Brute force not triggered

[mgusta]

Hi,

I would like to stop (block) an ip when there are a number of failed logon attempts but I cant get it to work. The vulnurability signatures are not being triggered. The other day someone tried over 400 different user names against out owa. 6 tries for each. None were sucessfull, and we use MFA, but I still want to halt the attack. Can it be done? I´ve enabled inbound decryption and now I see application Outlook-web insteaf of just ssl. I´ve also created exceptions for all brute force signatures to trigger after just 5 repeats for testing. But no child signatures (failed log on attempt etc.) are triggered so the parent signature never fires no matter how low I set the threashold. What could be wrong? Is the decryption still not working fully so the failed attempts are hidden in the ssl stream? How can I troubleshoot?

Thanks,

Mikael