I'm not at this point yet, thankfully, but being prepared means knowing the answer before the issue arises, so here goes...
You're looking through your firewall / website logs...
And you notice a large number of requests. Someone appears to have portscanned you, or run sqlmap or DirBuster, Nessus, metasploit or whatever. Apart from breaking out in cold sweat and making occult sacrifices to the Internet gods, what are good steps to take at this point?
I'd assume you'd:
- go through other logs more carefully than usual, looking for derivations from the norm,
- (if it's only from one IP) do a reverse DNS query on them to see if they are associated with any domains, and, if they are, contact webmaster@, abuse@ and other RFC2142 addresses then, if they don't respond within 24 hours contact their ISP.
- (if it's from multiple IPs) check if they're using IPs from known anonymizing networks, and if they are, block those anonymizers (as much as possible).
- (if egregious enough / a clear attempt to break in or DOS, and not simply reconnaissance) contact the FBI (if any of the IPs are across state lines). Not sure what other law enforcement agencies you'd contact.
- Temporarily block ssh logins from non-essential users while the storm is being weathered (so your attack surface is smaller).