Brute Force Protection policy settings in Nebula

The Brute Force Protection (BFP) policy settings in Nebula allow the endpoint agent to detect and block brute-force attacks on your Windows™ endpoints. When login attempts are made through Windows protocols, this feature counts unsuccessful login attempts within a specified period of time and temporarily blocks the incoming IP address by creating a Windows Firewall block rule. 

To locate the Brute Force Protection settings tab in your policy:

1. On the left navigation menu, go to Configure > Policies.
2. Select a policy.
3. Select the Brute Force Protection tab to see the specific settings available for each operating system.

For the default settings, see ThreatDown recommended policy for Nebula.

Requirements

To enable BFP, your endpoints must be running:

• Workstations: minimum version Windows 7
• Servers: minimum version Windows Server 2008 R2
• Windows Firewall

Supported protocols

• Workstations and servers:
  • RDP: Monitors Windows workstations and servers RDP protocol.
    Note: Remote Desktop Gateway servers are not supported.
• Servers only: 
  • FTP: Monitors FTP server application included with Windows servers.
  • IMAP: Monitors IMAP connections on Microsoft Exchange servers. 
  • Microsoft SQL: Monitors connections on Microsoft SQL servers and SQL Server Express. 
  • POP3:Monitors POP3 connections on Microsoft Exchange servers. 
  • SMTP: Monitors SMTP connections on Microsoft Exchange servers.
  • SSH: Monitors SSH connections on Windows Servers.

Configure Brute Force Protection

Below are the options for selecting a trigger rule:

• Block mode: Windows Firewall is automatically enabled; attacks are blocked for the defined period, and reported.
• Monitor and detect mode: Windows Firewall is not enabled; attacks are only reported.
  • Network gateway devices are not blocked if configured as the single source of all inbound network traffic.

To configure BFP:

1. Select the following protocols for your workstations or servers:
   • Workstation and server protocols: Check mark the RDP protocol.
   • Server-only protocols: Check mark the FTP, IMAP, MSSQL, POP3, SMTP, or SSH protocols.
2. Change Port fields based on your endpoint environment and protocol requirements. 
   • Workstation and server protocols: You may specify a custom port to monitor. Leave this blank to auto detect the port used on the endpoint based on the operating system.
   • Server-only protocols: These are defaulted to the Windows recommended port settings. Manually configure your port protocols if your server protocol settings are different from the Windows default ports. 
3. Create a Trigger rule based on the number of failed remote login attempts within a certain minute range across all enabled protocols. Choose to block the IP address, or monitor and detect the event when the trigger threshold is reached.
4. Optionally, check mark the Prevent private network connections from being blocked option. When enabled, endpoints within private network address ranges will not trigger BFP due to failed login attempts. This excludes the following network ranges:
   • 10.0.0.0/8 (10.0.0.0-10.255.255.255)
   • 172.16.0.0/12 (172.16.0.0-172.31.255.255)
   • 192.168.0.0/16 (192.168.0.0-192.168.255.255)
   • 127.0.0.0/8 (127.0.0.0-127.255.255.255)
     Note: Internal vulnerability and port scanners not included in those ranges above can generate intrusion alerts when the trigger rule is met. If you need to allow a specific IP address, create an exclusion on the Configure > Exclusions page. For more information, see Overview of exclusions in Nebula.
5. Click Save at the top-right of your policy.

When your BFP rule is triggered, the event is logged on your Detections page as an intrusion based on the protocol triggered. If your rule is set to block, a Windows Firewall rule is created on the endpoint and the event displays on the Brute Force Protection page. For more information, see Brute Force Protection in Nebula.

A dashboard widget is available to view a global map of all Brute Force detections for the past 7 days and includes targeted endpoint information. For more information, see Dashboard page in Nebula.