diff --git a/TESTING.md b/TESTING.md
new file mode 100644
index 0000000..3aa488a
--- /dev/null
+++ b/TESTING.md
@@ -0,0 +1,180 @@
+# Testing Guide - secrds Detection
+
+## Quick Test
+
+Run the comprehensive test script:
+
+```bash
+sudo ./fix-and-test.sh
+```
+
+This will:
+1. Check service status
+2. Rebuild the project
+3. Reinstall everything
+4. Verify service is running
+5. Check eBPF program attachment
+6. Run SSH attack simulation
+7. Verify alerts are generated
+
+## Manual Testing
+
+### Step 1: Ensure service is running
+
+```bash
+sudo systemctl status secrds
+# If not running:
+sudo systemctl start secrds
+```
+
+### Step 2: Run test script
+
+```bash
+./test-ssh-attacks.sh 10
+```
+
+This makes 10 SSH connection attempts and checks for alerts.
+
+### Step 3: Check alerts
+
+```bash
+secrds alerts
+```
+
+## Debugging
+
+### View real-time logs
+
+```bash
+sudo journalctl -u secrds -f
+```
+
+Look for:
+- `[DEBUG] SSH event received` - Events are being captured
+- `[DEBUG] Threat detected` - Threats are being identified
+- `Attached kprobe` - eBPF program loaded correctly
+
+### Check if events are received
+
+```bash
+sudo journalctl -u secrds | grep "SSH event received"
+```
+
+### Check eBPF program attachment
+
+```bash
+sudo journalctl -u secrds | grep "Attached kprobe"
+```
+
+Should show:
+- `Attached kprobe to inet_csk_accept` (incoming connections)
+- `Attached kprobe to tcp_v4_connect` (outgoing connections)
+
+### Check storage file
+
+```bash
+cat /var/lib/secrds/events.json | jq .
+# Or without jq:
+cat /var/lib/secrds/events.json
+```
+
+## Common Issues
+
+### Issue: No alerts detected
+
+**Possible causes:**
+
+1. **Service not running**
+   ```bash
+   sudo systemctl start secrds
+   ```
+
+2. **eBPF program not attached**
+   - Check kernel version: `uname -r` (needs 5.8+)
+   - Check logs: `sudo journalctl -u secrds | grep "Attached"`
+   - Kernel might not export `inet_csk_accept` symbol
+
+3. **Source IP detection failing**
+   - Check logs for "invalid IP" or "0.0.0.0"
+   - Socket structure offsets might be wrong for your kernel
+
+4. **Thresholds too high**
+   - Check config: `cat /etc/secrds/config.yaml`
+   - Default is 3 attempts in 5 minutes
+   - Lower if needed: `ssh_threshold: 2`
+
+### Issue: Events received but no alerts
+
+- Check detection thresholds in config
+- Check logs for "Threat detected" messages
+- Verify threat score calculation
+
+### Issue: Invalid IP addresses
+
+If you see IPs like `0.0.0.0` or invalid addresses:
+- Socket structure offsets need adjustment for your kernel
+- Try rebuilding with different offsets
+- Check kernel version compatibility
+
+## Testing from Remote Server
+
+To test from another server:
+
+```bash
+# On remote server
+for i in {1..10}; do
+  ssh root@TARGET_SERVER_IP "exit" 2>&1 | head -1
+  sleep 0.5
+done
+
+# On target server
+secrds alerts
+```
+
+## Configuration
+
+Edit `/etc/secrds/config.yaml`:
+
+```yaml
+ssh_threshold: 3          # Number of attempts to trigger alert
+ssh_window_seconds: 300   # Time window (5 minutes)
+enable_ip_blocking: true  # Auto-block detected IPs
+```
+
+Lower thresholds for more sensitive detection:
+```yaml
+ssh_threshold: 2
+ssh_window_seconds: 60
+```
+
+## Expected Behavior
+
+After making SSH connection attempts, you should see:
+
+1. **Events in logs:**
+   ```
+   [DEBUG] SSH event received: IP=127.0.0.1, Port=22, PID=1234, Type=0
+   ```
+
+2. **Threat detection:**
+   ```
+   [DEBUG] Threat detected: IP=127.0.0.1, Type=SSH_BRUTE_FORCE, Severity=MEDIUM, Count=3, Score=9.0
+   ```
+
+3. **Alerts:**
+   ```
+   🟠 [MEDIUM] SSH_BRUTE_FORCE
+     Time:   2024-01-01 12:00:00 UTC
+     IP:     127.0.0.1
+     Count:  3
+     Score:  9.0
+     Details: Brute force detected: 3 attempts in 5 minutes
+   ```
+
+## Performance
+
+- Detection happens in real-time
+- Alerts are stored immediately
+- Storage file is flushed every 60 seconds
+- No performance impact on SSH connections
+
diff --git a/clear-all.sh b/clear-all.sh
new file mode 100755
index 0000000..0ecded1
--- /dev/null
+++ b/clear-all.sh
@@ -0,0 +1,31 @@
+#!/bin/bash
+# Quick script to clear all logs and storage
+
+set -e
+
+# Check if running as root
+if [ "$EUID" -eq 0 ]; then
+    SUDO=""
+else
+    SUDO="sudo"
+fi
+
+echo "Clearing all secrds logs and storage..."
