1. System Architecture & Workflow
The diagram below represents the system architecture and operational data flow routing designed for this project.
2. Part 1: Step-by-Step Action Items & Key Execution Steps
STEP 1
Generate Brute Force SSH Attack logs
Use network auditing tools in Kali to generate repeated SSH login failure logs targeting your host.
$ hydra -l victim_user -P passwords.txt ssh://192.168.56.10 -t 4
This command runs the Hydra brute-force tool to test a list of passwords against SSH user victim_user on target IP 192.168.56.10.
| Part | What It Does |
|---|
-l | Show only listening sockets (servers waiting for connections) |
-t | Show only TCP connections |
STEP 2
Analyze Ingested Logs & Create Detection Queries
Search raw events inside your Splunk console and build detection criteria.
- Navigate to the Splunk search page:
http://localhost:8000/app/search.
- In the main search bar, type the query below:
index=security sourcetype=syslog "Failed password for"
This Splunk search query filters the security index for syslog messages containing failed password alerts.
- Build a query that groups events by source IP and flags counts exceeding limits:
index=security sourcetype=syslog "Failed password for" | stats count by src_ip | where count > 5
This query groups failed login events by source IP and only displays IPs with more than 5 failed attempts.
- Click Save As in the top right, select Alert, name it
Brute-Force Detected, and configure it to trigger when results are greater than 0.
4. Part 2: Complete Deliverable Assets & Production Templates
To simulate malicious authentication patterns locally without third-party network tools, use the Python script below named simulate_brute.py:
$ python simulate_brute.py /var/log/auth.log
This command runs the simulation script to write failed password entries directly to your auth.log.
Code Breakdown — Line by Line
Copy
Line 1: This line performs an operation as part of the script logic. It contributes to the overall functionality of the program.
# simulate_brute.py - Syslog Authentication Event Generator
Line 2: This is a comment that describes what the code does: "simulate_brute.py - Syslog Authentication Event Generator". Comments start with # and are ignored by Python.
import time
Line 3: Imports the time module/library, making its functions available for use in this script.
import sys
Line 4: Imports the sys module/library, making its functions available for use in this script.
def inject_failed_login(log_path):
Line 5: Defines a new function called inject_failed_login that accepts parameters: log_path. Functions are reusable blocks of code.
print(f"[*] Injecting failed login logs to: {{log_path}}")
Line 6: Prints output to the terminal so the user can see the result or status of the operation.
timestamp = time.strftime("%b %d %H:%M:%S")
Line 7: Creates a variable called timestamp and assigns a value to it. Variables store data for use later in the program.
log_entry = f"{{timestamp}} server-1 sshd[1234]: Failed password for invalid user admin from 192.168.56.222 port 49152 ssh2\n"
Line 8: Creates a variable called log_entry and assigns a value to it. Variables store data for use later in the program.
try:
Line 9: Starts a try block — attempts to run the code inside. If an error occurs, execution jumps to the except block instead of crashing.
with open(log_path, "a") as f:
Line 10: A context manager — automatically handles setup and cleanup (like opening and closing files safely).
for _ in range(6):
Line 11: A for loop — repeats the code inside the loop once for each item in the collection being iterated over.
f.write(log_entry)
Line 12: This line performs an operation as part of the script logic. It contributes to the overall functionality of the program.
time.sleep(0.1)
Line 13: This line performs an operation as part of the script logic. It contributes to the overall functionality of the program.
print("[SUCCESS] 6 failed login attempts logged.")
Line 14: Prints output to the terminal so the user can see the result or status of the operation.
except PermissionError:
Line 15: Catches errors from the try block and handles them gracefully instead of crashing the program.
print("[CRITICAL] Permission denied. Run script as root using sudo.")
Line 16: Prints output to the terminal so the user can see the result or status of the operation.
if __name__ == "__main__":
Line 17: A conditional check — the code inside this block only runs if the condition evaluates to True.
target_log = sys.argv[1] if len(sys.argv) > 1 else "/var/log/auth.log"
Line 18: Creates a variable called target_log and assigns a value to it. Variables store data for use later in the program.
inject_failed_login(target_log)
Line 19: This line performs an operation as part of the script logic. It contributes to the overall functionality of the program.
✓ Complete Combined Script: All lines explained above are combined into the full script shown below. Copy and paste the entire script into your file.
Copy
# simulate_brute.py - Syslog Authentication Event Generator
import time
import sys
def inject_failed_login(log_path):
print(f"[*] Injecting failed login logs to: {{log_path}}")
timestamp = time.strftime("%b %d %H:%M:%S")
log_entry = f"{{timestamp}} server-1 sshd[1234]: Failed password for invalid user admin from 192.168.56.222 port 49152 ssh2\n"
try:
with open(log_path, "a") as f:
for _ in range(6):
f.write(log_entry)
time.sleep(0.1)
print("[SUCCESS] 6 failed login attempts logged.")
except PermissionError:
print("[CRITICAL] Permission denied. Run script as root using sudo.")
if __name__ == "__main__":
target_log = sys.argv[1] if len(sys.argv) > 1 else "/var/log/auth.log"
inject_failed_login(target_log)
5. Deliverables Summary
Created Files / Templates
simulate_brute.py - Log generation script- Splunk saved alert definition file:
savedsearches.conf
Verification Artifacts
- Screenshot of the triggered Splunk alert console showing brute-force warnings.
- Audit logs output showing injected attempts from
simulate_brute.py.
3. Automation Architecture
The diagram below highlights the automated execution flow pipeline or scripting loop implemented for this module.
