Upload SSH Logs
Uploaded the JSON SSH dataset into Splunk Enterprise using the Add Data workflow.
CompletedSIEM & Log AnalysisLocal SOC Lab
SSH Log Analysis using Splunk
Local Splunk Enterprise Lab — SSH Authentication Analysis
A local SOC lab focused on analyzing SSH authentication activity in Splunk to detect failed login patterns, repeated authentication failures, successful access, and connections without authentication.
- Role
- SOC Analyst Learner
- Environment
- Local Splunk Enterprise Lab
- Scenario
- SSH Authentication Analysis
- Status
- Completed
- SIEM
- Splunk Enterprise
- Events
- 1,200 SSH events
01Scenario Overview
This case study documents a hands-on SSH authentication investigation using Splunk Enterprise. The lab focused on ingesting a JSON SSH dataset, validating extracted fields, and using SPL searches to identify suspicious login behavior.
The investigation covered successful logins, failed logins, multiple failed authentication attempts, and connections that reached SSH without completing authentication.
02Investigation Workflow
Validate Fields
Confirmed key fields such as event_type, auth_success, auth_attempts, id.orig_h, and id.resp_h were parsed.
Count Event Types
Used SPL to summarize SSH activity across successful logins, failed logins, repeated failures, and unauthenticated connections.
Analyze Failed Logins
Grouped failed login attempts by source IP to identify repeated authentication failures.
Review Brute-Force Indicators
Compared source and destination pairs for multiple failed authentication attempts.
Document Alert Logic
Defined a high-risk alert condition for repeated failures within a short window.
03SSH Event Counts
The validation search returned 1,200 total SSH events across four categories.
306
Successful SSH Login
305
Failed SSH Login
303
Multiple Failed Authentication Attempts
286
Connection Without Authentication
04SPL Searches Practiced
Validate SSH Event Categories
index=ssh_logs source="ssh_logs.json" | stats count by event_type
Failed SSH Logins by Source IP
index=ssh_logs source="ssh_logs.json" event_type="Failed SSH Login" | stats count by id.orig_h | head 10
Multiple Failed Authentication Attempts
index=ssh_logs source="ssh_logs.json" event_type="Multiple Failed Authentication Attempts" | stats count by id.orig_h id.resp_h
Successful SSH Logins
index=ssh_logs source="ssh_logs.json" event_type="Successful SSH Login" | stats count by id.orig_h id.resp_h
Connections Without Authentication
index=ssh_logs event_type="Connection Without Authentication" | stats count by id.orig_h
05Alert Logic
The brute-force detection logic focused on source and destination pairs with repeated failed authentication activity.
Multiple Failed Attempts + Source IP + Destination Host → High-Risk SSH Alert
index=ssh_logs event_type="Multiple Failed Authentication Attempts" | stats count by id.orig_h id.resp_h | where count > 5
06Key Findings
- ✓ Splunk successfully ingested and parsed the JSON SSH dataset.
- ✓ The dataset contained 1,200 SSH-related events.
- ✓ Failed login analysis identified source IPs generating authentication failures.
- ✓ Multiple failed authentication attempts provided a brute-force detection path.
- ✓ Connections without authentication may indicate SSH probing or scanning.
- ✓ Successful login tracking can help identify suspicious access after repeated failures.
07Skills Demonstrated
Log Ingestion
Practiced during the SSH log analysis workflow.
Field Validation
Practiced during the SSH log analysis workflow.
SPL Searching
Practiced during the SSH log analysis workflow.
Failed Login Analysis
Practiced during the SSH log analysis workflow.
Brute-Force Detection
Practiced during the SSH log analysis workflow.
SSH Monitoring
Practiced during the SSH log analysis workflow.
Alert Logic
Practiced during the SSH log analysis workflow.
SOC Documentation
Practiced during the SSH log analysis workflow.
08Lessons Learned
This lab reinforced that effective Splunk analysis starts with a clear security question. The most useful workflow was to identify the behavior, choose the fields, build the SPL search, review the evidence, and explain the security meaning.
The project also showed how visualizations and alert logic can help turn raw authentication logs into an analyst-friendly SOC workflow.
09Training Context
This case study uses lab-provided SSH log data for educational purposes. The activity patterns are part of a controlled training environment and do not represent production systems.