I was doing some routine maintenance on a Windows Server 2008 box that I manage. When looking at the Security Log in the Windows Event Log interface I see a burst of 50-200 failed logins that happen over a 15 minute span. So it's obvious this is not someone who just forgot their password.
I know there are a lot of bots out there pinging servers and taking shots at firewalls. My question is if there is any yard stick to measure how bad the problem is? What is normal for a Windows Server running behind a firewall?