# vim: tw=2 sw=2 :
groups:
- name: meta.sr.ht
  rules:
  - alert: High rate of login failures
    expr: increase(meta_logins_failed_total[10m]) > 10
    labels:
      severity: important
      security: true
    annotations:
      summary: "Unusual number of failed logins"
  - alert: Sustained attack on user logins may be underway
    expr: increase(meta_logins_failed_total[10m]) > 10
    for: 30m
    labels:
      severity: urgent
      security: true
    annotations:
      summary: "Sustained attack on user logins may be underway"
  - alert: High rate of password resets
    expr: increase(meta_pw_resets_total[10m]) > 5
    labels:
      severity: urgent
      security: true
    annotations:
      summary: "Unusual number of password resets"
  - alert: High rate of user registrations
    expr: increase(meta_registrations_total[10m]) > 5
    labels:
      severity: interesting
    annotations:
      summary: "High rate of user registrations"
  - alert: High rate of unconfirmed accounts
    expr: rate(meta_registrations_total[24h]) - rate(meta_confirmations_total[24h]) > 0.0002
    labels:
      severity: important
    annotations:
      summary: "High rate of unconfirmed accounts - email delivery issues?"