+
+# Stop service
+$SUDO systemctl stop secrds 2>/dev/null || true
+
+# Clear storage
+$SUDO rm -f /var/lib/secrds/events.json
+$SUDO mkdir -p /var/lib/secrds
+
+# Clear logs
+$SUDO journalctl --vacuum-time=1s -u secrds > /dev/null 2>&1 || true
+
+# Restart service
+$SUDO systemctl start secrds
+
+echo "✓ All cleared! Service restarted."
+echo ""
+echo "Run test: ./fresh-test.sh"
+
diff --git a/fix-and-test.sh b/fix-and-test.sh
new file mode 100755
index 0000000..ba57a64
--- /dev/null
+++ b/fix-and-test.sh
@@ -0,0 +1,187 @@
+#!/bin/bash
+# Comprehensive fix and test script for secrds detection
+
+set -e
+
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+YELLOW='\033[1;33m'
+BLUE='\033[0;34m'
+NC='\033[0m'
+
+# Check if running as root
+if [ "$EUID" -eq 0 ]; then
+    SUDO=""
+    echo -e "${YELLOW}Running as root, skipping sudo${NC}"
+else
+    SUDO="sudo"
+    echo -e "${YELLOW}Not running as root, will use sudo${NC}"
+fi
+
+echo -e "${BLUE}========================================${NC}"
+echo -e "${BLUE}secrds Detection Fix & Test Script${NC}"
+echo -e "${BLUE}========================================${NC}"
+echo ""
+
+# Step 1: Check if service is running
+echo -e "${YELLOW}[1/6] Checking service status...${NC}"
+if $SUDO systemctl is-active --quiet secrds 2>/dev/null; then
+    echo -e "${GREEN}✓ Service is running${NC}"
+    SERVICE_RUNNING=true
+else
+    echo -e "${RED}✗ Service is NOT running${NC}"
+    SERVICE_RUNNING=false
+fi
+echo ""
+
+# Step 2: Rebuild
+echo -e "${YELLOW}[2/6] Rebuilding project...${NC}"
+if make build; then
+    echo -e "${GREEN}✓ Build successful${NC}"
+else
+    echo -e "${RED}✗ Build failed${NC}"
+    exit 1
+fi
+echo ""
+
+# Step 3: Reinstall
+echo -e "${YELLOW}[3/6] Reinstalling...${NC}"
+if $SUDO ./install.sh 2>&1 | tail -20; then
+    echo -e "${GREEN}✓ Installation complete${NC}"
+else
+    echo -e "${RED}✗ Installation failed${NC}"
+    exit 1
+fi
+echo ""
+
+# Step 4: Verify service
+echo -e "${YELLOW}[4/6] Verifying service...${NC}"
+sleep 2
+if $SUDO systemctl is-active --quiet secrds 2>/dev/null; then
+    echo -e "${GREEN}✓ Service is running${NC}"
+else
+    echo -e "${YELLOW}⚠ Service not running, attempting to start...${NC}"
+    $SUDO systemctl start secrds
+    sleep 2
+    if $SUDO systemctl is-active --quiet secrds 2>/dev/null; then
+        echo -e "${GREEN}✓ Service started${NC}"
+    else
+        echo -e "${RED}✗ Failed to start service${NC}"
+        echo "Check logs: sudo journalctl -u secrds -n 50"
+        exit 1
+    fi
+fi
+echo ""
+
+# Step 5: Check eBPF program
+echo -e "${YELLOW}[5/6] Checking eBPF program attachment...${NC}"
+if $SUDO journalctl -u secrds --no-pager 2>/dev/null | grep -q "Attached kprobe"; then
+    echo -e "${GREEN}✓ eBPF program attached${NC}"
+    $SUDO journalctl -u secrds --no-pager 2>/dev/null | grep "Attached kprobe" | tail -3
+else
+    echo -e "${YELLOW}⚠ No kprobe attachment found in logs${NC}"
+fi
+echo ""
+
+# Step 6: Run test
+echo -e "${YELLOW}[6/6] Running SSH attack simulation...${NC}"
+echo ""
