Knowledge BasePanther.comRelease NotesDemo Request
Search…
Overview
Quick Start
Data Sources & Transports
Writing Detections
Rules
Policies
Testing
Alert Summaries
Detection Packs
Caching
Data Models
Global Helper Functions
Report Mapping
Panther Developer Workflows: Detections
Triaging Alerts
Alert Runbooks
Built-in Policies
Built-in Rules
AWS CloudTrail Modified
AWS Config Service Modified
AWS Console Login Failed
AWS Console Login Without MFA
AWS EC2 Gateway Modified
AWS EC2 Network ACL Modified
AWS EC2 Route Table Modified
AWS EC2 SecurityGroup Modified
AWS EC2 VPC Modified
AWS IAM Policy Modified
AWS KMS CMK Loss
AWS Root Activity
AWS S3 Bucket Policy Modified
AWS Unauthorized API Call
Cloud Security Scanning
Destinations
Data Analytics
Enrichment (Beta)
System Configuration
Panther API (Beta)
Guides
Help
Powered By GitBook
AWS Console Login Failed
This rule monitors for failed AWS console logins.
Risk
Remediation Effort
Low
Low
Failed logins may be indicative of brute force attacks or the use of old compromised credentials.
Remediation
In small numbers, this does not bear investigation. In large numbers, check for the possibility of brute force attacks and consider upgrading password strength.
References
  • CIS AWS Benchmark 3.6: "Ensure a log metric filter and alarm exist for AWS Management Console authentication failures"
Previous
AWS Config Service Modified
Next
AWS Console Login Without MFA
Last modified 1yr ago
Copy link