Catch the Brute Force: Write the Detection, Tune Out the Noise

A SOC alert says host web01 got hammered on SSH overnight and an account may be compromised. Reading /var/log/auth.log you'll find a brute-force burst from one source, then a successful login from that same source — the compromise. But the log also has a legit user (luke) who fat-fingered their password twice before logging in normally. Your job isn't just to eyeball it once: build the DETECTION a SOC would actually run.

1. Identify the brute-force source IP and record it in /root/case/attacker_ip.txt.

2. Write a detector at /root/detect.sh that reads auth.log on stdin and prints the source IP(s) it flags as brute-force, one per line. Grading runs it as bash /root/detect.sh < /var/log/auth.log. Grading also feeds it a second, unseen log the same way, so it must work from what it reads on stdin, not from a hardcoded file path or answer.

3. Tune it: it MUST flag the attacker AND must NOT flag luke's address (two failures is a typo, not an attack). A detector that flags any failed password is too noisy — that false positive fails grading. Brute force is about VOLUME from one source: count failed passwords per IP and threshold it. MITRE ATT&CK: T1110 (Brute Force).