get_login_failures_by_ip
Retrieve login failure statistics grouped by source IP to identify potential brute force or malicious activity. Specify date range and limit results to top IPs.
Instructions
Get login failure statistics broken down by source IP.
Args: date_from: Start date (YYYY-MM-DD). Defaults to last 24h when omitted (KEYCLOAK_DEFAULT_DATE_FROM_HOURS). date_to: End date (YYYY-MM-DD). Empty for all. top: Number of top IPs to show (default 20).
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| top | No | ||
| date_to | No | ||
| date_from | No |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |