Just checked our IDS rules earlier today and noticed we were still on defaults and the defaults are very gentle.

Are people using the defaults or are you lowering the thresholds and increasing the block times? I'm wondering if maybe I just wasn't paying attention.

We lowered the thresholds and increased the block times substantially today and haven't gotten any tickets yet, so likely will push them even more tomorrow. With our VOIP systems we block IP addresses for weeks or months or even years sometimes if they try to brute force us. I feel like it's worth it to have a few more support tickets then to risk these brute force attacks catching a user with a horrible weak password.