Monitor only your authorized in-scope assets.
Session cookies are HttpOnly + SameSite. Login attempts are rate limited.