Linux SSH Failed Logon Attempt

Jorden Smith@Jorden

•updated Feb 10, 2026•0•17

This rule detects a successful SSH login that occurs within 10 minutes after 10 or more failed SSH login attempts targeting the same user, regardless of the source IP address. This scenario is indicative of a brute-force attack where the attacker might be changing source IPs but consistently targeting a specific user account.