Add comprehensive attack monitoring and auto-mitigation
Extended live monitor with additional attack vectors and intelligent mitigation:
Attack Monitoring:
- Email/SMTP bruteforce (dovecot/exim authentication failures)
- FTP bruteforce (vsftpd login failures)
- Database bruteforce (MySQL authentication failures)
- Distributed attack detection (botnet identification via pattern analysis)
Automated Mitigation:
- Auto-blocking engine for IPs reaching critical threshold (score ≥80)
- 1-hour temporary blocks with automatic logging
- Prevents manual intervention for clear threats
Intelligence Enhancements:
- Cross-source attack correlation
- Distributed attack pattern recognition (5+ IPs, same attack)
- Automated threat response with audit trail
Coverage: Web, SSH, Email, FTP, Database, Firewall, cPHulk, Network (8 sources)
cschantz
ca8fe4f02c