A project in Splunk meant to detect, highlight and provide a list of Source IPs (src_ip), the failed attempts and also the amount of unique usernames attempted.
Detects SSH brute-force activity by aggregating failed login attempts per source IP and surfacing any address that crosses a set threshold, along with how many distinct usernames it tried. Built as a hands-on exercise in Splunk log ingestion and SPL — the same problem a SIEM correlation rule solves, built from the search bar up to understand the mechanics.
index="main" sourcetype="linux_secure" "Failed password"
| rex "Failed password for (invalid user )?(?<user>\S+) from (?<src_ip>\S+) port"
| stats count dc(user) as unique_user by src_ip
| sort -count
| where count >=5
Breaking the search down:
-
index="main" sourcetype="linux_secure" "Failed password"— pulls events from the index and keeps only those containing "Failed password." This is the filter; everything downstream operates on that subset. -
rex "Failed password for (invalid user )?(?<user>\S+) from (?<src_ip>\S+) port"— runs a regular expression against each matching event and creates two new fields from the named capture groups: user and src_ip. The (invalid user )? is optional so the pattern matches attempts against both real and non-existent accounts. -
stats count dc(user) as unique_user by src_ip— aggregates. For each source IP it returns total failed attempts (count) and the number of distinct usernames tried (dc(user), renamed unique_user). One username with many attempts looks like a locked-out user; many usernames from one IP looks like an attack. -
sort -count— orders by attempt volume, highest first. -
where count >=5— the detection threshold. Any source IP with five or more failed attempts is flagged. Five is deliberately low for a sample dataset; a production threshold would account for time windows, legitimate lockout behavior, and per-source baselines.
Reproduction is as simple as entering into your Splunk local install, ingesting Splunk_sample_auth.log, selecting the index=main, specifying sourcetype=linux_secure and running the search. In order to fully reproduce and validate you should also run logchecker.py located within SSH-Log-Analyzer against the logs provided within this repo.
During initial setup and creation I found minimal issues, near the end of completion I cross-checked the Splunk results with my local Python parser and found that the results were different. The Splunk results were showing triple the amount of the Python parser, after closer examination it became clear that I had accidentally uploaded the same file three separate times. The Splunk output had looked normal on its own, a bit high, but nothing obviously wrong. I cleared the ingested data, re-uploaded the log once, and re-ran both tools. Exact 1:1 match.
Threshold is static (5 attempts or more), only a single log source, no alerting configured and only sample data.
Splunk_sample_auth.log is a separately generated dataset from the sample found within SSH-Log-Analyzer. It's the same generator just with different data.