[Brute Force attempts]

Hello,

In the future we will block access to this server from unknown IP addresses, but now, we want to receive a notification "ONLY" when we receive "5 o more"  failed login attempts in RDP and SQL.

I try  "Pulseway Counters", but don't work...Any idea?

 

[Brute Force attempts]

Hello.

We have a server with a lot of brute force attacks

RDP: 3389

SQL: 1433

We can see in event viewer two repeated events (failed loing attempts)

eventID: 4625 Microsoft Windows Security Auditing

eventID: 18456 MSSQLSERVER

 

We want to receive a notification when we receive "5 o more"  failed login attempts in RDP and SQL.

Can we use "Pulseway Counters" or "Pulseway evenlog"? How?