Set up the ModSec Brute force by IP Burst playbook

  • Versão de lançamento: Australia
  • Atualizado 12 de mar. de 2026
  • 1 min. de leitura

    • Use the following steps to set up the ModSec Brute force by IP Burst playbook.

    Antes de Iniciar

    Role required:
    • sn_si.admin
    • flow_designer

    Make sure you have installed Security Operations Spoke (sn_sec_spoke).

    Procedimento

    1. Login as a user with sn_si.user and flow_designer roles.
    2. Navigate to All > Flow Designer and select the ModSec Bruteforce by IP Burst playbook.
    3. Opcional: Create a copy of the ModSec Bruteforce by IP Burst playbook flow and make the necessary modifications.

      To create a copy of the playbook's flow, select the more actions menu icon (More actions menu) and select Copy flow. Perform this step only if you plan to customize or make specific changes to the flow.

      Figura 1. ModSec Brute force by IP Burst playbook
      Overview of the ModSec Brute force by IP Burst playbook.
    4. Activate the playbooks.
      1. Activate the main flow to use the playbook available in the base system.
      2. Activate the copied flows after making the required changes.
    5. Set a Trigger Condition for the playbook.
      This playbook is triggered and associated with the security incident when the following conditions are met:
      • Category is Unauthorized access.
      • Subcategory is Brute force password cracking attempts.
      Figura 2. ModSec Brute force by IP Burst playbook trigger condition
      Trigger condition for ModSec Brute force by IP Burst playbook.