Incident 3873429f-75ea-46fc-b5d4-37d9f0664262

← all incidents

ID: 3873429f-75ea-46fc-b5d4-37d9f0664262
Class: meta
Severity: warning
Status: escalated
Source / agent: posture_review
Signature: posture_brute:172.20.0.14
Created: 2026-09-08 15:00:10 UTC
Resolved: —

Chain of command

Scout

done

evidence via posture_review

2026-09-08 15:00:10 UTC

Analyst

done

kb_hit · 90% · brute_force_burst

2026-09-08 15:00:10 UTC

Librarian

done

rejected by kimi-cli

2026-09-15 11:51:42 UTC

Surgeon

pending

no execution considered

—

Watchdog

pending

nothing to verify

—

1 · Detection

Symptoms

{
  "failures": 203,
  "ip": "172.20.0.14",
  "sources": [
    "authlog",
    "caddy",
    "fail2ban",
    "nginx"
  ],
  "threshold": 10,
  "window_minutes": 60
}

2 · Diagnosis

Run 1

Tier: kb_hit
Confidence: 0.9
Confidence source: historical_success_rate
Root cause entity: brute_force_burst
LLM used: no
Duration: —
At: 2026-09-08 15:00:10 UTC

Tree path

{
  "kb_signature": "5dd36996484d07b8fa38140ed4c696bf03bdd47a26fdd38bd01ee67d08de3c9c"
}

Candidate deliberation (R5)

Winner margin: 0.05

Source	Root cause	Fix	Confidence	Score
kb_hit	brute_force_burst WINNER	block_brute_force_ip	0.9	1.45
rule_tree	brute_force_burst	block_brute_force_ip(ip=172.20.0.14)	0.85	1.4

3 · Fix attempts

No fix attempts recorded.

4 · Human feedback

Decision: rejected
Decided by: kimi-cli
Decided at: 2026-09-15 11:51:42 UTC
Human root cause: —
Notes: Proposed fix would block 172.20.0.14 = ghostshell-caddy (the stack's own reverse proxy). Approving would take down all web traffic. Real client IP must come from X-Forwarded-For; fail2ban should act on the real source.