https://community.splunk.com/t5/Alerting/Alert-on-a-user-attempting-to-connect-from-one-box-to-another/m-p/231162#M4304 <P>If you mean "how can I identify an ssh login attempt between 2 Linux boxes that uses a specific user name," that's pretty simple.<BR /> First, on the target system, make sure you are collecting <CODE>/var/log/secure.log</CODE> and sending it to Splunk with a sourcetype of <CODE>linux_secure</CODE> Then, your Splunk search will be:</P> <PRE><CODE>sourcetype=linux_secure host="target system name" src_ip="ip address of first system" user="user name" </CODE></PRE> <P>That gives you a starting point, at least. <CODE>secure.log</CODE> is the ssh log and it is normally found in <CODE>/var/log</CODE></P> Wed, 17 Aug 2016 23:17:08 GMT lguinn2 2016-08-17T23:17:08Z https://community.splunk.com/t5/Alerting/Alert-on-a-user-attempting-to-connect-from-one-box-to-another/m-p/231161#M4303 <P>Hi Guys,</P> <P>Whats the best way if at all to alert on a specific user trying to connect from a specific system to another specific system ? any help would be greatly appreciated, if it matters the systems will be Unix systems not Windows</P> Wed, 17 Aug 2016 15:12:41 GMT https://community.splunk.com/t5/Alerting/Alert-on-a-user-attempting-to-connect-from-one-box-to-another/m-p/231161#M4303 AaronMoorcroft 2016-08-17T15:12:41Z https://community.splunk.com/t5/Alerting/Alert-on-a-user-attempting-to-connect-from-one-box-to-another/m-p/231162#M4304 <P>If you mean "how can I identify an ssh login attempt between 2 Linux boxes that uses a specific user name," that's pretty simple.<BR /> First, on the target system, make sure you are collecting <CODE>/var/log/secure.log</CODE> and sending it to Splunk with a sourcetype of <CODE>linux_secure</CODE> Then, your Splunk search will be:</P> <PRE><CODE>sourcetype=linux_secure host="target system name" src_ip="ip address of first system" user="user name" </CODE></PRE> <P>That gives you a starting point, at least. <CODE>secure.log</CODE> is the ssh log and it is normally found in <CODE>/var/log</CODE></P> Wed, 17 Aug 2016 23:17:08 GMT https://community.splunk.com/t5/Alerting/Alert-on-a-user-attempting-to-connect-from-one-box-to-another/m-p/231162#M4304 lguinn2 2016-08-17T23:17:08Z https://community.splunk.com/t5/Alerting/Alert-on-a-user-attempting-to-connect-from-one-box-to-another/m-p/231163#M4305 <P>Thank you that's a great help</P> Thu, 18 Aug 2016 08:52:09 GMT https://community.splunk.com/t5/Alerting/Alert-on-a-user-attempting-to-connect-from-one-box-to-another/m-p/231163#M4305 AaronMoorcroft 2016-08-18T08:52:09Z