Are you a member of the Splunk Community?
- Find Answers
- :
- Using Splunk
- :
- Other Using Splunk
- :
- Reporting
- :
- report on ssh login attempts from the foreign sour...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
report on ssh login attempts from the foreign source ip address
I have several firewall appliances logging into one syslog file and would like to report on the number of SSH login attempts by the external source IP. The fields are a little different from typical syslog format. The appliances do not have the same rule base, so I can't key on rule number.
May 25 07:20:53 10.1.2.3 2011: May 25 15:37:39 fw_appl <50000> Dropped Inbound packet (Policy rule) Src:85.1.2.3 SPort:2624 Dst:62.1.2.3 DPort:22 IPP:6 Rule:21 Interface:WAN (Internet)
May 25 07:20:54 10.1.2.3 2011: May 25 15:37:40 fw_appl <50000> Dropped Inbound packet (Policy rule) Src:85.1.2.3 SPort:2639 Dst:62.1.2.3 DPort:22 IPP:6 Rule:21 Interface:WAN (Internet)
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
How about this:
"Dropped Inbound packet" Interface="WAN (Internet)" DPort=22 NOT Src=10.* NOT Src=192.168.* | stats count by host, Src
This search assumes that all the fields in your syslog message are extracted by Splunk.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
From your question I assumed you wanted to see stats on both src ip as well as firewall device. If you just want the src ip, modify your search as such: | stats count by Src
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
maybe the Src: field is not extracted as expected
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
it seems to track the device IP address as the host, instead of Src:x.x.x.x -- when I go to report I see the fw appliance and the count of ssh logins without tracking how many times the foreign address attempted
Splunk Classroom Chronicles: Training Tales and Testimonials (Episode 3)
Operationalizing TDIR: Building a More Resilient, Scalable SOC
Almost Too Eventful Assurance: Part 1
