| Time  | Event |
|--------|-------|
| 09:40 | Unusual volume of `POST` requests to `/api/login` detected from a single IP. |
| 09:42 | Failed login attempts exceed **300** within one minute. |
| 09:44 | No rate limiting or temporary IP blocking was triggered. |
| 09:46 | One login attempt succeeds using a password from a common wordlist (e.g., `rockyou.txt`). |
| 09:47 | The server issues a valid JWT for the compromised account. |
| 09:49 | The attacker uses the JWT to access `/api/users/me`. |
| 09:51 | The attacker begins probing undocumented API endpoints (shadow APIs). |
| 09:54 | Sensitive data is exfiltrated through repeated API requests. |
| 09:58 | The SOC team detects the incident through a SIEM alert triggered by an abnormal spike in HTTP 401 responses. |


## Incident Response Plan

### 1. Identification
- Review API, application, and authentication logs.
- Identify the source IP addresses responsible for the brute force attack.
- Determine which user accounts were compromised.
- Analyze the scope of the data accessed or exfiltrated.
- Correlate events using the SIEM to establish the attack timeline.

### 2. Containment
- Block the attacker's IP address using the firewall or Web Application Firewall (WAF).
- Temporarily disable the compromised user account.
- Revoke all active JWT access tokens and terminate existing sessions.
- Enable temporary rate limiting on the `/api/login` endpoint.
- Isolate affected containers if compromise is suspected.

### 3. Eradication
- Reset passwords for affected accounts.
- Remove any malicious processes or unauthorized changes.
- Patch the authentication service to enforce rate limiting and account lockout.
- Verify container images for integrity and rebuild compromised containers from trusted images.
- Scan systems for indicators of compromise (IOCs).

### 4. Recovery
- Restore normal service after confirming the environment is secure.
- Re-enable affected user accounts with new credentials.
- Continue monitoring logs for suspicious authentication attempts.
- Validate that security controls (MFA, rate limiting, monitoring) are functioning correctly.