Writing a detection

A detection is just a rule you can run

You saw an SSH brute force: dozens of failures from one IP. A detection turns that observation into a rule anyone can run. The logic: count failed logins per source IP, and flag any IP over a threshold. On the real log that is one command:

grep 'Failed password' /srv/soc-data/linux/auth.log | grep -oE '([0-9]{1,3}\.){3}[0-9]{1,3}' | sort | uniq -c | sort -rn

In the terminal

student@vulntech:~$ grep 'Failed password' /srv/soc-data/linux/auth.log | grep -oE '([0-9]{1,3}\.){3}[0-9]{1,3}' | sort | uniq -c | sort -rn
     48 203.0.113.66

All 48 failures come from the one attacker IP. A rule like "alert on ≥10 failures from a single source" would have fired on exactly this — and that threshold is the knob you tune next.

Tip: Good detections are specific enough to catch the attack and loose enough to survive small changes. Too tight and the attacker's next variation slips by; too loose and you drown.