Week 8 Challenge: Use ELK for SSH Brute-Force Detection

Tags: security , elasticsearch , devops , linux series: Security Engineering Interview Prep published: true 💡 Before you dive in — if you find this useful, please ⭐ star my open source project SecEng-Exercises on GitHub. It's a growing collection of security engineering exercises designed to help engineers write more secure code and prepare for Security Engineering roles. Also — I'd love to know why you read security engineering blog posts . Take my 30-second poll here — results are public! A Horror Story First It's 2:47 AM. A sysadmin wakes up to his phone buzzing — a customer is reporting their data is gone. He logs into the server. The home directories are wiped. The database is dropped. A ransom note sits in /root/README.txt . He checks the logs the next morning. The attacker had been knocking since 11 PM — thousands of failed SSH login attempts against the root account, cycling through a credential list. At 1:13 AM they got lucky. A junior developer had set their password to Summe