LFD Monitoring

Configure how the intrusion monitor responds to repeated login failures and other suspicious activity.

Where to find it: Sign in as root, open Server > Firewall, then choose LFD Monitoring.

Available to: Root only.

Before you start

Security settings can also block legitimate visitors. Start with a narrow rule or monitoring mode where available, then check that normal access still works.

Why use it — and when not to

Use LFD Monitoring to reduce a specific, evidenced risk. Avoid broad blocks, global disables, or permanent exceptions when a monitor mode or narrower rule can solve the same problem.

How to use it

1. Choose which login failures or suspicious events to monitor.
2. Set the thresholds, block duration and notifications you need.
3. Save and review subsequent events to confirm the settings are suitable.

Intrusion Monitor controls

The current interface labels this function Intrusion monitor. It includes service installation/update, core enablement, login-failure bans, connection-storm and port-scan detection, temporary versus permanent responses, alert delivery, and log sources.

Select a limited response first, verify the relevant log source is producing events, and keep trusted automation sources in the appropriate ignore policy. Confirm both monitor state and an event/result before assuming a saved threshold is active.