Preemptive alerts in a connected environment
The present disclosure is related to devices, systems, and methods for preemptive alerts in a connected environment. An example device can include instructions to receive a log from a first log source, determine whether a pattern of events in the log exceeds an alert threshold of the first log source, wherein the pattern of events is associated with an event source, in response to the pattern of events exceeding the alert threshold, trigger an alert particular to the event source, and in response to the pattern of events exceeding the alert threshold, initiate a sensitivity threshold of a second log source that provides a same functionality as the first log source, wherein the sensitivity threshold is more sensitive than the alert threshold, and wherein the sensitivity threshold is particular to the event source.
1. A non-transitory machine-readable medium storing instructions executable by a processing resource to cause a computing system to:
receive a first log from a first log source;
determine whether a pattern of events in the first log exceeds an alert threshold of the first log source, wherein the pattern of events is associated with a particular client;
in response to the pattern of events in the first log exceeding the alert threshold, trigger a first alert particular to the client;
in response to the pattern of events in the first log exceeding the alert threshold, initiate a sensitivity threshold for a second log source that provides a same functionality as the first log source, wherein the second log source includes the alert threshold same as the first log source,
wherein the sensitivity threshold is less than the alert threshold, and wherein the sensitivity threshold is initiated particular to the client;
receive a second log from the second log source;
determine whether a pattern of events, corresponding to the particular client, in the second log exceeds the sensitivity threshold of the second log source; and
in response to the pattern of events in the second log exceeding the sensitivity threshold, trigger a second alert particular to the client.
2. The medium of claim 1 , wherein the instructions to determine whether the pattern of events in the first log exceeds the alert threshold include instructions to determine whether a particular number of events associated with the particular client occurred over a particular time period.
3. The medium of claim 2 , wherein the instructions include instructions to trigger the second alert in response to the determination that the pattern of events in the second log exceeds the sensitivity threshold but does not exceed the alert threshold.
4. The medium of claim 1 , Wherein the first and second log sources are email servers.
5. The medium of claim 1 , wherein the events are failed login attempts, and wherein the instructions to determine whether the pattern of events in the first log exceeds the alert threshold include instructions to determine that a number of failed login attempts to the first log source by the particular client exceeds a particular quantity.
6. The medium of claim 1 , wherein the first and second log sources are virtual computing instances.
7. The medium of claim 1 , wherein the sensitivity threshold is a user-defined quantity.
8. The medium of claim 1 , wherein the sensitivity threshold is a particular percentage of the alert threshold.
9. The medium of claim 1 , wherein the pattern of events in the first log exceeding the alert threshold is indicative of an attack on the first log source.
10. The medium of claim 9 , wherein the pattern of events in the first log exceeding the alert threshold indicates at least one of: a denial of service (DOS) attack, a distributed denial-of-service (DDoS) attack, and a brute-force attack.
11. The medium of claim 1 , wherein the pattern of events in the first log exceeding the alert threshold indicates a log source storage failure.
12. The medium of claim 1 , wherein the pattern of events in the first log exceeding the alert threshold indicates an application error.
13. A system, comprising:
a first log source configured to selectively permit client login;
a second log source configured to selectively permit client login, wherein the first and second log sources provide a same functionality, and wherein the second log source includes an alert threshold same as the first log source; and
a log management server having a memory and processor configured to execute instructions stored on the memory to:
receive a first log from the first log source, wherein the first log includes an identifier of a particular client and a number of failed login attempts to the first log source made by the client;
trigger a first alert responsive to a determination, from the first log, that the number of failed login attempts to the first log source made by the client exceeds the alert threshold;
initiate a sensitivity threshold for the second log source responsive to the determination, wherein the sensitivity threshold is particular to the client, and wherein the sensitivity threshold is less than the alert threshold;
receive a second log from the second log source, wherein the second log includes the identifier of the particular client and a number of failed login attempts to the second log source made by the client; and
trigger a second alert responsive to a determination, from the second log, that the number of failed login attempts to the second log source made by the client exceeds the sensitivity threshold.
14. The system of claim 13 , wherein the first and second log sources are virtual application servers.
15. The system claim 13 , wherein the identifier is an IP address associated with the client.
16. The system of claim 13 , wherein the alert threshold cannot be exceeded without exceeding the sensitivity threshold.
17. A method, comprising:
receiving a first event log associated with a first log source configured to selectively permit client login, wherein the first event log includes event information associated with each of a number of failed login attempts on the first log source made by a client, the event information including:
timestamp of the failed login attempt;
a source of the failed login attempt;
text associated with the failed login attempt; and
a name-value pair extracted from the failed login attempt;
determining, from the first event log, that the number of failed login attempts to the first log source made by the client exceeds a first threshold;
triggering a first alert and initiating a second threshold for a second log source responsive to the number of failed login attempts to the first log source made by the client exceeding the first threshold, wherein the second log source includes the alert threshold same as the first log source, and wherein the second threshold is particular to the client and less than the first threshold;
receiving a second event log associated with the second log source configured to selectively permit client login and provide a same functionality as the first log source, and wherein the second event log includes event information associated with each of a number of failed login attempts on the second log source made by the client;
triggering a second alert responsive to a determination, from the second event log, that the number of failed login attempts to the second log source made by the client exceeds the second threshold.
18. The medium of claim 17 , wherein the method includes receiving the first and second event logs from the first and second log sources, respectively.
19. The medium of claim 17 , wherein the method includes receiving the first and second event logs from a log aggregator.