+
+# Check if sshpass is installed
+if ! command -v sshpass &> /dev/null; then
+    echo -e "${YELLOW}Installing sshpass for testing...${NC}"
+    $SUDO apt-get update -qq && $SUDO apt-get install -y sshpass > /dev/null 2>&1 || {
+        echo -e "${RED}Failed to install sshpass. Install manually: apt install sshpass${NC}"
+        exit 1
+    }
+fi
+
+# Clear old alerts for clean test
+echo -e "${YELLOW}Clearing old alerts...${NC}"
+$SUDO rm -f /var/lib/secrds/events.json
+$SUDO systemctl restart secrds
+sleep 2
+
+# Make test attempts
+ATTEMPTS=5
+echo -e "${BLUE}Making ${ATTEMPTS} SSH connection attempts...${NC}"
+echo ""
+
+for i in $(seq 1 $ATTEMPTS); do
+    echo -n "  Attempt $i/$ATTEMPTS... "
+    
+    # Try SSH with wrong password
+    timeout 2 sshpass -p "wrongpass123" ssh -o StrictHostKeyChecking=no \
+        -o UserKnownHostsFile=/dev/null \
+        -o PreferredAuthentications=password \
+        -o PubkeyAuthentication=no \
+        -o ConnectTimeout=2 \
+        -o BatchMode=yes \
+        root@localhost "exit" 2>/dev/null || true
+    
+    sleep 0.5
+    echo "done"
+done
+
+echo ""
+echo -e "${YELLOW}Waiting for detection...${NC}"
+sleep 3
+
+# Check for alerts
+ALERT_COUNT=$(secrds alerts 2>/dev/null | grep -c "SSH_BRUTE_FORCE\|SSH" || echo "0")
+
+echo ""
+echo -e "${BLUE}========================================${NC}"
+echo -e "${BLUE}Test Results${NC}"
+echo -e "${BLUE}========================================${NC}"
+echo ""
+
+if [ "$ALERT_COUNT" -gt 0 ]; then
+    echo -e "${GREEN}✓ SUCCESS: Alerts detected!${NC}"
+    echo ""
+    echo -e "${YELLOW}Recent alerts:${NC}"
+    secrds alerts --limit 3
+    echo ""
+    echo -e "${GREEN}Detection is working correctly!${NC}"
+else
+    echo -e "${RED}✗ FAILED: No alerts detected${NC}"
+    echo ""
+    echo -e "${YELLOW}Debugging information:${NC}"
+    echo ""
+    
+    # Check logs
+    echo -e "${BLUE}Recent service logs:${NC}"
+    $SUDO journalctl -u secrds -n 30 --no-pager 2>/dev/null | tail -20
+    echo ""
+    
+    # Check if events are being received
+    echo -e "${BLUE}Checking for SSH events in logs:${NC}"
+    if $SUDO journalctl -u secrds --no-pager 2>/dev/null | grep -q "SSH event received"; then
+        echo -e "${GREEN}✓ Events are being received${NC}"
+        $SUDO journalctl -u secrds --no-pager 2>/dev/null | grep "SSH event received" | tail -5
+    else
+        echo -e "${RED}✗ No SSH events found in logs${NC}"
+        echo ""
+        echo -e "${YELLOW}Possible issues:${NC}"
+        echo "  1. eBPF program not detecting connections"
+        echo "  2. Source IP detection failing (check for 'invalid IP' messages)"
+        echo "  3. Kernel doesn't support required kprobes"
+        echo ""
+        echo -e "${YELLOW}Try manual test:${NC}"
+        echo "  /usr/local/bin/secrds-agent"
+        echo "  # In another terminal, try: ssh root@localhost"
+    fi
+    echo ""
+    
+    # Check storage
+    if [ -f "/var/lib/secrds/events.json" ]; then
+        echo -e "${BLUE}Storage file contents:${NC}"
