How AutoOps AI Detected a Real-Time SSH Brute-Force Attack
By The AutoOps team
At 02:14 on a Tuesday, an agent on a client's web-01 did something quietly
important: it noticed a pattern that a dashboard would have buried and a human
would have slept through.
The signal
Over ninety seconds, sshd logged twelve failed authentication attempts from a
single source IP, cycling through common usernames — root, admin, deploy,
ubuntu. On its own, that's background noise; the public internet knocks on port
22 all day. What made this different came next: a successful login from the
same IP, immediately after the failures.
That's the pattern AutoOps is built to catch. Not "someone tried to log in" — everyone gets that — but success after failure from an attacking source, which is the fingerprint of a credential that finally worked.
Why on-host mattered
This is the kind of thing remote polling can't see reliably. The evidence lives in the auth log, in real time, on the machine. The agent reads it where it happens, correlates the failures with the success, and raises one finding with the whole story attached: the source IP, the count, the usernames tried, the timestamp of the breach.
No flood of forty alerts. One incident, with the root cause on top.
What it did next — and didn't
Here's the part that matters for trust: AutoOps didn't touch the firewall.
It generated a recommendation — the exact, host-tailored command to block that IP — and surfaced it for a human:
Block 45.33.22.184?
run: sudo fail2ban-client set sshd banip 45.33.22.184
The on-call engineer saw it, recognized the breach, and ran the command. Elapsed time from first failed attempt to blocked IP: under four minutes. No agent reached for a privileged action on its own. The human stayed on the trigger.
The takeaway
Detection without action is safe but slow. Autonomous action without consent is fast but dangerous. AutoOps sits deliberately in between: it does the seeing and the thinking in real time, and hands the deciding to you. For an attack that would otherwise have run until morning, "in between" turned out to be exactly fast enough.