SQL Server
Event 18456 (failed logon) and connection probes from the application log, for all or selected instances, including SQL Server Express.
SQL Server & databases
Protect SQL Server, MySQL and PostgreSQL against brute force
A database port reachable from the internet is probed for sa and weak passwords. ServerBouncer detects the failed logons and blocks the source before a password matches.
MySQL and PostgreSQL
Dedicated profiles evaluate failed logons of MySQL and PostgreSQL.
Decoy accounts
sa, root or admin are default decoys: a single attempt is enough for a block – unless the account is on your exception list.
Even better: don't open the port at all
If the database only needs to be reachable for certain admins, make the SQL port a protected service. It stays closed for everyone and opens via sbc knock for a registered device only.
SQL Server reports successful logons only if success auditing is enabled there.
More use cases
Try ServerBouncer on your servers
Starts in learning mode – you first see what would be blocked.