Preemptive alerts in a connected environment

A system, comprising:

• a first log source configured to selectively permit client login;
• a second log source configured to selectively permit client login, wherein the first and second log sources provide a same functionality, and wherein the second log source includes an alert threshold same as the first log source;
• and
• a log management server having a memory and processor configured to execute instructions stored on the memory to:
• receive a first log from the first log source, wherein the first log includes an identifier of a particular client and a number of failed login attempts to the first log source made by the client;
• trigger a first alert responsive to a determination, from the first log, that the number of failed login attempts to the first log source made by the client exceeds the alert threshold;
• initiate a sensitivity threshold for the second log source responsive to the determination, wherein the sensitivity threshold is particular to the client, and wherein the sensitivity threshold is less than the alert threshold;
• receive a second log from the second log source, wherein the second log includes the identifier of the particular client and a number of failed login attempts to the second log source made by the client;
• and
• trigger a second alert responsive to a determination, from the second log, that the number of failed login attempts to the second log source made by the client exceeds the sensitivity threshold.

A method, comprising:

• receiving a first event log associated with a first log source configured to selectively permit client login, wherein the first event log includes event information associated with each of a number of failed login attempts on the first log source made by a client, the event information including:
• timestamp of the failed login attempt;
• a source of the failed login attempt;
• text associated with the failed login attempt;
• and
• a name-value pair extracted from the failed login attempt;
• determining, from the first event log, that the number of failed login attempts to the first log source made by the client exceeds a first threshold;
• triggering a first alert and initiating a second threshold for a second log source responsive to the number of failed login attempts to the first log source made by the client exceeding the first threshold, wherein the second log source includes the alert threshold same as the first log source, and wherein the second threshold is particular to the client and less than the first threshold;
• receiving a second event log associated with the second log source configured to selectively permit client login and provide a same functionality as the first log source, and wherein the second event log includes event information associated with each of a number of failed login attempts on the second log source made by the client;
• triggering a second alert responsive to a determination, from the second event log, that the number of failed login attempts to the second log source made by the client exceeds the second threshold.