An analyst wants to use Zeek to detect SSH brute-force attacks. Which built-in Zeek script and log provide this capability?
Select an answer to reveal the explanation.
Short Explanation
Here's the deal — you'll use Zeek's SSH analyzer and ssh.log, because it records SSH authentication success or failure, versions, and connection metadata. The detect-bruteforcing.zeek policy script watches those failures and raises notices when the threshold is crossed.
Full Explanation
The correct capability comes from Zeek's SSH analyzer and ssh.log combined with the detect-bruteforcing.zeek policy script that counts failed authentication attempts. The SSH analyzer generates ssh.log recording authentication status (success/failure), client/server versions, and connection metadata; the detect-bruteforcing.zeek policy script monitors failure counts and generates notices when thresholds are exceeded. The HTTP analyzer and http.log are wrong because they record web traffic, not SSH authentication events. The SMB analyzer and smb_files.log are wrong because SMB handles file sharing protocol traffic, not SSH. The DNS analyzer and dns.log tracking failed NXDOMAIN responses are wrong because they track domain resolution queries and responses, not SSH authentication.