Log Correlator - Incident Dashboard

Generated 2026-10-10T23:25:52 · event window 2026-08-30T03:09:00+00:00 → 2026-08-31T09:05:00+00:00
log-correlator-siem · local, dependency-free correlation engine
34
Events ingested
5
Incidents
2
Critical
1
High
2
Medium
0
Low

MITRE ATT&CK techniques observed

T1078
Valid Accounts
Initial Access / Persistence
×1
T1041
Exfiltration Over C2 Channel
Exfiltration
×1
T1110.001
Brute Force: Password Guessing
Credential Access
×1
T1046
Network Service Discovery
Discovery
×1
T1548.003
Abuse Elevation Control Mechanism: Sudo and Sudo Caching
Privilege Escalation
×1

Incidents

Successful login from 203.0.113.45 following brute force T1078 · Valid Accounts ▾

User 'root' successfully authenticated from 203.0.113.45 at 2026-08-30T03:14:52+00:00, within 300s of a brute-force burst from the same IP. The account should be treated as potentially compromised.

src_ip: 203.0.113.45user: root

Recommended action: Force a password reset for the account, invalidate active sessions, and review actions taken by this login for further lateral movement.

TimestampSourceEventRaw
2026-08-30T03:14:02+00:00authssh_failed_password2026-08-30T03:14:02+00:00 web01 sshd[1204]: Failed password for invalid user admin from 203.0.113.45 port 51422 ssh2
2026-08-30T03:14:07+00:00authssh_failed_password2026-08-30T03:14:07+00:00 web01 sshd[1205]: Failed password for root from 203.0.113.45 port 51430 ssh2
2026-08-30T03:14:14+00:00authssh_failed_password2026-08-30T03:14:14+00:00 web01 sshd[1206]: Failed password for root from 203.0.113.45 port 51438 ssh2
2026-08-30T03:14:22+00:00authssh_failed_password2026-08-30T03:14:22+00:00 web01 sshd[1207]: Failed password for invalid user admin from 203.0.113.45 port 51446 ssh2
2026-08-30T03:14:30+00:00authssh_failed_password2026-08-30T03:14:30+00:00 web01 sshd[1208]: Failed password for root from 203.0.113.45 port 51454 ssh2
2026-08-30T03:14:52+00:00authssh_accepted_password2026-08-30T03:14:52+00:00 web01 sshd[1211]: Accepted password for root from 203.0.113.45 port 51478 ssh2
Large outbound transfer 10.0.0.14 -> 198.51.100.200 T1041 · Exfiltration Over C2 Channel ▾

75,000,000 bytes sent from internal host 10.0.0.14 to external host 198.51.100.200 over tcp/443 at 2026-08-30T23:47:12+00:00 (outside business hours).

src_ip: 10.0.0.14dst_ip: 198.51.100.200

Recommended action: Confirm the transfer was expected (backup job, approved sync). If not, isolate the host and inspect for exfiltration tooling or a compromised process.

TimestampSourceEventRaw
2026-08-30T23:47:12+00:00firewallfirewall_flow2026-08-30T23:47:12+00:00,10.0.0.14,198.51.100.200,443,tcp,ALLOW,75000000
SSH brute force from 203.0.113.45 T1110.001 · Brute Force: Password Guessing ▾

5 failed SSH password attempts from 203.0.113.45 within 120s, targeting user(s): admin, root.

src_ip: 203.0.113.45users: admin, root

Recommended action: Block or rate-limit the source IP, confirm targeted accounts were not compromised, and review fail2ban / SSH key-only auth policy.

