Suspicious IP Throttling Attack Protection not Getting Triggered

rueben.tiow · January 25, 2024, 1:21am

Problem statement

Suspicious IP Throttling Attack protection is not getting triggered. The tenant logs show many errors for the specific IPs including:

“description”: “Missing required parameter: response_type”.

Solution

Suspicious IP Throttling protections exist as a layer of defense against credential stuffing style attacks (along with our Bot Detection). They specifically prevent a single IP from having an unbounded number of username/password checks when they continue to fail.

In the case of an invalid grant or response type, the username/password is never actually checked. The request is rejected based on schema definitions for that endpoint. This means that no information about the correctness of the credentials is ascertained and, therefore, Suspicious IP Throttling protections do not fire.

Topic		Replies	Views
Suspicious IP Throttling for Access Token Request Help attack-protection , suspicious-ip-throttling	0	279	May 26, 2024
Suspicious IP Throttling Help	4	3135	September 20, 2021
What happens if Suspicious IP Throttling and Brute-force Protection Maximum Attempt values are the same? Knowledge Articles brute-force , attack-protection , brute-force-protection , suspicious-ip-throttling	1	2802	July 28, 2022
Tenant Log Event Not Generated or Notification Email Not Received after an Attack Protection Feature is Triggered Knowledge Articles email , brute-force , notifications , limits , suspicious-ip-throttle , attack_protection	1	319	March 19, 2024
Threshold Manager for Suspicious IP Throttling Now Generally Available Announcements ip , threshold , manager , suspicious , throttling	1	2852	November 1, 2021

Suspicious IP Throttling Attack Protection not Getting Triggered

Problem statement

Solution

Related topics