+        cat /var/lib/secrds/events.json | python3 -m json.tool 2>/dev/null | head -30 || cat /var/lib/secrds/events.json | head -30
+    fi
+    
+    exit 1
+fi
+
+echo ""
+echo -e "${GREEN}All tests passed!${NC}"
+
diff --git a/fresh-test.sh b/fresh-test.sh
new file mode 100755
index 0000000..51d4606
--- /dev/null
+++ b/fresh-test.sh
@@ -0,0 +1,140 @@
+#!/bin/bash
+# Fresh test script - clears all logs and runs clean test
+
+set -e
+
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+YELLOW='\033[1;33m'
+BLUE='\033[0;34m'
+NC='\033[0m'
+
+# Check if running as root
+if [ "$EUID" -eq 0 ]; then
+    SUDO=""
+else
+    SUDO="sudo"
+fi
+
+echo -e "${BLUE}========================================${NC}"
+echo -e "${BLUE}Fresh Test - Clear All & Test${NC}"
+echo -e "${BLUE}========================================${NC}"
+echo ""
+
+# Step 1: Stop service
+echo -e "${YELLOW}[1/5] Stopping service...${NC}"
+$SUDO systemctl stop secrds 2>/dev/null || true
+sleep 1
+echo -e "${GREEN}✓ Service stopped${NC}"
+echo ""
+
+# Step 2: Clear storage file
+echo -e "${YELLOW}[2/5] Clearing storage file...${NC}"
+$SUDO rm -f /var/lib/secrds/events.json
+$SUDO mkdir -p /var/lib/secrds
+echo -e "${GREEN}✓ Storage cleared${NC}"
+echo ""
+
+# Step 3: Clear systemd logs
+echo -e "${YELLOW}[3/5] Clearing systemd logs...${NC}"
+$SUDO journalctl --vacuum-time=1s -u secrds > /dev/null 2>&1 || true
+echo -e "${GREEN}✓ Logs cleared${NC}"
+echo ""
+
+# Step 4: Restart service
+echo -e "${YELLOW}[4/5] Restarting service...${NC}"
+$SUDO systemctl start secrds
+sleep 2
+
+if $SUDO systemctl is-active --quiet secrds 2>/dev/null; then
+    echo -e "${GREEN}✓ Service started${NC}"
+else
+    echo -e "${RED}✗ Failed to start service${NC}"
+    exit 1
+fi
+echo ""
+
+# Step 5: Run test
+echo -e "${YELLOW}[5/5] Running fresh SSH attack test...${NC}"
+echo ""
+
+# Check if sshpass is installed
+if ! command -v sshpass &> /dev/null; then
+    echo -e "${YELLOW}Installing sshpass...${NC}"
+    $SUDO apt-get update -qq && $SUDO apt-get install -y sshpass > /dev/null 2>&1 || {
+        echo -e "${RED}Failed to install sshpass${NC}"
+        exit 1
+    }
+fi
+
+# Make test attempts
+ATTEMPTS=5
+echo -e "${BLUE}Making ${ATTEMPTS} SSH connection attempts...${NC}"
+echo ""
+
+for i in $(seq 1 $ATTEMPTS); do
+    echo -n "  Attempt $i/$ATTEMPTS... "
+    
+    # Try SSH with wrong password
+    timeout 2 sshpass -p "wrongpass123" ssh -o StrictHostKeyChecking=no \
+        -o UserKnownHostsFile=/dev/null \
+        -o PreferredAuthentications=password \
+        -o PubkeyAuthentication=no \
+        -o ConnectTimeout=2 \
+        -o BatchMode=yes \
+        root@localhost "exit" 2>/dev/null || true
+    
+    sleep 0.5
+    echo "done"
+done
+
+echo ""
+echo -e "${YELLOW}Waiting for detection...${NC}"
+sleep 3
+
+# Check for alerts
+ALERT_COUNT=$(secrds alerts 2>/dev/null | grep -c "SSH_BRUTE_FORCE\|SSH" || echo "0")
+
+echo ""
+echo -e "${BLUE}========================================${NC}"
+echo -e "${BLUE}Test Results${NC}"
