[#825] SOC sweep: UCS machine-account suppression (CR 24) + churn root causes

https://projects.knownelement.com/issues/825
2026-09-06 16:17:45 -05:00
parent cb2a24eaf9
commit 9476f92029
2 changed files with 19 additions and 0 deletions
@@ -93,3 +93,16 @@ sshd successes: visible for triage, below every notification path.
 5. Re-check email volume at coo@ weekly; tune further only on evidence.
 6. Vulnerability backlog: OpenVAS scans (GLPI-fed targets) → tickets per the triage
   standard; Wazuh vuln alerts feed the same weekly review.
+
+## Sweep additions
+
+**2026-09-06 (CR 24):** rule 100520 (L3) — UCS machine-account SSH probe suppression:
+`tsys-ucs-02$` → tsys-ucs-01 every 20 min is a UCS domain artifact (verified in
+auth.log), not an intrusion. Narrow match: if_sid 5710 + srcip 100.68.10.17 + pcre2
+`Invalid user tsys-ucs-02\$`. All other invalid-user attempts stay L5. Gotchas that
+bit during apply: `srcuser` is not a valid rule element in 4.14 (use regex on the log),
+OSMatch `$` anchors and does not escape reliably — use `<regex type="pcre2">`.
+
+**Known remaining churn (L3, dashboard-only, tracked):** 40704 systemd failures
+dominated by `nut-driver@tripplite.service` (pfv-tsys5) and `dell-fan-control.service`
+(pfv-tsys9) arriving via remote syslog — infra-ops crash-loops, not security.