Reporting

report on ssh login attempts from the foreign source ip address

gisnetsec
Explorer

I have several firewall appliances logging into one syslog file and would like to report on the number of SSH login attempts by the external source IP. The fields are a little different from typical syslog format. The appliances do not have the same rule base, so I can't key on rule number.

May 25 07:20:53 10.1.2.3 2011: May 25 15:37:39 fw_appl <50000> Dropped Inbound packet (Policy rule) Src:85.1.2.3 SPort:2624 Dst:62.1.2.3 DPort:22 IPP:6 Rule:21 Interface:WAN (Internet)

May 25 07:20:54 10.1.2.3 2011: May 25 15:37:40 fw_appl <50000> Dropped Inbound packet (Policy rule) Src:85.1.2.3 SPort:2639 Dst:62.1.2.3 DPort:22 IPP:6 Rule:21 Interface:WAN (Internet)

Tags (2)
0 Karma

ftk
Motivator

How about this:

"Dropped Inbound packet" Interface="WAN (Internet)" DPort=22 NOT Src=10.* NOT Src=192.168.* | stats count by host, Src

This search assumes that all the fields in your syslog message are extracted by Splunk.

ftk
Motivator

From your question I assumed you wanted to see stats on both src ip as well as firewall device. If you just want the src ip, modify your search as such: | stats count by Src

0 Karma

gisnetsec
Explorer

maybe the Src: field is not extracted as expected

0 Karma

gisnetsec
Explorer

it seems to track the device IP address as the host, instead of Src:x.x.x.x -- when I go to report I see the fw appliance and the count of ssh logins without tracking how many times the foreign address attempted

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...