+echo -e "${BLUE}========================================${NC}"
+echo ""
+
+if [ "$ALERT_COUNT" -gt 0 ]; then
+    echo -e "${GREEN}✓ SUCCESS: Alerts detected!${NC}"
+    echo ""
+    echo -e "${YELLOW}Recent alerts:${NC}"
+    secrds alerts --limit 5
+    echo ""
+    
+    # Show debug logs
+    echo -e "${YELLOW}Recent debug logs:${NC}"
+    $SUDO journalctl -u secrds --no-pager -n 50 2>/dev/null | grep -E "DEBUG|SSH event|Threat detected" | tail -10 || echo "No debug logs found"
+    echo ""
+    
+    echo -e "${GREEN}✓ Fresh test PASSED!${NC}"
+else
+    echo -e "${RED}✗ FAILED: No alerts detected${NC}"
+    echo ""
+    
+    # Show recent logs
+    echo -e "${YELLOW}Recent service logs:${NC}"
+    $SUDO journalctl -u secrds --no-pager -n 30 2>/dev/null | tail -20
+    echo ""
+    
+    # Check for events
+    echo -e "${YELLOW}Checking for SSH events:${NC}"
+    if $SUDO journalctl -u secrds --no-pager 2>/dev/null | grep -q "SSH event received"; then
+        echo -e "${GREEN}✓ Events received:${NC}"
+        $SUDO journalctl -u secrds --no-pager 2>/dev/null | grep "SSH event received" | tail -5
+    else
+        echo -e "${RED}✗ No SSH events found${NC}"
+    fi
+    
+    exit 1
+fi
+
+echo ""
+echo -e "${GREEN}All tests passed!${NC}"
+
diff --git a/install.sh b/install.sh
index 3f1bd05..9541675 100755
--- a/install.sh
+++ b/install.sh
@@ -16,10 +16,17 @@ RUN_DIR="/var/run"
 
 echo -e "${GREEN}Installing secrds Security Monitor${NC}"
 
-# Check if running as root
+# Check if running as root or has sudo
 if [ "$EUID" -ne 0 ]; then 
-    echo -e "${RED}Please run as root (use sudo)${NC}"
-    exit 1
+    if ! command -v sudo &> /dev/null; then
+        echo -e "${RED}Please run as root or install sudo${NC}"
+        exit 1
+    fi
+    # Not root, will use sudo
+    SUDO_CMD="sudo"
+else
+    # Already root, no sudo needed
+    SUDO_CMD=""
 fi
 
 # Check prerequisites
diff --git a/secrds-agent/internal/detector/threat.go b/secrds-agent/internal/detector/threat.go
index e93c196..1e12691 100644
--- a/secrds-agent/internal/detector/threat.go
+++ b/secrds-agent/internal/detector/threat.go
@@ -83,6 +83,12 @@ func (td *ThreatDetector) ProcessSSHEvent(ip uint32, port uint16, pid uint32, ev
 	ipAddr := u32ToIP(ip)
 	ipStr := ipAddr.String()
 
+	// Skip invalid IPs (0.0.0.0 or invalid)
+	if ip == 0 || ipStr == "0.0.0.0" {
+		fmt.Printf("[DEBUG] Skipping invalid IP: %s\n", ipStr)
+		return nil
+	}
+
 	// Check if already blocked
 	if td.storage.IsBlocked(ipStr) {
 		return nil
@@ -223,8 +229,15 @@ func (td *ThreatDetector) detectSSHThreats(ip string, behavior *IPBehavior, now
 	failedInShort := td.countFailedInWindow(behavior.SSHEvents, now, shortWindow)
 	failedInMedium := td.countFailedInWindow(behavior.SSHEvents, now, mediumWindow)
 
+	// Use config threshold for detection
+	threshold := td.config.SSHThreshold
+	if threshold == 0 {
+		threshold = 3 // Default fallback
+	}
+
 	// Pattern 1: Rapid brute force attack (high frequency in short window)
-	if shortTerm >= 10 || (shortTerm >= 5 && failedInShort >= 5) {
