Good afternoon, I am trying to check the following:
Brute force ssh logs.
I have made sure that in the local.zeek file the script is loaded correctly.
/opt/zeek/share/zeek/zeek/policy/protocols/ssh/detect-bruteforcing.zeek
I have also checked that when zeek is run, it appears in the
loaded_scripts.log, so the script has loaded correctly.
I look in the ssh.log file and in conn.log and the log of the ssh connections appears, but in my notice.log file there is no log of this action.
What could be happening?
Thanks in advance.
My version of zeek is:
ZeekControl Version 2.5.0-37
I check the version with zeekctl and zeek but they are different, I don’t know if this could be the root of the problem, as I have found in this thread a similar problem with a version similar to my zeekctl: ssh-detect-bruteforcing: auth_success and auth_attempts are not recorded in ssh.log
I thought that when I ran zeek -v it was the service, and that /opt/zeek/bin/zeekctl was also the same.
But I see that it is not.
One more thing, when I try to run zeek with the pcap that you have uploaded in github, I get the following error that I think may be related:
Good morning, it seems that this thread is not moving for now, I would appreciate your help.
Thanks in advance.
