git clone https://github.com/Ayush-Parab/cybersecurity-agentic-AI
cd cybersecurity-agentic-AI

pip install -r requirements.txt

OPENAI_API_KEY="la_tua_chiave"
LOG_ANALYTICS_WORKSPACE_ID="il_tuo_id"

TimeGenerated,Status,User,IPAddress,Computer,SyslogMessage
2026-02-12 02:00:15.912351+00:00,Failure,,,Test-VM-For-Logs,Connection closed by invalid user  98.80.4.65 port 35908 [preauth]
2026-02-12 02:00:15.706067+00:00,Failure,,98.80.4.65,Test-VM-For-Logs,Invalid user  from 98.80.4.65 port 35908
2026-02-12 01:59:38.275807+00:00,Success,Ayush,103.38.69.120,Test-VM-For-Logs,Accepted password for Ayush from 103.38.69.120 port 31551 ssh2
2026-02-12 01:59:24.542329+00:00,Failure,,,Test-VM-For-Logs,Connection reset by invalid user balloon 103.38.69.120 port 31573 [preauth]
2026-02-12 01:59:22.850922+00:00,Failure,balloon,103.38.69.120,Test-VM-For-Logs,Failed password for invalid user balloon from 103.38.69.120 port 31573 ssh2
2026-02-12 01:59:17.554208+00:00,Failure,balloon,103.38.69.120,Test-VM-For-Logs,Failed password for invalid user balloon from 103.38.69.120 port 31573 ssh2
2026-02-12 01:59:13.693935+00:00,Failure,,103.38.69.120,Test-VM-For-Logs,Invalid user balloon from 103.38.69.120 port 31573
2026-02-12 01:59:06.649583+00:00,Failure,,,Test-VM-For-Logs,Connection reset by invalid user hamster 103.38.69.120 port 31890 [preauth]
2026-02-12 01:59:03.577720+00:00,Failure,hamster,103.38.69.120,Test-VM-For-Logs,Failed password for invalid user hamster from 103.38.69.120 port 31890 ssh2
2026-02-12 01:58:55.777039+00:00,Failure,hamster,103.38.69.120,Test-VM-For-Logs,Failed password for invalid user hamster from 103.38.69.120 port 31890 ssh2
2026-02-12 01:58:51.167792+00:00,Failure,,103.38.69.120,Test-VM-For-Logs,Invalid user hamster from 103.38.69.120 port 31890
2026-02-12 01:54:50.302217+00:00,Success,Ayush,103.38.69.120,Test-VM-For-Logs,Accepted password for Ayush from 103.38.69.120 port 31565 ssh2

Yes — this looks suspicious.

What stands out
- 103.38.69.120: Multiple “Invalid user/Failed password” attempts (hamster/balloon), then successful SSH password logins for Ayush at 01:54:50 and 01:59:38 on Test-VM-For-Logs. This is consistent with brute-force/credential stuffing followed by success. Verify with Ayush if both logins are expected from that IP.
- 98.80.4.65: Single invalid-user probe — likely generic scan, still block if not needed.

Immediate actions (Azure-first)
- Contain: Block 103.38.69.120 at the NSG/Azure Firewall. Restrict TCP/22 to trusted IPs only or close it and use Azure Bastion or Defender for Cloud Just‑In‑Time VM access.
- Credentials: If any Ayush login is unrecognized, reset Ayush password/SSH keys, invalidate cached credentials, remove from sudoers if not required, and terminate active SSH sessions.
- SSH hardening: Disable password auth (PasswordAuthentication no), enforce SSH keys or AADLoginForLinux with Conditional Access MFA, and restart sshd.
- Detection/response: Run Microsoft Defender for Servers/Endpoint AV scan on the VM and review alerts. Check for new users, sudoers changes, suspicious processes, and authorized_keys modifications.

Hunt next (Log Analytics/Sentinel – KQL)
- Brute-force followed by success from same IP (10m window):
let window=10m;
let ssh = Syslog
| where ProcessName == "sshd" and Facility in ("auth","authpriv")
| extend SrcIP = extract(@"from (\d+\.\d+\.\d+\.\d+)",1, SyslogMessage);
let fails = ssh
| where SyslogMessage has_any ("Invalid user","Failed password")
| summarize FailCount=count(), FirstFail=min(TimeGenerated), LastFail=max(TimeGenerated) by Computer, SrcIP;
ssh
| where SyslogMessage has "Accepted password"
| extend SrcIP = extract(@"from (\d+\.\d+\.\d+\.\d+)",1, SyslogMessage), User = extract(@"for (\S+)",1, SyslogMessage)
| join kind=inner (fails) on Computer, SrcIP
| where TimeGenerated between (FirstFail .. LastFail + window) and FailCount >= 3
| project TimeGenerated, Computer, User, SrcIP, FailCount
- Pivot that IP across all VMs:
Syslog
| where ProcessName == "sshd" and SyslogMessage has_any ("Invalid user","Failed password","Accepted password")
| extend SrcIP = extract(@"from (\d+\.\d+\.\d+\.\d+)",1, SyslogMessage)
| where SrcIP in ("103.38.69.120","98.80.4.65")
| project TimeGenerated, Computer, SyslogMessage, SrcIP
| order by TimeGenerated desc

Validate and scope
- Correlate with Azure Activity Logs for any NSG/VM changes around the same time.
- If Defender for Endpoint is enabled, check for post-login activity (new services, unusual outbound connections) on Test-VM-For-Logs.

Hardening (ongoing)
- Keep SSH closed to the internet; prefer Bastion or JIT.
- Enable Sentinel analytics for “multiple SSH failures followed by success” and blocklists for repeated offenders.
- Install and tune fail2ban on the VM.
- Patch OS and rotate secrets used on that VM.