logstash filters for ssh attempts

Description

Logstash filters for ssh brute for, sudo auth failures, or failed login attempts

Filters

grok {
  type => "syslog"
  patterns_dir => ["/opt/logstash/patterns"]
  pattern => [
     "%{SYSLOGLINE}"
  ]
}

grep {
type => "syslog"
drop => false
match => [ "@message", "([fF]ailed|[fF]ailure).*password|authentication.*failure|incorrect.password" ]
add_tag => [ "auth_failure" ]
}

grep {
type => "syslog"
drop => false
match => [ "@message", "Invalid user" ]
add_tag => [ "ssh_brute_force" ]
}

Leave a Reply

  

  

  

You can use these HTML tags

<a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <strike> <strong>