The sensor checks its sources every 5 minutes and records here whatever changed since the previous check.
A single address seen by several defences at once. These are no longer scattered lines in the feed, but a sequence of actions: reconnaissance, password guessing, an attempted login.
| Address | Defences | Events | Last seen |
|---|---|---|---|
| 198.51.100.13 | ssh fail2ban suricata | 31 | 12.10.2026 01:56 |
| Time | Severity | Source | Message | Count |
|---|---|---|---|---|
| 12.10.2026 01:56 | Warning | ssh |
SSH: login from a new address deploy@198.51.100.13
|
1 |
| 12.10.2026 01:11 | Warning | fail2ban | Fail2ban: new bans | 6 |
| 12.10.2026 00:11 | Warning | suricata |
Suricata: new alerts ET SCAN Nmap Scripting Engine User-Agent 198.51.100.13
|
14 |
| 11.10.2026 23:17 | Info | service | Protection service is running again: crowdsec | 1 |
| 11.10.2026 21:20 | Warning | fail2ban | Fail2ban: new bans | 5 |
| 11.10.2026 19:59 | Critical | service | Protection service stopped: suricata | 1 |
| 11.10.2026 14:05 | Warning | network |
A new port is reachable from outside 5432
|
1 |
| 11.10.2026 13:03 | Warning | fail2ban | Fail2ban: new bans | 5 |
| 11.10.2026 05:57 | Warning | network |
A new port is reachable from outside 3000
|
1 |
| 11.10.2026 03:52 | Warning | fail2ban | Fail2ban: new bans | 5 |
| 11.10.2026 03:48 | Info | service | Protection service is running again: crowdsec | 1 |
| 11.10.2026 00:23 | Critical | ssh |
SSH: root login deploy@198.51.100.20
|
1 |
| 10.10.2026 23:04 | Critical | falco |
Falco: critical events Read of sensitive file /etc/shadow
|
1 |
| 10.10.2026 21:20 | Warning | ssh |
SSH: login from a new address deploy@198.51.100.14
|
1 |
| 10.10.2026 10:12 | Critical | falco |
Falco: critical events Write below /usr/bin
|
1 |
| 10.10.2026 05:01 | Warning | suricata |
Suricata: new alerts ET SCAN Nmap Scripting Engine User-Agent 198.51.100.18
|
14 |
| 10.10.2026 01:34 | Warning | network |
A new port is reachable from outside 3000
|
1 |
| 10.10.2026 00:12 | Critical | service | Protection service stopped: suricata | 1 |
| 09.10.2026 14:11 | Info | service | Protection service is running again: crowdsec | 1 |
| 09.10.2026 06:36 | Warning | suricata |
Suricata: new alerts ET SCAN Nmap Scripting Engine User-Agent 198.51.100.35
|
9 |
| 08.10.2026 23:13 | Warning | suricata |
Suricata: new alerts ET WEB_SERVER SQL Injection Attempt 198.51.100.18
|
23 |
| 07.10.2026 00:28 | Warning | suricata |
Suricata: new alerts ET WEB_SERVER SQL Injection Attempt 198.51.100.13
|
9 |
| 06.10.2026 15:49 | Critical | ssh |
SSH: root login deploy@198.51.100.13
|
1 |
| 06.10.2026 14:12 | Warning | network |
A new port is reachable from outside 8080
|
1 |
| 06.10.2026 12:22 | Critical | falco |
Falco: critical events Shell spawned in a container (user=www-data)
|
1 |