Defensive / Blue

Fail2ban

Bans IPs that show malicious signs (e.g., too many SSH failures).

beginner

Linux

Defense

Authorized testing only. Practice on systems you own, isolated labs, or targets with written permission. Unauthorized access is illegal.

Hardening internet-facing lab services against noisy scans.

Enable jails for sshd/http; tune thresholds; monitor bans.

Practical host defense you can deploy today.

Commands & usage

sudo systemctl enable --now fail2ban

sudo fail2ban-client status sshd

Commands are educational examples. Adapt hosts, paths, and rates to your authorized scope.

Sigma Rules

Generic detection rule format convertible to SIEM queries.

osquery

SQL-powered endpoint visibility agent.

Suricata

Network IDS/IPS and network security monitoring engine.

Wazuh

Open-source XDR/SIEM platform for log analysis and FIM.