+	// Critical: 2x threshold in 1 minute
+	if shortTerm >= threshold*2 || (shortTerm >= threshold && failedInShort >= threshold) {
 		threats = append(threats, ThreatInfo{
 			ThreatType: storage.ThreatTypeSSHBruteForce,
 			Severity:   SeverityCritical,
@@ -232,7 +245,8 @@ func (td *ThreatDetector) detectSSHThreats(ip string, behavior *IPBehavior, now
 			Details:    fmt.Sprintf("Rapid brute force: %d attempts in 1 minute", shortTerm),
 			Score:      score,
 		})
-	} else if mediumTerm >= 15 || (mediumTerm >= 10 && failedInMedium >= 10) {
+	} else if mediumTerm >= threshold*3 || (mediumTerm >= threshold*2 && failedInMedium >= threshold*2) {
+		// High: 3x threshold in 5 minutes
 		threats = append(threats, ThreatInfo{
 			ThreatType: storage.ThreatTypeSSHBruteForce,
 			Severity:   SeverityHigh,
@@ -240,12 +254,22 @@ func (td *ThreatDetector) detectSSHThreats(ip string, behavior *IPBehavior, now
 			Details:    fmt.Sprintf("Sustained brute force: %d attempts in 5 minutes", mediumTerm),
 			Score:      score,
 		})
-	} else if longTerm >= 20 {
+	} else if mediumTerm >= threshold {
+		// Medium: threshold or more in 5 minutes
 		threats = append(threats, ThreatInfo{
 			ThreatType: storage.ThreatTypeSSHBruteForce,
 			Severity:   SeverityMedium,
+			Count:      mediumTerm,
+			Details:    fmt.Sprintf("Brute force detected: %d attempts in 5 minutes", mediumTerm),
+			Score:      score,
+		})
+	} else if longTerm >= threshold {
+		// Low: threshold or more in 15 minutes
+		threats = append(threats, ThreatInfo{
+			ThreatType: storage.ThreatTypeSSHBruteForce,
+			Severity:   SeverityLow,
 			Count:      longTerm,
-			Details:    fmt.Sprintf("Persistent brute force: %d attempts in 15 minutes", longTerm),
+			Details:    fmt.Sprintf("Suspicious activity: %d attempts in 15 minutes", longTerm),
 			Score:      score,
 		})
 	}
@@ -475,10 +499,10 @@ func (td *ThreatDetector) detectSequentialPortScan(conns []TCPConnectionDetail)
 }
 
 func (td *ThreatDetector) handleThreat(ip string, threat ThreatInfo) error {
-	// Only alert if severity is MEDIUM or higher, or if score is significant
-	if threat.Severity == SeverityLow && threat.Score < 10 {
-		return nil
-	}
+	// Alert on all threats (including LOW severity for testing/debugging)
+	// In production, you might want to filter LOW severity threats
+	fmt.Printf("[DEBUG] Threat detected: IP=%s, Type=%s, Severity=%s, Count=%d, Score=%.1f\n",
+		ip, threat.ThreatType, threat.Severity, threat.Count, threat.Score)
 
 	alert := &storage.Alert{
 		IP:         ip,
diff --git a/secrds-agent/internal/processor/event.go b/secrds-agent/internal/processor/event.go
index 222447b..6bf3f1c 100644
--- a/secrds-agent/internal/processor/event.go
+++ b/secrds-agent/internal/processor/event.go
@@ -99,6 +99,12 @@ func (ep *EventProcessor) processSSHEvents(reader *perf.Reader) {
 			Timestamp: binary.LittleEndian.Uint64(record.RawSample[16:24]),
 		}
 
+		// Debug: Log received events (can be disabled in production)
+		ipStr := fmt.Sprintf("%d.%d.%d.%d", 
