Incident 695c5ff5-5aca-430b-8e0c-86069dedfc7b

← all incidents

ID: 695c5ff5-5aca-430b-8e0c-86069dedfc7b
Class: meta
Severity: warning
Status: false_positive
Source / agent: posture_review
Signature: posture_brute:100.68.28.71
Created: 2026-07-22 11:00:14 UTC
Resolved: —

Chain of command

Scout

done

evidence via posture_review

2026-07-22 11:00:14 UTC

Analyst

done

rule_tree · 85% · brute_force_burst

2026-07-22 11:00:14 UTC

Librarian

done

rejected by mamadou

2026-07-22 11:01:34 UTC

Surgeon

pending

no execution considered

—

Watchdog

pending

nothing to verify

—

1 · Detection

Symptoms

{
  "failures": 345,
  "ip": "100.68.28.71",
  "sources": [
    "authlog",
    "caddy",
    "fail2ban",
    "nginx"
  ],
  "threshold": 10,
  "window_minutes": 60
}

2 · Diagnosis

Run 1

Tier: rule_tree
Confidence: 0.85
Confidence source: tree_base
Root cause entity: brute_force_burst
LLM used: no
Duration: —
At: 2026-07-22 11:00:14 UTC

Tree path

{
  "path": [],
  "tree_pattern": "posture_brute:"
}

Suggested fix params

{
  "ip": "100.68.28.71"
}

Candidate deliberation (R5)

Winner margin: 1.4

Source	Root cause	Fix	Confidence	Score
rule_tree	brute_force_burst WINNER	block_brute_force_ip(ip=100.68.28.71)	0.85	1.4

3 · Fix attempts

No fix attempts recorded.

4 · Human feedback

Decision: rejected
Decided by: mamadou
Decided at: 2026-07-22 11:01:34 UTC
Human root cause: —
Notes: —