{
"event": "PreToolUse",
"tool_name": "Bash",
"tool_input": {
"command": "ssh root@prod.karlkratz.com \"\necho '=== fail2ban letzte 30 Min ==='\ngrep -c 'Ban\\|Found' \/var\/log\/fail2ban.log | head -1\necho ''\necho '=== Letzte Bans ==='\ngrep 'Ban' \/var\/log\/fail2ban.log | tail -20\necho ''\necho '=== Geoblock Counter ==='\nnft list chain inet firewall input 2>\/dev\/null | grep -E 'whitelist|geoblock|blacklist'\necho ''\necho '=== Letzte SSH-Versuche ==='\njournalctl -u ssh --since '30 min ago' --no-pager 2>\/dev\/null | grep -iE 'fail|invalid|refused|disconnect|accepted' | tail -15\necho ''\necho '=== Apache\/Nginx Errors ==='\ntail -10 \/var\/log\/apache2\/bot-blocks.log 2>\/dev\/null\necho ''\necho '=== Postfix Attacks ==='\ngrep -c 'warning.*authentication failed' \/var\/log\/mail.log 2>\/dev\/null\necho ''\necho '=== Nginx Bad Requests ==='\ntail -5 \/var\/log\/nginx\/access.log 2>\/dev\/null | grep -E ' [45][0-9]{2} '\n\" 2>&1",
"timeout": 30000,
"description": "Check logs for ongoing attacks"
}
}