Reporting

report on ssh login attempts from the foreign source ip address

gisnetsec
Explorer

I have several firewall appliances logging into one syslog file and would like to report on the number of SSH login attempts by the external source IP. The fields are a little different from typical syslog format. The appliances do not have the same rule base, so I can't key on rule number.

May 25 07:20:53 10.1.2.3 2011: May 25 15:37:39 fw_appl <50000> Dropped Inbound packet (Policy rule) Src:85.1.2.3 SPort:2624 Dst:62.1.2.3 DPort:22 IPP:6 Rule:21 Interface:WAN (Internet)

May 25 07:20:54 10.1.2.3 2011: May 25 15:37:40 fw_appl <50000> Dropped Inbound packet (Policy rule) Src:85.1.2.3 SPort:2639 Dst:62.1.2.3 DPort:22 IPP:6 Rule:21 Interface:WAN (Internet)

Tags (2)
0 Karma

ftk
Motivator

How about this:

"Dropped Inbound packet" Interface="WAN (Internet)" DPort=22 NOT Src=10.* NOT Src=192.168.* | stats count by host, Src

This search assumes that all the fields in your syslog message are extracted by Splunk.

ftk
Motivator

From your question I assumed you wanted to see stats on both src ip as well as firewall device. If you just want the src ip, modify your search as such: | stats count by Src

0 Karma

gisnetsec
Explorer

maybe the Src: field is not extracted as expected

0 Karma

gisnetsec
Explorer

it seems to track the device IP address as the host, instead of Src:x.x.x.x -- when I go to report I see the fw appliance and the count of ssh logins without tracking how many times the foreign address attempted

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...