log correlation

Learn a practical, Unix-friendly way to catch incidents early by correlating SSH and Nginx logs with a Bash-first, Python-assisted pipeline: normalize and bucket per-minute features by IP, score anomalies via Isolation Forest, and emit ranked alerts with concise "why" explanations you can automate in cron. Detect coordinated attacks, cut MTTR, and extend with app features, tuning, whitelists, and enrichments—no heavy stack required.