# Source: firehose-exporter
---

- type: replace
  path: /instance_groups/name=prometheus2/jobs/name=prometheus2/properties/prometheus/custom_rules?/-
  value:
    name: UAAFailedLoginWrongPassword
    rules:
      - alert: UAAFailedLoginWrongPassword_Warning
        expr: sum(increase(firehose_value_metric_uaa_audit_service_client_authentication_failure_count[1h])) > 10
        labels:
          severity: warning
          notify: email
        annotations:
          summary: "UAA - Failed login: wrong password"
          description: "Anomalous levels of authentication attempts with an existing user name and wrong password. Number of failed login attempts per hour: {{ $value | printf \"%.0f\" }}"
          url: "https://team-manual.cloud.service.gov.uk/incident_management/responding_to_alerts/#failed-logins"

Migrate "UAA - Failed login: wrong password" monitor to Prometheus
Migrate "UAA - Failed login: wrong password" monitor to Prometheus

Original DataDog monitor:
avg(last_30m):anomalies(sum:cf.uaa.audit_service.user_authentication_failure_count{deployment:prod}, 'agile', 2, direction='above') >= 0.5
