Proactive Alerting and Audit Visibility for Automated SFTP IP Blocks / Fail2ban Actions

Problem Statement

• Scenario: An automated ETL job or developer uses invalid credentials, triggering an automated IP block on the Planning Analytics SFTP server.

• Pain Points:

  • Silent Failure: The block occurs without notice; connections fail with generic network timeouts.

  • Company-Wide Impact: Because enterprise traffic typically shares a single outbound NAT IP, one bad attempt locks out all automated feeds and admins across the organization.

  • Prolonged MTTR: Teams spend days debugging internal firewalls and routing before IBM Support identifies the IP block, leading to multi-day pipeline outages and platform distrust.

Current Workarounds

• Submitting urgent Sev-1/Sev-2 tickets to IBM Support to check and release the IP.

• Routing urgent data loads through ad-hoc network egress points or cellular hotspots.

Proposed Solutions

• Instant Alerts: Configurable webhook (REST API / custom cURL) or email notifications sent to platform administrators when an IP ban is triggered, specifying the blocked IP, timestamp, and rule reason.

• Admin Portal Visibility: An "Active IP Blocks" section in the Planning Analytics Administration console, ideally with a self-service option to release the block.

Benefits & Business Value

• Cuts MTTR from Days to Minutes: Eliminates blind troubleshooting and redundant IBM support escalations.

• Pipeline Reliability: Ensures critical nightly data feeds meet SLAs for finance and operations.

• Platform Trust: Replaces invisible platform lockouts with transparent security monitoring.

Users Impacted & Frequency

• Impact: Platform administrators, ETL engineers, and all downstream business users reliant on scheduled data feeds.

• Frequency: 2–4 times per year, with each incident previously taking 24–72+ hours to diagnose and resolve.