Analyzing SSH Log Files Using Splunk
SIEM
Objective
To analyze SSH authentication events from system logs using Splunk to identify possible
brute-force attacks, unauthorized access attempts, and overall SSH login activity.
Tools Used
- Splunk Enterprise (Search & Reporting App)
- Log Format: JSON-based SSH logs
Dataset Used
Source: ssh_logs.json
Host: DESKTOP-AM4GS1A
Sourcetype: _json
Number of total events: 2,400
Queries & Analysis Performed
1. Failed SSH Login Attempts by Source IP
Query:
source="ssh_logs.json" host="DESKTOP-AM4GS1A" sourcetype="_json" auth_success=false
| stats count by "id.orig_h" | sort -count | head 10
Purpose: To identify top IPs with the most failed SSH login attempts — indicating possible
brute-force sources.
Top Result: 10.0.0.25 with 44 failed login attempts
2. Total SSH Connections Count
Query:
source="ssh_logs.json" host="DESKTOP-AM4GS1A" sourcetype="_json"
| stats count as total_ssh_connections
Purpose: To count total SSH-related events.
Result: 2,400 total SSH log events
3. Event Type Distribution
Query:
source="ssh_logs.json" host="DESKTOP-AM4GS1A" sourcetype="_json"
| stats count by event_type
Purpose: To categorize different SSH login events.
Results:
- Successful SSH Login: 612
- Failed SSH Login: 610
- Multiple Failed Authentication Attempts: 606
- Connection Without Authentication: 572
Security Insights
- High number of failed and multiple failed logins suggests potential brute-force attacks.
- Consistent IPs with multiple failures may be marked for firewall rules or further
investigation.
- Unusual successful logins after multiple failures could point to compromised credentials.
Suggested Mitigations
- Implement account lockouts after several failed attempts.
- Use key-based authentication instead of passwords.
- Enable SSH logging and regularly analyze them using Splunk.
- Block or restrict access from suspicious IP addresses.
Conclusion
This Splunk-based mini-project demonstrated how to leverage SIEM tools to analyze SSH
log data for identifying malicious behavior patterns and gaining insights into SSH access
trends. Such proactive monitoring is essential for maintaining a secure IT environment.