change detection rules default to alert only

app/dashboard/threat_analysis.go

@@ -143,9 +143,9 @@ func (ta *ThreatAnalyzer) insertDefaultRules() error {
 			Description: "Detect SSH brute force attempts",
 			Service:     "ssh",
 			Condition:   "auth_attempts",
-			Threshold:   10,
+			Threshold:   5,
 			TimeWindow:  60, // 1 hour
-			Action:      "block",
+			Action:      "alert",
 			Enabled:     true,
 		},
 		{
@@ -163,9 +163,9 @@ func (ta *ThreatAnalyzer) insertDefaultRules() error {
 			Description: "Detect port scanning across multiple services",
 			Service:     "*",
 			Condition:   "service_diversity",
-			Threshold:   5, // 5 different services
+			Threshold:   3,  // 3 different services
 			TimeWindow:  15, // 15 minutes
-			Action:      "block",
+			Action:      "alert",
 			Enabled:     true,
 		},
 		{
@@ -173,9 +173,9 @@ func (ta *ThreatAnalyzer) insertDefaultRules() error {
 			Description: "Detect FTP brute force attempts",
 			Service:     "ftp",
 			Condition:   "auth_attempts",
-			Threshold:   15,
+			Threshold:   5,
 			TimeWindow:  60,
-			Action:      "block",
+			Action:      "alert",
 			Enabled:     true,
 		},
 	}