Posts about incident response
What happened, what we did, and what we changed afterward.
-
CH-0006
18,000 alerts before coffee: a brute-force attempt on our VPN
A low-and-slow login attack on our GlobalProtect VPN, how we stopped it, what the logs showed, and why we finally blocked inbound traffic from outside the US.