diff --git a/rsyslog/map.jinja b/rsyslog/map.jinja
index cdcce0a..b5c7b8b 100644
--- a/rsyslog/map.jinja
+++ b/rsyslog/map.jinja
@@ -153,3 +153,9 @@
 {%- endload %}
 {%- set global = salt['grains.filter_by'](base_defaults, merge=salt['pillar.get']('rsyslog:client')) %}
 {%- set server = salt['pillar.get']('rsyslog:server', {}) %}
+
+{%- set monitoring = salt['grains.filter_by']({
+  'default': {
+    'failed_auths_per_sec': 0.2,
+  },
+}, grain='os_family', merge=salt['pillar.get']('rsyslog:monitoring')) %}
diff --git a/rsyslog/meta/prometheus.yml b/rsyslog/meta/prometheus.yml
index 4f6211a..0bf48f8 100644
--- a/rsyslog/meta/prometheus.yml
+++ b/rsyslog/meta/prometheus.yml
@@ -1,4 +1,4 @@
-{%- from "rsyslog/map.jinja" import global with context %}
+{%- from "rsyslog/map.jinja" import global, monitoring with context %}
 
 {%- if global.get('enabled', False) %}
 {%- raw %}
@@ -6,7 +6,7 @@
   alert:
     FailedLoginsTooHigh:
 {%- endraw %}
-      {%- set threshold = prometheus_server.get('alert', {}).get('FailedAuthsTooHigh', {}).get('var', {}).get('threshold', 0.2 ) %}
+      {%- set threshold = monitoring.failed_auths_per_sec|float %}
       if: >-
         rate(failed_logins_total[5m]) > {{ threshold }}
 {%- raw %}