This repository documents a small SOC-oriented lab focused on the audit, detection, monitoring, and remediation of password-based SSH attack activity against a Linux target.
The project combines four complementary components:
- OpenVAS for attack surface assessment
- Wazuh for security event collection and detection
- Zabbix for metric collection
- Grafana for dashboard visualization
A Windows endpoint monitored with Sysmon and Wazuh is also included to demonstrate multi-platform visibility in the same environment.
The main goal of the project is to show how a Linux SSH attack path can be:
- assessed during a vulnerability scanning phase
- detected through security events
- monitored through a dedicated metric
- reduced through SSH hardening
- validated after remediation
linux-target: main protected Linux targetmonitoring-server: Zabbix and Grafana hostwazuh-server: security monitoring platformscanner-openvas: OpenVAS scanning hostwindows-endpoint: Windows endpoint with Sysmon telemetry
Configuration artifacts used in the lab.
configs/ssh/sshd_config.before.confconfigs/ssh/sshd_config.after.confconfigs/wazuh/windows-sysmon-localfile.xmlconfigs/zabbix/failed-ssh-logins.conf
Shell scripts used to generate the SSH attack and the post-remediation retest.
scripts/failed_ssh_wave.shscripts/post_remediation_retest.sh
Raw exported artifacts collected from the tools used in the project.
- OpenVAS scan exports
- Wazuh alert exports
- Zabbix metric export
- Grafana dashboard export
Short supporting logs and summaries extracted from the lab.
- OpenVAS scans the Linux target
- A controlled wave of failed SSH logins is generated
- Wazuh detects the SSH authentication failures
- Zabbix counts failed SSH logins from
auth.log - Grafana visualizes the metric
- SSH hardening is applied
- Post-remediation validation confirms a change in behavior
- SSH exposure identified through OpenVAS
- Linux authentication failures detected in Wazuh
- Failed SSH login activity measured in Zabbix
- Visualization of the metric in Grafana
- Reduced password-based SSH attack surface after remediation
The Linux SSH scenario is the main use case of the project.
The Windows endpoint is included as an additional telemetry source to extend the monitoring scope beyond a single operating system.