/challenge/forensics/log-hunt/auth.log is regenerated at every instance start: a randomized SSH brute-force campaign from one external source is hidden among benign traffic.
Identify the attacker's source IP address, then run:
/challenge/forensics/log-hunt/unlock <ip>
It prints your /flag when the IP is right.