Investigating an SSH brute force in my home lab: 357 failed logins, one stolen account
Structured on the NIST SP 800-61 incident response lifecycle. Own lab: the attack was run on purpose against a throwaway account, then investigated from the logs as if it were a real alert. Field
