<commit_before># Lab 2

**Table of Contents**

- [Search for Invalid SSH Login Attempts](##search-for-invalid-ssh-login-attempts)
- [Splunk Field Extraction](##splunk-field-extraction)
- [Splunk Statistics](##splunk-statistics)
- [Create a Splunk Alert](##create-a-splunk-alert)


# Splunk Extractions, Stats and Dashboards

In this lab we will be searching for invalid SSH login attempts, extracting fields of interest and creating a dashboard.

**Resources:**

* [http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Search](http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Search)
* [http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Rex](http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Rex)
* [http://regexr.com/](http://regexr.com/)
* [http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Stats](http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Stats)
* [http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Eval](http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Eval)

---

## Search for Invalid SSH Login Attempts

Search for invalid SSH login attempts made against your instance.

1. Login to Splunk by opening the Splunk Console with your browser. Splunk Console: [https://172.16.17.32/en-US/account/login?return_to=%2Fen-US%2F](https://172.16.17.32/en-US/account/login?return_to=%2Fen-US%2F)

2. Search for your instance's logs. Click `Search & Reporting` and enter `index=main host=ip-10-0-0-0.us-west-2.compute.internal` in the search input box. Select `Last 4 hours` from the time chooser pull-down and hit search.

3. Narrow your search by adding the `sourcetype` of `linux_secure` or the `source` of `/var/log/secure`. What is the difference between these?
<commit_msg>Update LAB-2.md<commit_after># Lab 2

**Table of Contents**

- [Search for Invalid SSH Login Attempts](##search-for-invalid-ssh-login-attempts)
- [Splunk Field Extraction](##splunk-field-extraction)
- [Splunk Statistics](##splunk-statistics)
- [Create a Splunk Alert](##create-a-splunk-alert)


# Splunk Extractions, Stats and Dashboards

In this lab we will be searching for invalid SSH login attempts, extracting fields of interest and creating a dashboard.

**Resources:**

* [http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Search](http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Search)
* [http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Rex](http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Rex)
* [http://regexr.com/](http://regexr.com/)
* [http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Stats](http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Stats)
* [http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Eval](http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Eval)

---

## Search for Invalid SSH Login Attempts

Search for invalid SSH login attempts made against your instance.

1. Login to Splunk by opening the Splunk Console with your browser. Splunk Console: [https://172.16.17.32/en-US/account/login?return_to=%2Fen-US%2F](https://172.16.17.32/en-US/account/login?return_to=%2Fen-US%2F)

2. Search for your instance's logs. Click `Search & Reporting` and enter `index=main host=<Private DNS>` in the search input box. Select `Last 4 hours` from the time chooser pull-down and hit search. `Private DNS` is your intance's private DNS name.

3. Narrow your search by adding the `sourcetype` of `linux_secure` or the `source` of `/var/log/secure`. What is the difference between these?

{'fraction_non_alphanumeric': 0.1374692538945067, 'fraction_numerical': 0.016671221645258267, 'mean_word_length': 5.029654036243822, 'pattern_counts': {'":': 0, '<': 4, '<?xml version=': 0, '>': 4, 'https://': 4, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 4, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '7179408', 'n_tokens_mistral': 1242, 'n_tokens_neox': 1140, 'n_words': 278}