Do you have a better way to monitor brute force attacks on Linux Servers?

[xsstest]

This is the Linux system's secure log（/var/log/secure）。I tried to crack the user and password to login SSH .

now,I extracted two fields, one is the login_IP, one is the login_name.

SPL search on Splunk Enterprise :

index=test  Failed password for |transantion maxpause=2s maxspan=10s|where eventcount>=9|table login_name,login_IP

I think my method is not perfect, Then do you have a better way to monitor violence crack against Linux login

May 15 16:04:38 localhost sshd[5514]: Failed password for root from 192.168.240.143 port 49790 ssh2
May 15 16:04:38 localhost sshd[5517]: Failed password for root from 192.168.240.143 port 49796 ssh2
May 15 16:04:38 localhost sshd[5519]: Failed password for root from 192.168.240.143 port 49800 ssh2
May 15 16:04:38 localhost sshd[5516]: Failed password for root from 192.168.240.143 port 49794 ssh2
May 15 16:04:38 localhost sshd[5513]: Failed password for root from 192.168.240.143 port 49786 ssh2
May 15 16:04:38 localhost sshd[5520]: Failed password for root from 192.168.240.143 port 49802 ssh2
May 15 16:04:38 localhost sshd[5521]: Failed password for root from 192.168.240.143 port 49804 ssh2
May 15 16:04:38 localhost sshd[5512]: Failed password for root from 192.168.240.143 port 49788 ssh2
May 15 16:04:38 localhost sshd[5515]: Failed password for root from 192.168.240.143 port 49792 ssh2
May 15 16:04:38 localhost sshd[5518]: Failed password for root from 192.168.240.143 port 49798 ssh2
May 15 16:04:53 localhost sshd[5544]: Failed password for root from 192.168.240.143 port 50310 ssh2
May 15 16:04:53 localhost sshd[5545]: Failed password for root from 192.168.240.143 port 50312 ssh2
May 15 16:04:53 localhost sshd[5550]: Failed password for root from 192.168.240.143 port 50322 ssh2
May 15 16:04:53 localhost sshd[5548]: Failed password for root from 192.168.240.143 port 50318 ssh2
May 15 16:04:53 localhost sshd[5549]: Failed password for root from 192.168.240.143 port 50320 ssh2
May 15 16:04:53 localhost sshd[5551]: Failed password for root from 192.168.240.143 port 50324 ssh2
May 15 16:04:53 localhost sshd[5546]: Failed password for root from 192.168.240.143 port 50314 ssh2
May 15 16:04:53 localhost sshd[5552]: Failed password for root from 192.168.240.143 port 50326 ssh2
May 15 16:04:53 localhost sshd[5553]: Failed password for root from 192.168.240.143 port 50328 ssh2
May 15 16:04:53 localhost sshd[5547]: Failed password for root from 192.168.240.143 port 50316 ssh2
May 15 16:04:55 localhost sshd[5545]: Failed password for root from 192.168.240.143 port 50312 ssh2
May 15 16:04:55 localhost sshd[5544]: Failed password for root from 192.168.240.143 port 50310 ssh2
May 15 16:04:55 localhost sshd[5546]: Failed password for root from 192.168.240.143 port 50314 ssh2
May 15 16:04:55 localhost sshd[5549]: Failed password for root from 192.168.240.143 port 50320 ssh2
May 15 16:04:55 localhost sshd[5550]: Failed password for root from 192.168.240.143 port 50322 ssh2
May 15 16:04:55 localhost sshd[5552]: Failed password for root from 192.168.240.143 port 50326 ssh2
May 15 16:04:55 localhost sshd[5551]: Failed password for root from 192.168.240.143 port 50324 ssh2
May 15 16:04:55 localhost sshd[5547]: Failed password for root from 192.168.240.143 port 50316 ssh2
May 15 16:04:55 localhost sshd[5548]: Failed password for root from 192.168.240.143 port 50318 ssh2
May 15 16:04:55 localhost sshd[5553]: Failed password for root from 192.168.240.143 port 50328 ssh2
May 15 16:04:57 localhost sshd[5545]: Failed password for root from 192.168.240.143 port 50312 ssh2
May 15 16:04:57 localhost sshd[5552]: Failed password for root from 192.168.240.143 port 50326 ssh2
May 15 16:04:57 localhost sshd[5547]: Failed password for root from 192.168.240.143 port 50316 ssh2
May 15 16:04:57 localhost sshd[5551]: Failed password for root from 192.168.240.143 port 50324 ssh2
May 15 16:04:57 localhost sshd[5548]: Failed password for root from 192.168.240.143 port 50318 ssh2
May 15 16:04:57 localhost sshd[5550]: Failed password for root from 192.168.240.143 port 50322 ssh2
May 15 16:04:57 localhost sshd[5544]: Failed password for root from 192.168.240.143 port 50310 ssh2
May 15 16:04:57 localhost sshd[5546]: Failed password for root from 192.168.240.143 port 50314 ssh2
May 15 16:04:57 localhost sshd[5549]: Failed password for root from 192.168.240.143 port 50320 ssh2
May 15 16:04:57 localhost sshd[5553]: Failed password for root from 192.168.240.143 port 50328 ssh2
May 15 16:04:59 localhost sshd[5545]: Failed password for root from 192.168.240.143 port 50312 ssh2
May 15 16:04:59 localhost sshd[5552]: Failed password for root from 192.168.240.143 port 50326 ssh2
May 15 16:04:59 localhost sshd[5548]: Failed password for root from 192.168.240.143 port 50318 ssh2
May 15 16:04:59 localhost sshd[5547]: Failed password for root from 192.168.240.143 port 50316 ssh2
May 15 16:04:59 localhost sshd[5546]: Failed password for root from 192.168.240.143 port 50314 ssh2
May 15 16:04:59 localhost sshd[5550]: Failed password for root from 192.168.240.143 port 50322 ssh2
