I'm curious on how people here handle the “is someone already on my box?” side of security.

Most setups I see cover the basics well: firewall, SSH keys, fail2ban or CrowdSec, maybe a reverse proxy with some rules. But that’s mostly prevention. I’m more interested in detection, how would you know if something got through?

No wrong answers, I’m just trying to understand what works in practice for people running a few servers rather than an enterprise SOC