HIDS 50106
From Atomicorp Wiki
| Rule 50106 | |
|---|---|
| Status | Active |
| Alert Message | Database authentication failure. |
Contents |
Description
This event not caused by ASL.
This event means that mysql has reported that an authentication attempt was made against mysql and it failed. ASL simply reports when this occurs. Disabling this rule will not prevent this from happening in mysql. It will just result in ASL no longer reporting when this happens.
You should investigate this event as it may be part of a broader attack.
Troubleshooting
False Positives
No false positives are known to exist for this. The event is not caused by ASL, but rather mysql reports to ASL that it has experienced an authentication failures.
Additional Information
Similar Rules
Knowledge Base Articles
None.
