Read Linux logs and spot an SSH brute force

40 min Debian 12

Objective

Know where a Linux server records login attempts, read these lines without mistakes and recognize three situations: brute force, password spraying and a successful login after failures. You will also know which Wazuh rules light up in each case.

This lesson is part of the full course

Unlock SOC Analyst with Wazuh: Detecting and Responding to Attacks to read every lesson, do the exercises, access the simulations and earn your certificate.

Buy — 290 MAD All-access pass — 1,490 MAD

Already enrolled? Log in.