Hello,

Among all the options you mentioned, the best function of NGAF to protect internal hosts from SSH and RDP  brute force attack is IPS or Intrusion Prevention System. See explanation below:

- IPS monitors network traffic for malicious activities including brute force login attempts and can identify patterns of repeated failed login attempts on SSH and RDP ports.
- IPS functions beyond just identifying vulnerabilities unlike vulnerability scanners. it also actively block suspicious traffic which prevents hackers from gaining access to the internal hosts thru SSH or RDP brute force attempts

HiHi,

I recommend configuring the IPS feature in NGAF to enhance security and protect your internal hosts from brute-force attacks on SSH and RDP services.