🔐 SSH Log Analysis using Splunk

📌 Project Overview

This project demonstrates an end-to-end SSH log analysis and security monitoring workflow using Splunk Enterprise.

The project focuses on analysing SSH authentication logs to identify successful logins, failed login attempts, repeated authentication failures that may indicate brute-force activity, and connections without authentication.

The workflow represents a simplified SOC (Security Operations Center) analyst process:

Collect → Index → Search → Analyse → Detect → Alert → Visualise

Splunk is used as the SIEM platform to ingest, search, analyse, and visualise the SSH authentication data.

---

🎯 Objectives

The main objectives of this project were:

• Ingest SSH authentication logs into Splunk.
• Create a dedicated index for SSH log data.
• Use Splunk Search Processing Language (SPL) to analyse authentication events.
• Identify successful and failed SSH login attempts.
• Detect multiple failed authentication attempts as a potential brute-force indicator.
• Analyse source and destination IP addresses.
• Configure a scheduled alert for brute-force-style activity.
• Create a dashboard for monitoring successful SSH login activity.

---

🛠️ Tools & Technologies

Technology	Purpose
Splunk Enterprise	SIEM platform for log ingestion and analysis
SPL	Searching, filtering and aggregating security events
SSH Logs	Authentication event data
JSON	Log data format
Dashboard Studio	Security event visualisation
Splunk Alerts	Detection and notification of suspicious activity

---

📂 Dataset

The project uses a JSON-formatted SSH authentication log file:

ssh_logs.json

The dataset contains fields such as:

• id.orig_h — Source IP address
• id.resp_h — Destination IP address
• auth_success — Authentication success information
• auth_attempts — Authentication attempts
• event_type — Type of SSH event

The events are categorised into:

1. Successful SSH Login
2. Failed SSH Login
3. Multiple Failed Authentication Attempts
4. Connection Without Authentication

---

🔄 Project Workflow

                SSH Log Data
                     │
                     ▼
              Data Ingestion
                     │
                     ▼
              Splunk Index
                     │
                     ▼
              SPL Searching
                     │
          ┌──────────┼──────────┐
          ▼          ▼          ▼
       Login      Failed      Suspicious
       Analysis   Logins       Activity
                                  │
                                  ▼
                         Brute-Force Detection
                                  │
                                  ▼
                              Alert
                                  │
                                  ▼
                             Dashboard

---

1️⃣ Data Ingestion

The ssh_logs.json file was uploaded into Splunk using:

Search & Reporting → Settings → Add Data → Upload

Splunk identified the JSON structure and applied the _json source type.

A dedicated index named:

ssh_logs

was created to keep the SSH security data separate from other data sources.

2️⃣ Event Analysis using SPL

After ingestion, SPL was used to analyse and classify SSH authentication events.

Event Type Summary

source="ssh_logs.json" host="LAPTOP-EHJ3QFJI" index="ssh_logs"
sourcetype="_json"
| stats count by event_type

This search provides an overview of the number of events in each SSH event category.

---

3️⃣ Failed SSH Login Analysis

To investigate failed SSH authentication attempts:

source="ssh_logs.json" host="LAPTOP-EHJ3QFJI" index="ssh_logs"
sourcetype="_json" event_type="Failed SSH Login"
| stats count by id.orig_h

This aggregates failed login attempts by source IP address.

It can help an analyst identify systems generating unusually high numbers of failed authentication attempts.

---

4️⃣ Visualising Failed Login Activity

The aggregated failed-login data was visualised using Splunk's Visualization functionality.

A column chart makes it easier to identify source IP addresses associated with higher numbers of failed login attempts.

---

5️⃣ Brute-Force Activity Detection

One of the main objectives of the project was to identify repeated failed authentication attempts.

The following SPL query was used:

source="ssh_logs.json" host="LAPTOP-EHJ3QFJI"
index="ssh_logs" sourcetype="_json"
event_type="Multiple Failed Authentication Attempts"
| stats count by id.orig_h, id.resp_h

This query aggregates suspicious authentication activity by:

• Source IP
• Destination IP

This helps identify which source systems are repeatedly attempting authentication against destination systems.

