# Source: https://docs.datadoghq.com/security/default_rules/def-000-vbc.md

---
title: Keycloak multiple login error events from the same IP address
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > Keycloak multiple login error events
  from the same IP address
---

# Keycloak multiple login error events from the same IP address

{% alert level="danger" %}
This rule is part of a beta feature. To learn more, [contact Support](https://docs.datadoghq.com/help/).
{% /alert %}
Classification:attackTactic:[TA0006-credential-access](https://attack.mitre.org/tactics/TA0006)Technique:[T1110-brute-force](https://attack.mitre.org/techniques/T1110) 
## Goal{% #goal %}

Detects when there are multiple login error events generated by the same IP address.

## Strategy{% #strategy %}

This rule lets you monitor multiple events related to a login error type from the same IP address.

## Triage and response{% #triage-and-response %}

1. Examine the login error events and assess the source: `{{@network.client.ip}}` and on realm: `{{@realmName}}`.
1. Identify the users impacted by these login error events.
1. Block the IP address where these events are originating.
1. Temporarily suspend the accounts of affected users to mitigate potential malicious activity.
1. Initiate a password reset for the affected users.