Y
HN Search
Hacker News Search
new
|
comments
|
top
|
jobs
fubar9463
searching PlanetScale…
1.
▲
2.
▲
3.
▲
4.
▲
5.
▲
6.
▲
4 ms
·
1.
▲
by
fubar9463
3y ago
In any case the ROI for correlating SSH logs against network traffic is potentially error prone and may be more noisy than useful (can you differentiate in logs between SSH logins from a private IP and a public one?). An EDR tool would be m
2.
▲
by
fubar9463
3y ago
You would be sending logs to a log collector (a SIEM) in security terms, and then you could join your firewall logs against your SSH auth logs. This kind of anomaly detection is possible. Not sure how common it is. I doubt it is common.