Getting brute force admin access attack from WAN but access is turned off?

Hi AllanD  Please click on detailed view and search for the IP 174.207.35.41 to see all module logs and that will give more info for failed attempt events, may be possible VPN attempt login is getting failed and an alert has been triggered. Please also ensure inside local ACL no specific rule there to allow login for specific outside IP for SSH or Web admin.

Thank-you Vishal - That helped me a lot.  Turns out it was something trying to brute force it's way into a internal website that is being protected by WAF / Forms without Passthrough on the firewall which is why the alert was coming through on there as that was blocking it. 

Hi AllanD Thanks for sharing the findings here for community user's reference and I am glad you managed to figure out the required information based on the given suggestion. 

Hi AllanD Thanks for sharing the findings here for community user's reference and I am glad you managed to figure out the required information based on the given suggestion.