authentication-logs

Splunk lab detecting SSH brute-force attacks using failed login events, alerts, and dashboards.

Reproducible zero-shot transfer study from CERT insider-threat logs to LANL authentication data with drift and capacity-constrained model analysis.

Investigated Ubuntu authentication logs for failed logins, SSH activity, unknown users, and suspicious sudo commands.

Python tool for analyzing authentication logs, identifying suspicious login activity, and generating SOC-style findings.

Blue Team lab for detecting and analyzing repeated failed SSH login attempts through Linux authentication logs in an isolated environment.

This project demonstrates detection of SSH brute-force attempts on a Linux system using Splunk Enterprise. It simulates SOC analyst workflows: detection, alerting, investigation, and documentation. (In Phases)

A Python defensive-security tool that detects brute-force attempts, targeted accounts and suspicious authentication activity.

🔍 Detect SSH brute-force attacks with ease using Splunk, leveraging real-time alerts and visual dashboards from simulated Linux authentication logs.