Audit security events

Pull the security event logs for the past 7 days from the intrusion-detection host, filter for failed SSH logins and sudo denials, aggregate by source IP, and send a one-page summary to Priya in security with indicators of compromise highlighted by 5pm today.

Before I hand this to the security team, make the audit easier to act on: surface the top five suspicious IPs up front, show time ranges where failures clustered, link each IP to known blacklist hits, and flag events with matching user accounts that had privilege escalation attempts.

The monitoring alerted me to a sudden spike of failed SSH logins on host-db1 over the last hour. I can't tell whether it is a noisy scanner hitting many accounts or a targeted credential-stuffing attempt against a handful of users. Which quick diagnostics should I run now to distinguish the two and what immediate containment action should I take if it's targeted?

Our security alerts keep producing noisy failed-login spikes so real incidents get buried and response slows. Which change will reduce false positives and surface true escalations: tuning rate thresholds per host, enforcing account lockouts after a few failures, or correlating with external blacklist feeds? Recommend the single most effective change and one metric to measure improvement this quarter.