OSSEC / HIDS Rule 40111

OSSEC / HIDS rule catalog

• Rule family: OSSEC / HIDS
• Rule ID: 40111
• Definition status: Present in current source
• Alert message / subject: Multiple authentication failures.
• Rule level: 10
• Definition checked: 2026-10-21
• Configured frequency: 10
• Timeframe (seconds): 160

Correlation values are configuration attributes; event-count behavior depends on the manager version and parent rules.

Interpretation and response

This event is recorded as “Multiple authentication failures.” Review the originating log and the affected host or service to determine whether the activity was expected.

An OSSEC/HIDS event records or correlates activity. Blocking depends on the originating application and any separately configured Active Response policy; an alert alone does not prove that an attack was blocked.

Documentation

The following guidance was migrated from the historical wiki and reviewed against the rule definition. Legacy ASL product names and interface instructions refer to the versions documented then. Use the current metadata above and your installed configuration when interpreting thresholds, notification settings and response behavior.

Rule ID

40111

Status

The wiki marked this rule Active at the source revision. Current definition status is shown above.

Description

This rule detects multiple authentication failures from the same IP, across multiple protocols. It is a “meta” or correlation rule for ASL, where ASL will look all the activity from a source and develop a profile of the activity from that source. In this case, this rule evaluates all authentication failures that are detected from all the services running on the system, and evaluates if a large number of failures is detected from a single IP source. The intent of this rule is to detect a malicious party attempting a denial of service attack, or attempting to break into the system by trying multiple passwords and/or accounts, or “brute force” password guessing.

The default settings are to detect 10 authentication failures in 160 seconds.

False Positives

This rule can be falsely triggered if multiple users are using the same IP address, such as behind a firewall and multiple users or the same user causes more than 10 authentication failures within 160 seconds (this can be across multiple protocols, or the same protocol).

This can also happen when large number of users from a single IP does this, or a client that can generate multiple connections at the same time (as with the IMAPX protocol) causes multiple authentication failures, or a user that has initiated multiple login failures at a high rate, or a client that has initiated multiple failures across multiple protocols within a period of time, or any combination of these.

If you believe that this is a false positive, then disable this rule, using the ASL rule manager (historical reference) or whitelist the source IP.

Tuning Recommendations

None.

Source and revision

Migrated from HIDS_40111, wiki page 210, revision 1783 (20110730). Documentation review: 2026-10-21. An archived wiki status of Active is not a current deployment status.

For assistance, provide the rule ID, installed product and rule version, and a sanitized event to Atomicorp support .