Firewall / VPN Gateway Logs - Multiple Failed VPN Logins + Success (Brute Force)

Ankit Mehta@Secvyn

•updated Sep 13, 2026•3•0•6

This rule detects a sequence of authentication activity on VPN gateways (Palo Alto, Fortinet, Cisco) where a source IP experiences multiple failed login attempts followed by at least one successful login within a 60-minute window, potentially indicating a successful brute force or password spraying attack.