TimestampSourceEventRaw
2026-08-30T03:14:02+00:00authssh_failed_password2026-08-30T03:14:02+00:00 web01 sshd[1204]: Failed password for invalid user admin from 203.0.113.45 port 51422 ssh2
2026-08-30T03:14:07+00:00authssh_failed_password2026-08-30T03:14:07+00:00 web01 sshd[1205]: Failed password for root from 203.0.113.45 port 51430 ssh2
2026-08-30T03:14:14+00:00authssh_failed_password2026-08-30T03:14:14+00:00 web01 sshd[1206]: Failed password for root from 203.0.113.45 port 51438 ssh2
2026-08-30T03:14:22+00:00authssh_failed_password2026-08-30T03:14:22+00:00 web01 sshd[1207]: Failed password for invalid user admin from 203.0.113.45 port 51446 ssh2
2026-08-30T03:14:30+00:00authssh_failed_password2026-08-30T03:14:30+00:00 web01 sshd[1208]: Failed password for root from 203.0.113.45 port 51454 ssh2
Possible port scan: 203.0.113.45 -> 10.0.0.5 T1046 · Network Service Discovery ▾

203.0.113.45 probed 10 distinct ports on 10.0.0.5 within 60s (ports: [21, 22, 23, 25, 80, 443, 445, 3306, 3389, 8080]).

src_ip: 203.0.113.45dst_ip: 10.0.0.5

Recommended action: Verify whether this is an authorized vulnerability scan; if not, block the source at the perimeter and review what, if anything, responded.

TimestampSourceEventRaw
2026-08-30T03:16:01+00:00firewallfirewall_flow2026-08-30T03:16:01+00:00,203.0.113.45,10.0.0.5,21,tcp,DENY,60
2026-08-30T03:16:03+00:00firewallfirewall_flow2026-08-30T03:16:03+00:00,203.0.113.45,10.0.0.5,22,tcp,ALLOW,60
2026-08-30T03:16:05+00:00firewallfirewall_flow2026-08-30T03:16:05+00:00,203.0.113.45,10.0.0.5,23,tcp,DENY,60
2026-08-30T03:16:07+00:00firewallfirewall_flow2026-08-30T03:16:07+00:00,203.0.113.45,10.0.0.5,25,tcp,DENY,60
2026-08-30T03:16:09+00:00firewallfirewall_flow2026-08-30T03:16:09+00:00,203.0.113.45,10.0.0.5,80,tcp,ALLOW,220
2026-08-30T03:16:11+00:00firewallfirewall_flow2026-08-30T03:16:11+00:00,203.0.113.45,10.0.0.5,443,tcp,ALLOW,220
2026-08-30T03:16:13+00:00firewallfirewall_flow2026-08-30T03:16:13+00:00,203.0.113.45,10.0.0.5,445,tcp,DENY,60
2026-08-30T03:16:15+00:00firewallfirewall_flow2026-08-30T03:16:15+00:00,203.0.113.45,10.0.0.5,3306,tcp,DENY,60
2026-08-30T03:16:17+00:00firewallfirewall_flow2026-08-30T03:16:17+00:00,203.0.113.45,10.0.0.5,3389,tcp,DENY,60
2026-08-30T03:16:19+00:00firewallfirewall_flow2026-08-30T03:16:19+00:00,203.0.113.45,10.0.0.5,8080,tcp,DENY,60
Sudo failure(s) then success for user 'hans' T1548.003 · Abuse Elevation Control Mechanism: Sudo and Sudo Caching ▾

User 'hans' had 2 sudo authentication failure(s) followed by a successful command ('/usr/sbin/useradd -m svc-backup') within 600s.

user: hans

Recommended action: Confirm the command was authorized by the account owner; if not, treat the session as compromised and audit sudoers configuration.

TimestampSourceEventRaw
2026-08-30T03:25:00+00:00authsudo_auth_failure2026-08-30T03:25:00+00:00 web01 sudo: pam_unix(sudo:auth): authentication failure; logname=hans uid=1000 euid=0 tty=/dev/pts/0 ruser=hans rhost= user=hans
2026-08-30T03:25:04+00:00authsudo_auth_failure2026-08-30T03:25:04+00:00 web01 sudo: pam_unix(sudo:auth): authentication failure; logname=hans uid=1000 euid=0 tty=/dev/pts/0 ruser=hans rhost= user=hans
2026-08-30T03:25:31+00:00authsudo_command2026-08-30T03:25:31+00:00 web01 sudo: hans : TTY=pts/0 ; PWD=/home/hans ; USER=root ; COMMAND=/usr/sbin/useradd -m svc-backup