May 15 16:04:59 localhost sshd[5544]: Failed password for root from 192.168.240.143 port 50310 ssh2
May 15 16:04:59 localhost sshd[5551]: Failed password for root from 192.168.240.143 port 50324 ssh2
May 15 16:04:59 localhost sshd[5549]: Failed password for root from 192.168.240.143 port 50320 ssh2
May 15 16:04:59 localhost sshd[5553]: Failed password for root from 192.168.240.143 port 50328 ssh2
May 15 16:05:01 localhost sshd[5552]: Failed password for root from 192.168.240.143 port 50326 ssh2
May 15 16:05:01 localhost sshd[5545]: Failed password for root from 192.168.240.143 port 50312 ssh2
May 15 16:05:01 localhost sshd[5544]: Failed password for root from 192.168.240.143 port 50310 ssh2
May 15 16:05:01 localhost sshd[5551]: Failed password for root from 192.168.240.143 port 50324 ssh2
May 15 16:05:01 localhost sshd[5547]: Failed password for root from 192.168.240.143 port 50316 ssh2
May 15 16:05:01 localhost sshd[5550]: Failed password for root from 192.168.240.143 port 50322 ssh2
May 15 16:05:01 localhost sshd[5549]: Failed password for root from 192.168.240.143 port 50320 ssh2
May 15 16:05:01 localhost sshd[5546]: Failed password for root from 192.168.240.143 port 50314 ssh2
May 15 16:05:01 localhost sshd[5548]: Failed password for root from 192.168.240.143 port 50318 ssh2
May 15 16:05:01 localhost sshd[5553]: Failed password for root from 192.168.240.143 port 50328 ssh2
May 15 16:05:03 localhost sshd[5552]: Failed password for root from 192.168.240.143 port 50326 ssh2
May 15 16:05:03 localhost sshd[5544]: Failed password for root from 192.168.240.143 port 50310 ssh2
May 15 16:05:03 localhost sshd[5550]: Failed password for root from 192.168.240.143 port 50322 ssh2
May 15 16:05:03 localhost sshd[5546]: Failed password for root from 192.168.240.143 port 50314 ssh2
May 15 16:05:03 localhost sshd[5548]: Failed password for root from 192.168.240.143 port 50318 ssh2
May 15 16:05:03 localhost sshd[5547]: Failed password for root from 192.168.240.143 port 50316 ssh2
May 15 16:05:03 localhost sshd[5551]: Failed password for root from 192.168.240.143 port 50324 ssh2
May 15 16:05:03 localhost sshd[5549]: Failed password for root from 192.168.240.143 port 50320 ssh2
May 15 16:05:03 localhost sshd[5545]: Failed password for root from 192.168.240.143 port 50312 ssh2
May 15 16:05:04 localhost sshd[5553]: Failed password for root from 192.168.240.143 port 50328 ssh2
May 15 16:05:06 localhost sshd[5624]: Failed password for root from 192.168.240.143 port 51260 ssh2
May 15 16:05:06 localhost sshd[5625]: Failed password for root from 192.168.240.143 port 51270 ssh2
May 15 16:05:06 localhost sshd[5631]: Failed password for root from 192.168.240.143 port 51278 ssh2
May 15 16:05:06 localhost sshd[5628]: Failed password for root from 192.168.240.143 port 51272 ssh2
May 15 16:05:06 localhost sshd[5630]: Failed password for root from 192.168.240.143 port 51276 ssh2
May 15 16:05:07 localhost sshd[5629]: Failed password for root from 192.168.240.143 port 51274 ssh2
May 15 16:05:08 localhost sshd[5631]: Failed password for root from 192.168.240.143 port 51278 ssh2
May 15 16:05:08 localhost sshd[5624]: Failed password for root from 192.168.240.143 port 51260 ssh2
May 15 16:05:08 localhost sshd[5628]: Failed password for root from 192.168.240.143 port 51272 ssh2
May 15 16:05:08 localhost sshd[5630]: Failed password for root from 192.168.240.143 port 51276 ssh2
May 15 16:05:08 localhost sshd[5625]: Failed password for root from 192.168.240.143 port 51270 ssh2
May 15 16:05:09 localhost sshd[5629]: Failed password for root from 192.168.240.143 port 51274 ssh2
May 15 16:05:10 localhost sshd[5629]: Failed password for root from 192.168.240.143 port 51274 ssh2
May 15 16:05:10 localhost sshd[5628]: Failed password for root from 192.168.240.143 port 51272 ssh2
May 15 16:05:10 localhost sshd[5631]: Failed password for root from 192.168.240.143 port 51278 ssh2
May 15 16:05:10 localhost sshd[5624]: Failed password for root from 192.168.240.143 port 51260 ssh2
May 15 16:05:10 localhost sshd[5630]: Failed password for root from 192.168.240.143 port 51276 ssh2
May 15 16:05:10 localhost sshd[5625]: Failed password for root from 192.168.240.143 port 51270 ssh2
May 15 16:05:13 localhost sshd[5624]: Failed password for root from 192.168.240.143 port 51260 ssh2
May 15 16:05:13 localhost sshd[5630]: Failed password for root from 192.168.240.143 port 51276 ssh2
May 15 16:05:13 localhost sshd[5629]: Failed password for root from 192.168.240.143 port 51274 ssh2
May 15 16:05:13 localhost sshd[5631]: Failed password for root from 192.168.240.143 port 51278 ssh2
May 15 16:05:13 localhost sshd[5628]: Failed password for root from 192.168.240.143 port 51272 ssh2
May 15 16:05:13 localhost sshd[5625]: Failed password for root from 192.168.240.143 port 51270 ssh2
May 15 16:05:13 localhost sshd[5662]: Failed password for root from 192.168.240.143 port 51284 ssh2
May 15 16:05:13 localhost sshd[5664]: Failed password for root from 192.168.240.143 port 51286 ssh2
May 15 16:05:13 localhost sshd[5661]: Failed password for root from 192.168.240.143 port 51282 ssh2
