The "content" Property from the limit_mu Event Code Mismatches the Suspicious IP Throttling Configuration when Using Datadog for Log Streaming

Knowledge Articles
, ,
1

Overview

When using Datadog as the log streaming service, the “content” property for the limit_mu log entries will show:

An IP address is blocked with 100 failed login attempts using different usernames, all with incorrect passwords in 24 hours, or 50 sign-up attempts per minute from the same IP address.

The 100 failed login attempts do not align with the configuration from the tenant’s Suspicious IP throttling attack protection or with the failed login attempts from the tenant logs.

Applies To

  • Datadog log stream

Cause

The “content” property comes from a Datadog enrichment that adds the event filter description from this documentation.

Solution

Use the “data.description” property in the Datadog to reflect what is obtained from the tenant logs for event code limit_mu.