Alert: SSHBruteForce

Symptom

More than 20 failed SSH authentication attempts in 10 minutes on a host (from audit/system journal).

Immediate action

Identify host from alert labels, then:

ssh <host> 'journalctl -u ssh --since "15 min ago" | grep -i "failed\|invalid" | tail -30'

Diagnosis

1. Source IPs: internet scanners vs misconfigured automation.
2. Confirm fail2ban or firewall posture if applicable.
3. Known false positive risk: legitimate scanners may trip threshold during calibration period.

Escalation

Ryan if same source targets multiple hosts or succeeds in auth.

Resolution history

Date	Notes