May 15 16:05:13 localhost sshd[5660]: Failed password for root from 192.168.240.143 port 51280 ssh2
May 15 16:05:15 localhost sshd[5630]: Failed password for root from 192.168.240.143 port 51276 ssh2
May 15 16:05:15 localhost sshd[5629]: Failed password for root from 192.168.240.143 port 51274 ssh2
May 15 16:05:15 localhost sshd[5628]: Failed password for root from 192.168.240.143 port 51272 ssh2
May 15 16:05:15 localhost sshd[5631]: Failed password for root from 192.168.240.143 port 51278 ssh2
May 15 16:05:15 localhost sshd[5624]: Failed password for root from 192.168.240.143 port 51260 ssh2
May 15 16:05:15 localhost sshd[5625]: Failed password for root from 192.168.240.143 port 51270 ssh2
May 15 16:05:16 localhost sshd[5660]: Failed password for root from 192.168.240.143 port 51280 ssh2
May 15 16:05:16 localhost sshd[5661]: Failed password for root from 192.168.240.143 port 51282 ssh2
May 15 16:05:16 localhost sshd[5664]: Failed password for root from 192.168.240.143 port 51286 ssh2
May 15 16:05:16 localhost sshd[5662]: Failed password for root from 192.168.240.143 port 51284 ssh2
May 15 16:05:17 localhost sshd[5628]: Failed password for root from 192.168.240.143 port 51272 ssh2
May 15 16:05:17 localhost sshd[5629]: Failed password for root from 192.168.240.143 port 51274 ssh2
May 15 16:05:17 localhost sshd[5624]: Failed password for root from 192.168.240.143 port 51260 ssh2
May 15 16:05:17 localhost sshd[5631]: Failed password for root from 192.168.240.143 port 51278 ssh2
May 15 16:05:17 localhost sshd[5630]: Failed password for root from 192.168.240.143 port 51276 ssh2
May 15 16:05:17 localhost sshd[5625]: Failed password for root from 192.168.240.143 port 51270 ssh2
May 15 16:05:18 localhost sshd[5661]: Failed password for root from 192.168.240.143 port 51282 ssh2
May 15 16:05:18 localhost sshd[5664]: Failed password for root from 192.168.240.143 port 51286 ssh2
May 15 16:05:18 localhost sshd[5660]: Failed password for root from 192.168.240.143 port 51280 ssh2
May 15 16:05:18 localhost sshd[5662]: Failed password for root from 192.168.240.143 port 51284 ssh2
May 15 16:05:20 localhost sshd[5696]: Failed password for root from 192.168.240.143 port 52320 ssh2
May 15 16:05:20 localhost sshd[5697]: Failed password for root from 192.168.240.143 port 52322 ssh2
May 15 16:05:20 localhost sshd[5692]: Failed password for root from 192.168.240.143 port 52312 ssh2
May 15 16:05:20 localhost sshd[5695]: Failed password for root from 192.168.240.143 port 52318 ssh2
May 15 16:05:20 localhost sshd[5694]: Failed password for root from 192.168.240.143 port 52316 ssh2
May 15 16:05:20 localhost sshd[5698]: Failed password for root from 192.168.240.143 port 52324 ssh2
May 15 16:05:20 localhost sshd[5661]: Failed password for root from 192.168.240.143 port 51282 ssh2
May 15 16:05:20 localhost sshd[5664]: Failed password for root from 192.168.240.143 port 51286 ssh2
May 15 16:05:20 localhost sshd[5660]: Failed password for root from 192.168.240.143 port 51280 ssh2
May 15 16:05:20 localhost sshd[5662]: Failed password for root from 192.168.240.143 port 51284 ssh2
May 15 16:05:22 localhost sshd[5697]: Failed password for root from 192.168.240.143 port 52322 ssh2
May 15 16:05:22 localhost sshd[5696]: Failed password for root from 192.168.240.143 port 52320 ssh2
May 15 16:05:22 localhost sshd[5692]: Failed password for root from 192.168.240.143 port 52312 ssh2
May 15 16:05:22 localhost sshd[5694]: Failed password for root from 192.168.240.143 port 52316 ssh2
May 15 16:05:22 localhost sshd[5695]: Failed password for root from 192.168.240.143 port 52318 ssh2
May 15 16:05:22 localhost sshd[5698]: Failed password for root from 192.168.240.143 port 52324 ssh2
May 15 16:05:22 localhost sshd[5661]: Failed password for root from 192.168.240.143 port 51282 ssh2
May 15 16:05:22 localhost sshd[5664]: Failed password for root from 192.168.240.143 port 51286 ssh2
May 15 16:05:22 localhost sshd[5660]: Failed password for root from 192.168.240.143 port 51280 ssh2
May 15 16:05:23 localhost sshd[5662]: Failed password for root from 192.168.240.143 port 51284 ssh2
May 15 16:05:24 localhost sshd[5697]: Failed password for root from 192.168.240.143 port 52322 ssh2
May 15 16:05:24 localhost sshd[5692]: Failed password for root from 192.168.240.143 port 52312 ssh2
May 15 16:05:24 localhost sshd[5696]: Failed password for root from 192.168.240.143 port 52320 ssh2
May 15 16:05:24 localhost sshd[5698]: Failed password for root from 192.168.240.143 port 52324 ssh2
May 15 16:05:24 localhost sshd[5695]: Failed password for root from 192.168.240.143 port 52318 ssh2
May 15 16:05:24 localhost sshd[5694]: Failed password for root from 192.168.240.143 port 52316 ssh2
May 15 16:05:25 localhost sshd[5661]: Failed password for root from 192.168.240.143 port 51282 ssh2
May 15 16:05:25 localhost sshd[5664]: Failed password for root from 192.168.240.143 port 51286 ssh2
May 15 16:05:25 localhost sshd[5662]: Failed password for root from 192.168.240.143 port 51284 ssh2
May 15 16:05:25 localhost sshd[5660]: Failed password for root from 192.168.240.143 port 51280 ssh2
May 15 16:05:26 localhost sshd[5697]: Failed password for root from 192.168.240.143 port 52322 ssh2
May 15 16:05:26 localhost sshd[5692]: Failed password for root from 192.168.240.143 port 52312 ssh2
May 15 16:05:26 localhost sshd[5698]: Failed password for root from 192.168.240.143 port 52324 ssh2
May 15 16:05:26 localhost sshd[5695]: Failed password for root from 192.168.240.143 port 52318 ssh2
May 15 16:05:26 localhost sshd[5696]: Failed password for root from 192.168.240.143 port 52320 ssh2
May 15 16:05:27 localhost sshd[5694]: Failed password for root from 192.168.240.143 port 52316 ssh2
May 15 16:05:28 localhost sshd[5742]: Failed password for root from 192.168.240.143 port 52330 ssh2
May 15 16:05:28 localhost sshd[5745]: Failed password for root from 192.168.240.143 port 52332 ssh2
May 15 16:05:28 localhost sshd[5740]: Failed password for root from 192.168.240.143 port 52326 ssh2
May 15 16:05:28 localhost sshd[5741]: Failed password for root from 192.168.240.143 port 52328 ssh2
May 15 16:05:28 localhost sshd[5754]: Failed password for mysql from 192.168.240.143 port 52374 ssh2
May 15 16:05:29 localhost sshd[5759]: Failed password for mysql from 192.168.240.143 port 52382 ssh2
May 15 16:05:29 localhost sshd[5763]: Failed password for mysql from 192.168.240.143 port 52386 ssh2
May 15 16:05:29 localhost sshd[5758]: Failed password for mysql from 192.168.240.143 port 52380 ssh2
May 15 16:05:29 localhost sshd[5752]: Failed password for mysql from 192.168.240.143 port 52370 ssh2
May 15 16:05:29 localhost sshd[5757]: Failed password for mysql from 192.168.240.143 port 52378 ssh2
May 15 16:05:30 localhost sshd[5763]: Failed password for mysql from 192.168.240.143 port 52386 ssh2
May 15 16:05:30 localhost sshd[5777]: Failed password for mysql from 192.168.240.143 port 52450 ssh2
May 15 16:05:30 localhost sshd[5759]: Failed password for mysql from 192.168.240.143 port 52382 ssh2
May 15 16:05:30 localhost sshd[5758]: Failed password for mysql from 192.168.240.143 port 52380 ssh2
May 15 16:05:30 localhost sshd[5772]: Failed password for mysql from 192.168.240.143 port 52438 ssh2
May 15 16:05:30 localhost sshd[5752]: Failed password for mysql from 192.168.240.143 port 52370 ssh2
May 15 16:05:30 localhost sshd[5757]: Failed password for mysql from 192.168.240.143 port 52378 ssh2
May 15 16:05:30 localhost sshd[5774]: Failed password for mysql from 192.168.240.143 port 52440 ssh2
May 15 16:05:30 localhost sshd[5770]: Failed password for mysql from 192.168.240.143 port 52432 ssh2
May 15 16:05:31 localhost sshd[5754]: Failed password for mysql from 192.168.240.143 port 52374 ssh2
May 15 16:05:32 localhost sshd[5777]: Failed password for mysql from 192.168.240.143 port 52450 ssh2
May 15 16:05:32 localhost sshd[5758]: Failed password for mysql from 192.168.240.143 port 52380 ssh2
May 15 16:05:32 localhost sshd[5772]: Failed password for mysql from 192.168.240.143 port 52438 ssh2
May 15 16:05:32 localhost sshd[5759]: Failed password for mysql from 192.168.240.143 port 52382 ssh2
May 15 16:05:32 localhost sshd[5763]: Failed password for mysql from 192.168.240.143 port 52386 ssh2
May 15 16:05:32 localhost sshd[5774]: Failed password for mysql from 192.168.240.143 port 52440 ssh2
May 15 16:05:32 localhost sshd[5770]: Failed password for mysql from 192.168.240.143 port 52432 ssh2
May 15 16:05:32 localhost sshd[5757]: Failed password for mysql from 192.168.240.143 port 52378 ssh2
May 15 16:05:32 localhost sshd[5752]: Failed password for mysql from 192.168.240.143 port 52370 ssh2
May 15 16:05:32 localhost sshd[5754]: Failed password for mysql from 192.168.240.143 port 52374 ssh2
May 15 16:05:35 localhost sshd[5777]: Failed password for mysql from 192.168.240.143 port 52450 ssh2
May 15 16:05:35 localhost sshd[5757]: Failed password for mysql from 192.168.240.143 port 52378 ssh2
May 15 16:05:35 localhost sshd[5774]: Failed password for mysql from 192.168.240.143 port 52440 ssh2
May 15 16:05:35 localhost sshd[5772]: Failed password for mysql from 192.168.240.143 port 52438 ssh2
May 15 16:05:35 localhost sshd[5758]: Failed password for mysql from 192.168.240.143 port 52380 ssh2
May 15 16:05:35 localhost sshd[5752]: Failed password for mysql from 192.168.240.143 port 52370 ssh2
May 15 16:05:35 localhost sshd[5754]: Failed password for mysql from 192.168.240.143 port 52374 ssh2
May 15 16:05:35 localhost sshd[5763]: Failed password for mysql from 192.168.240.143 port 52386 ssh2
May 15 16:05:35 localhost sshd[5759]: Failed password for mysql from 192.168.240.143 port 52382 ssh2
May 15 16:05:35 localhost sshd[5770]: Failed password for mysql from 192.168.240.143 port 52432 ssh2
May 15 16:05:37 localhost sshd[5757]: Failed password for mysql from 192.168.240.143 port 52378 ssh2
May 15 16:05:37 localhost sshd[5777]: Failed password for mysql from 192.168.240.143 port 52450 ssh2
May 15 16:05:37 localhost sshd[5754]: Failed password for mysql from 192.168.240.143 port 52374 ssh2
May 15 16:05:37 localhost sshd[5759]: Failed password for mysql from 192.168.240.143 port 52382 ssh2
May 15 16:05:37 localhost sshd[5772]: Failed password for mysql from 192.168.240.143 port 52438 ssh2
May 15 16:05:37 localhost sshd[5758]: Failed password for mysql from 192.168.240.143 port 52380 ssh2
May 15 16:05:37 localhost sshd[5774]: Failed password for mysql from 192.168.240.143 port 52440 ssh2
May 15 16:05:37 localhost sshd[5770]: Failed password for mysql from 192.168.240.143 port 52432 ssh2
May 15 16:05:37 localhost sshd[5752]: Failed password for mysql from 192.168.240.143 port 52370 ssh2
May 15 16:05:37 localhost sshd[5763]: Failed password for mysql from 192.168.240.143 port 52386 ssh2
May 15 16:05:39 localhost sshd[5754]: Failed password for mysql from 192.168.240.143 port 52374 ssh2
May 15 16:05:39 localhost sshd[5770]: Failed password for mysql from 192.168.240.143 port 52432 ssh2
May 15 16:05:39 localhost sshd[5758]: Failed password for mysql from 192.168.240.143 port 52380 ssh2
May 15 16:05:39 localhost sshd[5752]: Failed password for mysql from 192.168.240.143 port 52370 ssh2
May 15 16:05:39 localhost sshd[5759]: Failed password for mysql from 192.168.240.143 port 52382 ssh2
May 15 16:05:39 localhost sshd[5777]: Failed password for mysql from 192.168.240.143 port 52450 ssh2
May 15 16:05:39 localhost sshd[5774]: Failed password for mysql from 192.168.240.143 port 52440 ssh2
May 15 16:05:39 localhost sshd[5772]: Failed password for mysql from 192.168.240.143 port 52438 ssh2
May 15 16:05:39 localhost sshd[5757]: Failed password for mysql from 192.168.240.143 port 52378 ssh2
May 15 16:05:39 localhost sshd[5763]: Failed password for mysql from 192.168.240.143 port 52386 ssh2
May 15 16:05:41 localhost sshd[5829]: Failed password for invalid user test from 192.168.240.143 port 54604 ssh2
May 15 16:05:41 localhost sshd[5834]: Failed password for invalid user test from 192.168.240.143 port 54612 ssh2
May 15 16:05:42 localhost sshd[5832]: Failed password for invalid user test from 192.168.240.143 port 54608 ssh2
May 15 16:05:42 localhost sshd[5831]: Failed password for invalid user test from 192.168.240.143 port 54606 ssh2
May 15 16:05:42 localhost sshd[5836]: Failed password for invalid user test from 192.168.240.143 port 54616 ssh2
May 15 16:05:42 localhost sshd[5838]: Failed password for invalid user test from 192.168.240.143 port 54620 ssh2
May 15 16:05:42 localhost sshd[5833]: Failed password for invalid user test from 192.168.240.143 port 54610 ssh2
May 15 16:05:42 localhost sshd[5847]: Failed password for invalid user test from 192.168.240.143 port 54622 ssh2
May 15 16:05:42 localhost sshd[5837]: Failed password for invalid user test from 192.168.240.143 port 54618 ssh2
May 15 16:05:42 localhost sshd[5835]: Failed password for invalid user test from 192.168.240.143 port 54614 ssh2
May 15 16:05:43 localhost sshd[5832]: Failed password for invalid user test from 192.168.240.143 port 54608 ssh2
May 15 16:05:43 localhost sshd[5834]: Failed password for invalid user test from 192.168.240.143 port 54612 ssh2
May 15 16:05:43 localhost sshd[5831]: Failed password for invalid user test from 192.168.240.143 port 54606 ssh2
May 15 16:05:43 localhost sshd[5838]: Failed password for invalid user test from 192.168.240.143 port 54620 ssh2
May 15 16:05:43 localhost sshd[5836]: Failed password for invalid user test from 192.168.240.143 port 54616 ssh2
May 15 16:05:43 localhost sshd[5835]: Failed password for invalid user test from 192.168.240.143 port 54614 ssh2
May 15 16:05:43 localhost sshd[5837]: Failed password for invalid user test from 192.168.240.143 port 54618 ssh2
May 15 16:05:43 localhost sshd[5833]: Failed password for invalid user test from 192.168.240.143 port 54610 ssh2
May 15 16:05:43 localhost sshd[5847]: Failed password for invalid user test from 192.168.240.143 port 54622 ssh2
May 15 16:05:43 localhost sshd[5829]: Failed password for invalid user test from 192.168.240.143 port 54604 ssh2
May 15 16:05:45 localhost sshd[5834]: Failed password for invalid user test from 192.168.240.143 port 54612 ssh2
May 15 16:05:45 localhost sshd[5832]: Failed password for invalid user test from 192.168.240.143 port 54608 ssh2
May 15 16:05:45 localhost sshd[5831]: Failed password for invalid user test from 192.168.240.143 port 54606 ssh2
May 15 16:05:45 localhost sshd[5836]: Failed password for invalid user test from 192.168.240.143 port 54616 ssh2
May 15 16:05:45 localhost sshd[5838]: Failed password for invalid user test from 192.168.240.143 port 54620 ssh2
May 15 16:05:45 localhost sshd[5837]: Failed password for invalid user test from 192.168.240.143 port 54618 ssh2
May 15 16:05:45 localhost sshd[5847]: Failed password for invalid user test from 192.168.240.143 port 54622 ssh2
May 15 16:05:45 localhost sshd[5833]: Failed password for invalid user test from 192.168.240.143 port 54610 ssh2
May 15 16:05:45 localhost sshd[5835]: Failed password for invalid user test from 192.168.240.143 port 54614 ssh2
May 15 16:05:45 localhost sshd[5829]: Failed password for invalid user test from 192.168.240.143 port 54604 ssh2
May 15 16:05:47 localhost sshd[5832]: Failed password for invalid user test from 192.168.240.143 port 54608 ssh2
May 15 16:05:47 localhost sshd[5834]: Failed password for invalid user test from 192.168.240.143 port 54612 ssh2
May 15 16:05:47 localhost sshd[5831]: Failed password for invalid user test from 192.168.240.143 port 54606 ssh2
May 15 16:05:47 localhost sshd[5836]: Failed password for invalid user test from 192.168.240.143 port 54616 ssh2
May 15 16:05:47 localhost sshd[5838]: Failed password for invalid user test from 192.168.240.143 port 54620 ssh2
May 15 16:05:47 localhost sshd[5835]: Failed password for invalid user test from 192.168.240.143 port 54614 ssh2
May 15 16:05:47 localhost sshd[5833]: Failed password for invalid user test from 192.168.240.143 port 54610 ssh2
May 15 16:05:47 localhost sshd[5847]: Failed password for invalid user test from 192.168.240.143 port 54622 ssh2
May 15 16:05:47 localhost sshd[5837]: Failed password for invalid user test from 192.168.240.143 port 54618 ssh2
May 15 16:05:47 localhost sshd[5829]: Failed password for invalid user test from 192.168.240.143 port 54604 ssh2
May 15 16:05:49 localhost sshd[5832]: Failed password for invalid user test from 192.168.240.143 port 54608 ssh2
May 15 16:05:49 localhost sshd[5834]: Failed password for invalid user test from 192.168.240.143 port 54612 ssh2
May 15 16:05:49 localhost sshd[5836]: Failed password for invalid user test from 192.168.240.143 port 54616 ssh2
May 15 16:05:49 localhost sshd[5831]: Failed password for invalid user test from 192.168.240.143 port 54606 ssh2
May 15 16:05:49 localhost sshd[5838]: Failed password for invalid user test from 192.168.240.143 port 54620 ssh2
May 15 16:05:49 localhost sshd[5837]: Failed password for invalid user test from 192.168.240.143 port 54618 ssh2
May 15 16:05:49 localhost sshd[5833]: Failed password for invalid user test from 192.168.240.143 port 54610 ssh2
May 15 16:05:49 localhost sshd[5835]: Failed password for invalid user test from 192.168.240.143 port 54614 ssh2
May 15 16:05:49 localhost sshd[5847]: Failed password for invalid user test from 192.168.240.143 port 54622 ssh2
May 15 16:05:49 localhost sshd[5829]: Failed password for invalid user test from 192.168.240.143 port 54604 ssh2
May 15 16:05:51 localhost sshd[5834]: Failed password for invalid user test from 192.168.240.143 port 54612 ssh2
May 15 16:05:51 localhost sshd[5832]: Failed password for invalid user test from 192.168.240.143 port 54608 ssh2
May 15 16:05:51 localhost sshd[5836]: Failed password for invalid user test from 192.168.240.143 port 54616 ssh2
May 15 16:05:51 localhost sshd[5831]: Failed password for invalid user test from 192.168.240.143 port 54606 ssh2
May 15 16:05:51 localhost sshd[5838]: Failed password for invalid user test from 192.168.240.143 port 54620 ssh2
May 15 16:05:51 localhost sshd[5835]: Failed password for invalid user test from 192.168.240.143 port 54614 ssh2
May 15 16:05:51 localhost sshd[5833]: Failed password for invalid user test from 192.168.240.143 port 54610 ssh2
May 15 16:05:51 localhost sshd[5837]: Failed password for invalid user test from 192.168.240.143 port 54618 ssh2
May 15 16:05:51 localhost sshd[5847]: Failed password for invalid user test from 192.168.240.143 port 54622 ssh2
May 15 16:05:51 localhost sshd[5829]: Failed password for invalid user test from 192.168.240.143 port 54604 ssh2
May 15 16:05:53 localhost sshd[5854]: Failed password for invalid user test from 192.168.240.143 port 55542 ssh2
May 15 16:05:53 localhost sshd[5850]: Failed password for invalid user test from 192.168.240.143 port 55530 ssh2
May 15 16:05:53 localhost sshd[5852]: Failed password for invalid user test from 192.168.240.143 port 55538 ssh2
May 15 16:05:53 localhost sshd[5853]: Failed password for invalid user test from 192.168.240.143 port 55540 ssh2
May 15 16:05:53 localhost sshd[5849]: Failed password for invalid user test from 192.168.240.143 port 55532 ssh2
May 15 16:05:53 localhost sshd[5851]: Failed password for invalid user test from 192.168.240.143 port 55536 ssh2
May 15 16:05:54 localhost sshd[5854]: Failed password for invalid user test from 192.168.240.143 port 55542 ssh2
May 15 16:05:54 localhost sshd[5850]: Failed password for invalid user test from 192.168.240.143 port 55530 ssh2
May 15 16:05:54 localhost sshd[5852]: Failed password for invalid user test from 192.168.240.143 port 55538 ssh2
May 15 16:05:54 localhost sshd[5853]: Failed password for invalid user test from 192.168.240.143 port 55540 ssh2
May 15 16:05:55 localhost sshd[5849]: Failed password for invalid user test from 192.168.240.143 port 55532 ssh2
May 15 16:05:55 localhost sshd[5851]: Failed password for invalid user test from 192.168.240.143 port 55536 ssh2
May 15 16:05:56 localhost sshd[5852]: Failed password for invalid user test from 192.168.240.143 port 55538 ssh2
May 15 16:05:56 localhost sshd[5854]: Failed password for invalid user test from 192.168.240.143 port 55542 ssh2
May 15 16:05:56 localhost sshd[5850]: Failed password for invalid user test from 192.168.240.143 port 55530 ssh2
May 15 16:05:57 localhost sshd[5853]: Failed password for invalid user test from 192.168.240.143 port 55540 ssh2
May 15 16:05:57 localhost sshd[5849]: Failed password for invalid user test from 192.168.240.143 port 55532 ssh2
May 15 16:05:57 localhost sshd[5851]: Failed password for invalid user test from 192.168.240.143 port 55536 ssh2
May 15 16:05:58 localhost sshd[5854]: Failed password for invalid user test from 192.168.240.143 port 55542 ssh2
May 15 16:05:58 localhost sshd[5852]: Failed password for invalid user test from 192.168.240.143 port 55538 ssh2
May 15 16:05:58 localhost sshd[5850]: Failed password for invalid user test from 192.168.240.143 port 55530 ssh2
May 15 16:05:58 localhost sshd[5853]: Failed password for invalid user test from 192.168.240.143 port 55540 ssh2
May 15 16:05:58 localhost sshd[5851]: Failed password for invalid user test from 192.168.240.143 port 55536 ssh2
May 15 16:05:59 localhost sshd[5849]: Failed password for invalid user test from 192.168.240.143 port 55532 ssh2
May 15 16:06:01 localhost sshd[5854]: Failed password for invalid user test from 192.168.240.143 port 55542 ssh2
May 15 16:06:01 localhost sshd[5852]: Failed password for invalid user test from 192.168.240.143 port 55538 ssh2
May 15 16:06:01 localhost sshd[5850]: Failed password for invalid user test from 192.168.240.143 port 55530 ssh2
May 15 16:06:01 localhost sshd[5851]: Failed password for invalid user test from 192.168.240.143 port 55536 ssh2
May 15 16:06:01 localhost sshd[5853]: Failed password for invalid user test from 192.168.240.143 port 55540 ssh2
May 15 16:06:01 localhost sshd[5849]: Failed password for invalid user test from 192.168.240.143 port 55532 ssh2
May 15 16:06:01 localhost sshd[5862]: Failed password for invalid user test from 192.168.240.143 port 55546 ssh2
May 15 16:06:01 localhost sshd[5864]: Failed password for invalid user test from 192.168.240.143 port 55548 ssh2
May 15 16:06:01 localhost sshd[5865]: Failed password for invalid user test from 192.168.240.143 port 55550 ssh2
May 15 16:06:01 localhost sshd[5861]: Failed password for invalid user test from 192.168.240.143 port 55544 ssh2
May 15 16:06:03 localhost sshd[5852]: Failed password for invalid user test from 192.168.240.143 port 55538 ssh2
May 15 16:06:03 localhost sshd[5854]: Failed password for invalid user test from 192.168.240.143 port 55542 ssh2
May 15 16:06:03 localhost sshd[5850]: Failed password for invalid user test from 192.168.240.143 port 55530 ssh2
May 15 16:06:03 localhost sshd[5869]: Failed password for toor from 192.168.240.143 port 56516 ssh2
May 15 16:06:03 localhost sshd[5873]: Failed password for toor from 192.168.240.143 port 56530 ssh2
May 15 16:06:03 localhost sshd[5881]: Failed password for toor from 192.168.240.143 port 56650 ssh2
May 15 16:06:03 localhost sshd[5870]: Failed password for toor from 192.168.240.143 port 56522 ssh2
May 15 16:06:03 localhost sshd[5884]: Failed password for toor from 192.168.240.143 port 56652 ssh2
May 15 16:06:04 localhost sshd[5878]: Failed password for toor from 192.168.240.143 port 56616 ssh2
May 15 16:06:04 localhost sshd[5880]: Failed password for toor from 192.168.240.143 port 56644 ssh2
May 15 16:06:05 localhost sshd[5892]: Failed password for toor from 192.168.240.143 port 57188 ssh2
May 15 16:06:05 localhost sshd[5894]: Failed password for toor from 192.168.240.143 port 57190 ssh2
May 15 16:06:05 localhost sshd[5890]: Failed password for toor from 192.168.240.143 port 57180 ssh2
May 15 16:06:05 localhost sshd[5878]: Failed password for toor from 192.168.240.143 port 56616 ssh2
May 15 16:06:05 localhost sshd[5881]: Failed password for toor from 192.168.240.143 port 56650 ssh2
May 15 16:06:05 localhost sshd[5884]: Failed password for toor from 192.168.240.143 port 56652 ssh2
May 15 16:06:05 localhost sshd[5870]: Failed password for toor from 192.168.240.143 port 56522 ssh2
May 15 16:06:05 localhost sshd[5869]: Failed password for toor from 192.168.240.143 port 56516 ssh2
May 15 16:06:05 localhost sshd[5880]: Failed password for toor from 192.168.240.143 port 56644 ssh2
May 15 16:06:05 localhost sshd[5873]: Failed password for toor from 192.168.240.143 port 56530 ssh2
May 15 16:06:07 localhost sshd[5892]: Failed password for toor from 192.168.240.143 port 57188 ssh2
May 15 16:06:07 localhost sshd[5890]: Failed password for toor from 192.168.240.143 port 57180 ssh2
May 15 16:06:07 localhost sshd[5894]: Failed password for toor from 192.168.240.143 port 57190 ssh2
May 15 16:06:07 localhost sshd[5878]: Failed password for toor from 192.168.240.143 port 56616 ssh2
May 15 16:06:07 localhost sshd[5881]: Failed password for toor from 192.168.240.143 port 56650 ssh2
May 15 16:06:07 localhost sshd[5884]: Failed password for toor from 192.168.240.143 port 56652 ssh2
May 15 16:06:07 localhost sshd[5873]: Failed password for toor from 192.168.240.143 port 56530 ssh2
May 15 16:06:07 localhost sshd[5870]: Failed password for toor from 192.168.240.143 port 56522 ssh2
May 15 16:06:07 localhost sshd[5869]: Failed password for toor from 192.168.240.143 port 56516 ssh2
May 15 16:06:07 localhost sshd[5880]: Failed password for toor from 192.168.240.143 port 56644 ssh2
May 15 16:06:09 localhost sshd[5894]: Failed password for toor from 192.168.240.143 port 57190 ssh2

