Splunk SSH Log Investigation

 

Security Event Analysis & False Positive Identification

 

Lab Overview

​

This lab focused on investigating SSH authentication activity using Splunk to determine whether repeated failed login attempts represented a real security threat or routine background noise. Rather than relying on alert volume alone, the goal was to validate findings through correlation and evidence-based analysis.

 

Environment

​

• Splunk Cloud

• Linux SSH authentication logs (auth.log)

• linux_secure sourcetype

The dataset was intentionally limited to emphasize investigation methodology and analytical decision-making over scale.

 

Initial Observations

​

At first glance, repeated SSH authentication failures appeared suspicious. However, several key fields such as usernames and source IP addresses were not automatically parsed, requiring manual inspection before drawing conclusions.

This reinforced an early lesson: seeing logs does not mean understanding them.

​

 Investigation Process 

​

Usernames were manually extracted from raw log events using regex. Analysis showed that most failed login attempts targeted generic or invalid usernames commonly associated with automated brute-force activity, with only a single attempt involving a legitimate account.

Source IPs were then extracted and reviewed. Failed authentication attempts originated from a small number of external IPs exhibiting high-frequency, automated behavior consistent with background internet scanning.

To validate whether a compromise occurred, successful SSH login events were analyzed and correlated against failed attempts. All successful authentications originated from internal IP addresses, with no overlap between failure and success sources.