Brute Force Sentry for Managed SIEM
Huntress, Friday, November 6th, 2026
Huntress Managed SIEM's Brute Force Sentry flags brute force runs that end in successful logins on RDP, RD Gateway, RDWeb and SSH.
Huntress made Brute Force Sentry available to all Managed SIEM customers.
It watches internet-facing login surfaces including RDP, RD Gateway and RDWeb on Windows and SSH on Linux, and the Huntress SOC investigates when failed logons end in a successful one.
Huntress says generic threshold rules either flood teams with bot alerts or miss slow sprays, and cannot tell whether an attempt worked.
The feature reads Windows Security events, RD Gateway logs, Linux sshd and macOS telemetry and separates traditional and distributed brute force, spraying, credential stuffing and username enumeration, with evidence and hardening guidance.