Login attempt use case for unix device.class

[SahilArora]

Recently we build a core environment within an existing core environment. To access that environment, only bunch of jump servers are allowed to access this environment. We are looking for a use case to be build which alert us, whenever a login attempt(success/fail) happen and source is not part of those jump server family. 

any help would be appreciated.

[EricPartington]

Depending what you want to do with these alerts the you could use either a Report or ESa rule.

I would start with the Report section to look for hosts that are logging in to your restricted hosts from not your cleared list.

Put the hosts or networks in a list so you can manage the whitelist if you want to make it more modular.

you can schedule the report and have it emailed to you on a daily basis if you want to review it.

you will have to review the logs that you get from the unix systems to make sure that you have values for source IP to match on otherwise you wont be able to tell where the login attempt came from.

ip.src exists && device.class='unix'