Short Interactive Sessions on Linux or Vyatta
This rule identifies unusually short user sessions on Linux and Vyatta systems. It looks for instances where a user session is opened and then closed within 10 seconds. The rule then aggregates these short sessions over 5-minute intervals per host, counting the number of such sessions, listing affected users, and calculating the minimum, maximum, and average duration of these short sessions. This could indicate rapid login/logout activity, potential script-based access, or unusual system behavior.
Splunk (SPL)
