@pitrh Things do correlate but it's rather complex. SSH attempts are an indicator but not a good one to link directly to a conflict. Blocking known attempts makes it hard to measure development and origin of the attacks in the future. Real world conflicts have many many effects in the cyberspace nowadays. It's hard to get the relevant data, it's hard to measure the impact, it's hard to correlate the different data and take action. Welcome to the world of hybrid threats.