Security event triage

Repeated failed SSH logins against a public bastion host.

WAF and app logs showing UNION-based injection against /api/users.

Horizontal SYN scan across internal hosts from an untrusted IP.

Encoded PowerShell with remote download and credential access on a finance workstation.