Ravi Sir's Cyber Security Cards › Interview Cards
How do you triage a brute-force SSH alert?
How do you triage a brute-force SSH alert? Check the source IP and volume, confirm if any login succeeded , block or rate-limit, and verify key-only login. Thousands of failures then one success means the account may be compromised, so escalate. “The key question is: did any attempt succeed? If yes,
Read card text
What this card says
Short answer
Check the source IP and volume, confirm if any login succeeded, block or rate-limit, and verify key-only login.
Example
Thousands of failures then one success means the account may be compromised, so escalate.
Say it in the interview
“The key question is: did any attempt succeed? If yes, I treat it as a breach.”
Why it matters
Failures are noise. A success is the real incident.
Learn more in the lesson: 46.8 SOC, IR, Hardening and Cryptography Questions