---

6️⃣ Brute-Force Detection Alert

The suspicious-activity search was converted into a Splunk alert named:

brute_force

Alert Configuration

• Alert Type: Scheduled
• Schedule: Weekly
• Trigger Condition: Number of results > 0
• Severity: Medium
• Action: Add to Triggered Alerts

The alert is designed to trigger when the search identifies at least one matching multiple-failed-authentication event.

Note: This project demonstrates detection logic for brute-force-style activity. It does not claim that a real external attack was performed.

---

7️⃣ Successful SSH Login Dashboard

A separate analysis was created for successful SSH logins.

source="ssh_logs.json" host="LAPTOP-EHJ3QFJI"
index="ssh_logs" sourcetype="_json"
event_type="Successful SSH Login"
| stats count by id.orig_h, id.resp_h

The results were saved as a dashboard panel using Splunk Dashboard Studio.

The dashboard was named:

Successful_login

and configured using an Absolute layout.

---

8️⃣ Connection Without Authentication

The project also analysed SSH connections where no authentication step was recorded.

source="ssh_logs.json" host="LAPTOP-EHJ3QFJI"
index="ssh_logs" sourcetype="_json"
event_type="Connection Without Authentication"
| stats count by id.orig_h

These events were analysed separately because they may represent activity such as scanning or malformed connection attempts.

---

📊 Key Features

🔍 Log Analysis

Analysed SSH authentication events using SPL.

🚨 Brute-Force Detection

Identified multiple failed authentication attempts as a suspicious activity indicator.

⚡ Alerting

Configured a scheduled Splunk alert for detected suspicious events.

📈 Visualisation

Created visualisations for failed login activity and a dashboard for successful SSH logins.

🌐 IP-Based Analysis

Analysed source and destination IP addresses involved in SSH authentication events.

---

🧠 What I Learned

Through this project, I gained hands-on experience with:

• SIEM fundamentals
• Splunk Enterprise
• SPL queries
• Security log ingestion
• Authentication log analysis
• Source/destination IP analysis
• Brute-force detection concepts
• Splunk alert configuration
• Dashboard creation
• SOC-style security monitoring

Most importantly, I learned how raw security logs can be transformed into actionable security insights through a SIEM platform.

---

🎓 Skills Demonstrated

SIEM
Splunk
SPL
Log Analysis
SSH Security
Authentication Monitoring
Brute-Force Detection
Security Monitoring
Alert Configuration
Dashboard Development
SOC Fundamentals
Network Security

---

📸 Project Screenshots

Add your project screenshots here.

Suggested structure:

screenshots/
├── splunk-home.png
├── data-ingestion.png
├── event-analysis.png
├── failed-login-analysis.png
├── brute-force-search.png
├── brute-force-alert.png
├── successful-login-dashboard.png
└── connection-without-authentication.png

Then add them to the README:

## 📸 Screenshots

### Data Ingestion
![Data Ingestion](screenshots/data-ingestion.png)

### Failed Login Analysis
![Failed Login Analysis](screenshots/failed-login-analysis.png)

### Brute-Force Detection
![Brute Force Detection](screenshots/brute-force-search.png)

### Alert Configuration
![Brute Force Alert](screenshots/brute-force-alert.png)

### Successful Login Dashboard
![Dashboard](screenshots/successful-login-dashboard.png)

---

🚀 Future Improvements

Possible future enhancements include:

• Real-time SSH log monitoring
• More advanced brute-force detection thresholds
• Time-based authentication analysis
• Additional Splunk dashboards
• Detection of suspicious source IP behaviour
• Integration with additional log sources
• More advanced SOC detection rules
• Automated incident-response workflows

---

📌 Project Outcome

This project demonstrates a complete security monitoring workflow in Splunk:

Raw SSH Logs

⬇️

Data Ingestion

⬇️

Indexing

⬇️

SPL Analysis

⬇️

Suspicious Activity Detection

⬇️

Brute-Force Alert

⬇️

Security Dashboard

The workflow reflects core activities performed by entry-level SOC Analysts and Cybersecurity Analysts, including log ingestion, event investigation, detection, alerting, and visualisation.

---

👩‍💻 Author

Pranali Sonar

Cybersecurity | SOC | SIEM | Networking | Linux

---

⭐ If you found this project useful, feel free to explore the repository and connect with me on LinkedIn.