Count the failures, then find the success
The bastion host logged a burst of failed SSH passwords. Count them by source, find the noisiest address, and check whether any of its guesses worked.
Briefing
The bastion is reachable from the internet on port 22. Overnight its auth.log filled with failed passwords from a handful of addresses.
A failed-password line ends with "from <ip> port <port> ssh2", so the address is always the fourth field from the end. That makes it easy to pull out with awk and count.
bastion · SSH brute force
Type help for the command list and objectives for your tasks. Everything runs in this browser.
Up and down arrows walk your history. Ctrl+L clears the screen. Try help, ls, and objectives.