Tagged with log-analysis

Find SSH attacker subnets in /var/log/secure: a quickref

One-liner to surface the top attacking /24 subnets in /var/log/secure during an SSH brute-force wave, plus per-username and per-minute variations.