Add standalone Bash incident check scripts

2026-05-11 18:49:00 +00:00
parent 8a7b7c5abc
commit e851568c8c
27 changed files with 1623 additions and 6 deletions
@@ -0,0 +1,26 @@
+CRITICAL: Found 73 failed SSH login attempt(s) for requested window
+
+Top source IPs:
+52 203.0.113.44
+12 198.51.100.20
+9 192.0.2.10
+
+Top attempted users:
+31 admin
+24 oracle
+18 root
+
+Sample recent lines:
+May 11 10:01:02 host sshd[2201]: Failed password for invalid user admin from 203.0.113.44 port 51240 ssh2
+May 11 10:01:06 host sshd[2205]: Invalid user oracle from 198.51.100.20
+
+Evidence:
+Thresholds: warning=20 critical=50 since="1 hour ago"
+Log source: journalctl
+
+Recommended next steps:
+- Verify source IPs against expected scanners, admins, or automation
+- Check firewall, fail2ban, or security tooling state
+- Confirm whether the attempts are expected for this host
+- Review successful logins too, not only failures
+- Attach this output to incident ticket