+			byte(event.IP>>24), byte(event.IP>>16), byte(event.IP>>8), byte(event.IP))
+		fmt.Printf("[DEBUG] SSH event received: IP=%s, Port=%d, PID=%d, Type=%d\n", 
+			ipStr, event.Port, event.PID, event.EventType)
+
 		if err := ep.detector.ProcessSSHEvent(event.IP, event.Port, event.PID, event.EventType); err != nil {
 			fmt.Printf("Failed to process SSH event: %v\n", err)
 		}
diff --git a/test-ssh-attacks.sh b/test-ssh-attacks.sh
new file mode 100755
index 0000000..17a4043
--- /dev/null
+++ b/test-ssh-attacks.sh
@@ -0,0 +1,89 @@
+#!/bin/bash
+# Test script to simulate SSH brute force attacks
+# This will make multiple failed SSH login attempts
+
+set -e
+
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+YELLOW='\033[1;33m'
+NC='\033[0m'
+
+echo -e "${YELLOW}SSH Attack Simulation Test${NC}"
+echo "================================"
+echo ""
+
+# Check if service is running
+if ! systemctl is-active --quiet secrds 2>/dev/null; then
+    echo -e "${RED}ERROR: secrds service is not running!${NC}"
+    echo "Start it with: sudo systemctl start secrds"
+    exit 1
+fi
+
+echo -e "${GREEN}✓ secrds service is running${NC}"
+
+# Get local IP
+LOCAL_IP=$(hostname -I | awk '{print $1}')
+echo -e "${YELLOW}Testing from: ${LOCAL_IP}${NC}"
+echo ""
+
+# Number of attempts
+ATTEMPTS=${1:-10}
+echo -e "${YELLOW}Making ${ATTEMPTS} SSH connection attempts...${NC}"
+echo ""
+
+# Count successful detections
+SUCCESS_COUNT=0
+
+for i in $(seq 1 $ATTEMPTS); do
+    echo -n "Attempt $i/$ATTEMPTS... "
+    
+    # Try SSH connection with wrong password
+    timeout 2 sshpass -p "wrongpassword123" ssh -o StrictHostKeyChecking=no \
+        -o UserKnownHostsFile=/dev/null \
+        -o PreferredAuthentications=password \
+        -o PubkeyAuthentication=no \
+        -o ConnectTimeout=2 \
+        -o BatchMode=yes \
+        root@localhost "exit" 2>/dev/null || true
+    
+    sleep 0.3
+    
+    # Check for alerts
+    ALERT_COUNT=$(secrds alerts 2>/dev/null | grep -c "SSH_BRUTE_FORCE" || echo "0")
+    
+    if [ "$ALERT_COUNT" -gt 0 ]; then
+        echo -e "${GREEN}✓ Alert detected!${NC}"
+        SUCCESS_COUNT=$((SUCCESS_COUNT + 1))
+    else
+        echo "No alert yet"
+    fi
+done
+
+echo ""
+echo "================================"
+echo -e "${YELLOW}Test Results:${NC}"
+echo "Attempts made: $ATTEMPTS"
+echo "Alerts detected: $SUCCESS_COUNT"
+
+# Show recent alerts
+echo ""
+echo -e "${YELLOW}Recent alerts:${NC}"
+secrds alerts --limit 5
+
+if [ "$SUCCESS_COUNT" -gt 0 ]; then
+    echo ""
+    echo -e "${GREEN}✓ Test PASSED - Detection is working!${NC}"
+    exit 0
+else
+    echo ""
+    echo -e "${RED}✗ Test FAILED - No alerts detected${NC}"
+    echo ""
+    echo -e "${YELLOW}Troubleshooting steps:${NC}"
+    echo "1. Check service logs: sudo journalctl -u secrds -n 50"
+    echo "2. Check if eBPF program loaded: sudo journalctl -u secrds | grep 'Attached kprobe'"
+    echo "3. Verify service is running: sudo systemctl status secrds"
+    echo "4. Check storage file: cat /var/lib/secrds/events.json | jq .alerts"
+    exit 1
+fi
+