# SSH - brute forcing

**URL:** <https://community.zeek.org/t/ssh-brute-forcing/7735>\
**Category:** Zeek\
**Tags:** development\
**Created:** [March 28, 2025, 1:49pm UTC](https://community.zeek.org/t/ssh-brute-forcing/7735 "2025-03-28T13:49:12Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![georgio](https://avatars.discourse-cdn.com/v4/letter/g/b5ac83/32.png) [@georgio](https://community.zeek.org/u/georgio)\
**Post date:** [March 28, 2025, 1:49pm UTC](https://community.zeek.org/t/ssh-brute-forcing/7735/1 "2025-03-28T13:49:12Z")

</div>

Hey there

I am wondering if someone implemented Login\_By\_Password\_Guesser from the default [ssh-bruteforcing](https://github.com/bro/bro/blob/master/scripts/policy/protocols/ssh/detect-bruteforcing.zeek) since the script is not complete.

Thank you

---

<div class="post-metadata">

**Author:** ![georgio](https://avatars.discourse-cdn.com/v4/letter/g/b5ac83/32.png) [@georgio](https://community.zeek.org/u/georgio)\
**Post date:** [April 9, 2025, 5:45am UTC](https://community.zeek.org/t/ssh-brute-forcing/7735/2 "2025-04-09T05:45:07Z")

</div>

Any thoughts ? This is the part of the script about the “Login\_By\_Password\_Guesser”

export {  
redef enum Notice::Type += {  
## Indicates that a host previously identified as a “password  
## guesser” has now had a successful login  
## attempt. This is not currently implemented.  
Login\_By\_Password\_Guesser,  
};