API Authentication Failure Spike Detection

Track HTTP 401 Unauthorized and 403 Forbidden responses across OpenStack API endpoints (Nova, Neutron, Glance, Cinder). Monitor Keystone token validation errors and authentication latency. Alert on sudden spikes in auth failures.

Check Keystone service health and database connectivity. Verify token expiration policies aren't too aggressive. Investigate if specific users/projects are affected. Review for potential credential compromise or brute-force attempts.