SOC triage: the overnight SSH alert

The SIEM raised a high-severity alert overnight: many failed SSH sign-ins on one server, then a success. You are the analyst on shift. Read the alert and the server's auth.log, work out which source got in and as whom, what it did first, and which steps contain it. The organisation, people and addresses are fictional and generated for you, so your answers differ from other players'.