Incident lab · LAB-S01
Knocking at the door
Wazuh raised a high-severity SSH alert on the bastion host. Work out whether anyone got in, contain the source, and classify the alert.
Security operationsStarterWazuh · Linux · SSH
C
Chiamaka · SOC shift lead
Alert 5712 fired on bastion-01: 'sshd brute force trying to get access'. Triage it. Did anyone get in? Contain it if it's real, then give me a verdict.
Simulated. Nothing real is affected.