Brute force detection
Note: Brute force detection can be enabled only if the Firewall module is also active.
General Settings
Block RDP port on brute force detection - automatically blocks the RDP port on an endpoint when multiple failed login attempts (an audit breach) are detected, for both TCP and UDP, preventing unauthorized access. Once the RDP port is blocked on an endpoint, a Blocked RDP icon is shown in the Status column. Blocked endpoints can be viewed and unblocked from the Device Info page: select the endpoint in question and click Unblock RDP Port from the dropdown menu. The Unblock RDP Port option is then replaced by Cancel Unblock RDP Port, which cancels the unblock action. The RDP port is not blocked if the brute force attempts originate from the private network, and the Unblock RDP Port option does not appear if the RDP port is not blocked. This option is available only when Brute force detection is enabled.
Applying the Unblock RDP Port option shows the following notification:
RDP Port - the port(s) monitored for RDP brute force detection. Accepts single or multiple port values within the range 1–65535, separated by commas (e.g., 3389,3390). Editing the ports in either the Brute Force Attack Protection or the Remote Access Protection (RAP) section automatically synchronizes the values to maintain consistency across both modules.
Note: If the default RDP port (3389) is changed, brute force detection will no longer work.
Allowlist
The Allowlist allows you to add specific IP addresses to be excluded from brute force detection (for example, an IP that is detected as a brute force attack but is considered a false positive). Enter an IP in the Add an IP to the allowlist field, or search the existing entries. Entries are listed in a grid with the Value, Expiration date, and Action columns; each entry can have an optional expiration date and can be edited or deleted as needed.