An analyst wants to use Zeek to detect SSH brute-force attacks. Which built-in Zeek script and log provide this capability?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — b is correct because Zeek's SSH analyzer generates ssh.log recording authentication status (success/failure), client/server versions, and connection metadata; the detect-bruteforcing.zeek policy script monitors failure counts and generates notices when thresholds are exceeded. A is wrong because HTTP analyzer and http.log record web traffic, not SSH authentication events.
Full explanation below image
Full Explanation
B is correct because Zeek's SSH analyzer generates ssh.log recording authentication status (success/failure), client/server versions, and connection metadata; the detect-bruteforcing.zeek policy script monitors failure counts and generates notices when thresholds are exceeded. A is wrong because HTTP analyzer and http.log record web traffic, not SSH authentication events. C is wrong because SMB analyzer handles file sharing protocol traffic, not SSH. D is wrong because DNS analyzer and dns.log track domain resolution queries and responses, not SSH authentication.