Syslog

← All KQL categories

Data Source

Syslog

3 queries tagged with this data source.

• Analytics Rules Detect Successful Login Following Distributed Ssh Brute Force

  Successful SSH login against a host that just weathered a distributed brute-force campaign. Pair with the Act-I hunt to know if the lightning hit anything.

• Cost & Ingest / Cost By Eventid Cost Of Syslog Events By Severity

  Cost of Syslog events grouped by severity level.

• Hunting Hunt Distributed Ssh Brute Force Per Target

  SSH brute-force hunt that pivots on the target host, not the source IP — catches distributed attacks that stay under per-source thresholds by using thousands of IPs.