Ssh login fail events on kibana through filebeat

Elastic Stack Beats
1

Hi,
Can someone help how to get events for failed ssh login attempts on Kibana dashboard?

I'm using linux as host with filebeat installed. Should i install logstash as well in the host?

-Thaks

2

Hi @gkulkarni, welcome to the Elastic Community Forums!

Have you considered using Auditbeat to collect and visualize failed SSH login attempts? See https://www.elastic.co/guide/en/beats/auditbeat/current/auditbeat-overview.html, https://www.elastic.co/guide/en/beats/auditbeat/current/auditbeat-module-system.html, and https://www.elastic.co/guide/en/beats/auditbeat/current/auditbeat-dataset-system-login.html.

Cheers,

Shaunak

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.