Read a server log and point at the attacks SENTRY
The evidence of an attack is usually in a log nobody has time to read. This reads it in the browser, groups it by source, and points at the brute force, the scanning and the requests carrying a payload.
The log
What stands out
How it works
How to read this
Addresses and accounts are ordered worst first: a login after failures, a new administrator and requests carrying a payload sit above raw scanning. It reads volume and signature, not intent, so confirm before blocking - a busy legitimate client can look like a scanner, and a slow attack can stay under the line. Export the list to feed a block list, and keep the raw log with CHAIN if it may be evidence.
What it looks for
By address: 8 failed logins is noted and 20 is a brute force; a success after 5 failures is a possible compromise; failures against 10 or more different usernames is password spraying or credential stuffing; 5 non-existent usernames is enumeration; 12 requests to missing paths is noted and 30 is scanning; and any request carrying an attack payload or a scanner’s user-agent.
By account: failures from 5 or more addresses is one account tried from many places, and 20 is a distributed brute force; a success after failures from 5 addresses is a possible compromise. From sudo, su, useradd, usermod and gpasswd in the same log: sudo refused (not in sudoers), 3 wrong sudo passwords, 3 failed su to root, a root shell or su through sudo, commands that change accounts or permissions, an account first using sudo in the second half of a log whose first half shows others using it, an account created or given UID 0, and an account added to sudo, wheel, admin, root, docker or lxd.
Auth0 logs (a JSON array, or one event per line) count failed logins (f, fp, fu) and successes (s) the same way, and add Auth0’s blocks (limit_wc, limit_mu, limit_sul), breached passwords (pwd_leak), 3 failed or rejected MFA challenges, an MFA factor changed on an account with failed sign-ins, 5 failed Management API calls (fapi), and successful ones (sapi) from an address that failed sign-ins.
Syslog lines in either the RFC 3164 or the RFC 5424 format are read by the program named in them. A file is read a piece at a time, so a log of several hundred megabytes does not stall the page; only the counts are kept, with up to five example lines for each address and account. Where an address is on a map is not looked at.
Doing this often? The Sovereign Console reads logs and the rest of the evidence into one case and timeline, with Sigma rules to hunt across them. On its own, US$4 a month; with everything else, US$9 a month or US$79 a year. 7 days free.