get_login_failures_by_ip
Retrieves login failure statistics grouped by source IP to identify potential brute-force attacks, with configurable date range and top IP count.
Instructions
Get login failure statistics broken down by source IP.
Args: date_from: Start date (YYYY-MM-DD). Defaults to last 24h when omitted (KEYCLOAK_DEFAULT_DATE_FROM_HOURS). date_to: End date (YYYY-MM-DD). Empty for all. top: Number of top IPs to show (default 20).
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| date_from | No | ||
| date_to | No | ||
| top | No |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |