Initial Access
Difficulty: very-easy
Log Format: syslog
The Locksmith
Someone is trying to break into your webserver. They're using a standard ssh brute-force tool, banging away at the login. Find the attacker's IP address and count how many failed attempts they made.
Brute ForceSSHThreat Hunting
Investigation Scenario
Someone is trying to break into your webserver. They're using a standard ssh brute-force tool, banging away at the login. Find the attacker's IP address and count how many failed attempts they made.