Rehber Sıfırdan İleriye Log Analizi ve Saldırı Tespiti (Kodlar ve Toollar Dahil) - Tüm Detaylar!

Get-EventLog -LogName Security -Newest 100 | Where-Object {$_.EventID -eq 4625}

Dec 19 03:14:22 server sshd[12345]: Failed password for root from 192.168.1.100 port 54321 ssh2
Dec 19 03:14:23 server sshd[12346]: Failed password for root from 192.168.1.100 port 54322 ssh2
Dec 19 03:14:24 server sshd[12347]: Failed password for root from 192.168.1.100 port 54323 ssh2
Dec 19 03:14:25 server sshd[12348]: Failed password for admin from 192.168.1.100 port 54324 ssh2

grep "Failed password" /var/log/auth.log | awk '{print $11}' | sort | uniq -c | sort -rn | head -20

192.168.1.50 - - [19/Dec/2025:10:15:33] "GET /page?id=1' OR '1'='1 HTTP/1.1" 200 4523
192.168.1.50 - - [19/Dec/2025:10:15:34] "GET /page?id=1; DROP TABLE users-- HTTP/1.1" 500 1234

192.168.1.60 - - [19/Dec/2025:11:20:15] "GET /../../../../etc/passwd HTTP/1.1" 400 0
192.168.1.60 - - [19/Dec/2025:11:20:16] "GET /..%2F..%2F..%2Fetc/passwd HTTP/1.1" 400 0

192.168.1.70 - - [19/Dec/2025:14:30:22] "POST /upload.php HTTP/1.1" 200 45
192.168.1.70 - - [19/Dec/2025:14:30:25] "GET /uploads/shell.php?cmd=id HTTP/1.1" 200 123

Dec 19 15:45:12 server sudo: unauthorized_user : user NOT in sudoers ; TTY=pts/0 ; PWD=/home/user ; COMMAND=/bin/bash
Dec 19 15:46:33 server kernel: [UFW BLOCK] IN=eth0 OUT= MAC=... SRC=192.168.1.100 DST=192.168.1.1 PROTO=TCP DPT=22

sudo apt install fail2ban

[sshd]
enabled = true
port = ssh
filter = sshd
logpath = /var/log/auth.log
maxretry = 3
bantime = 3600
findtime = 600

sudo apt install goaccess
goaccess /var/log/nginx/access.log -c

input {
  file {
    path => "/var/log/auth.log"
    type => "auth"
  }
}
filter {
  grok {
    match => { "message" => "%{SYSLOGTIMESTAMP:timestamp} %{HOSTNAME:hostname} %{WORD:program}\[%{NUMBER:pid}\]: %{GREEDYDATA:message}" }
  }
}
output {
  elasticsearch {
    hosts => ["localhost:9200"]
    index => "security-logs-%{+YYYY.MM.dd}"
  }
}

grep "Failed password" /var/log/auth.log | tail -50

grep "192.168.1.100" /var/log/auth.log

#!/bin/bash
THRESHOLD=50
LOG_FILE="/var/log/auth.log"
ALERT_EMAIL="[email protected]"

# Son 1 saatteki falsolu girişleri say
FAILED_COUNT=$(grep "Failed password" $LOG_FILE | grep "$(date -d '1 hour ago' '+%b %d %H')" | wc -l)

if [ $FAILED_COUNT -gt $THRESHOLD ]; then
    echo "UYARI: Son 1 saatte $FAILED_COUNT başarısız giriş denemesi!" | mail -s "Güvenlik Uyarısı" $ALERT_EMAIL
fi

#!/bin/bash
BOT_TOKEN="your_bot_token"
CHAT_ID="your_chat_id"
MESSAGE="$1"

curl -s -X POST "https://api.telegram.org/bot$BOT_TOKEN/sendMessage" \
    -d chat_id="$CHAT_ID" \
    -d text="$MESSAGE" \
    -d parse_mode="HTML"

/var/log/auth.log {
    weekly
    rotate 52
    compress
    delaycompress
    missingok
    notifempty
    create 640 root adm
}