[DalJeanis · Accepted solution]

Honestly, ANY failed password for ROOT seems like it would suggest an issue. More than 3 in a second, worth alerting on.

 index=test  "Failed password for" 
| bin _time span=1s 
| rex "Failed password for (?<userid>.*?) from (?<fromIP)>[\d\.]+) port (?<port>\d+)" 
| stats  count as trycount, values(login_IP) as login_IP, values(port) as port  by  login_name _time
| streamstats window=2 sum(trycount) as eventcount values(port) as eventports by login_name 
| where eventcount>=4 OR (eventcount>=3 AND userid="root")
| table login_name,login_IP, eventports

The streamstats is to catch attacks that happen to split across an even second boundary. I'm assuming that the value for login_name is identical to what I'm extracting as userid, and the value for login_IP is identical to what I'm extracting as FromIP. I only left the rex in there because I'd like to see the port in this situation.

Obviously, this method will not catch a low-and-slow attack, but you were asking for a brute force attack, so there you go.

[xsstest]

Attackers do not necessarily use the root account, you may also use other accounts

[DalJeanis]

True, but my professional experience is that only employees with a good job-related reason should be trying for root, and they shouldn't screw up the password more than once.

For your purposes, the search becomes simpler...

 index=test  "Failed password for" 
 | bin _time span=1s 
 | stats  count as trycount, values(login_IP) as login_IP  by  login_name, _time
 | streamstats window=2 sum(trycount) as eventcount by login_name 
 | where eventcount>=9 
 | table _time login_name, login_IP, eventcount

[xsstest]

and the port is not very important

[ddrillic]

It's a good start ; -)

Related article at How To Stop Brute force Password Attack Using Splunk

A starting query from there -

index=MyApplicationIndex LOGIN_ATTEMPT=F CLIENT_IP=* minutesago=1 | stats count by CLIENT_IP | search count>1000 

[xsstest]

Like me, this is too simple, I think not perfect.

[DalJeanis]

There's a maxim that applies here - "Done" is better than "Perfect".

Start with anything which approximates the desired solution, and then trade up whenever you find a better way.

...and with splunk alerting, there's no reason you can't have three different imperfect solutions all running at the same time, and adjust them as conditions change.