Canonical: https://botbento.com/usecases/ssh-brute-force-attack-log-analysis-and/
Format: Markdown representation of the public HTML page.

[Home](/) / [Use cases](/usecases/) / [Operations](/usecases/?category=ops)

Operations · Intermediate

# SSH brute-force attack log analysis and reporting

Inspect authentication logs to summarize attack patterns, repeated credentials, and hostile IP ranges.

[Use with BotBento ](https://app.botbento.com/?ref=usecases&utm_source=botbento.com&utm_medium=usecases&utm_campaign=ssh-brute-force-attack-log-analysis-and)Copy promptShare[Markdown](/text/usecases/ssh-brute-force-attack-log-analysis-and/index.md)[العربية](/ar/usecases/ssh-brute-force-attack-log-analysis-and/)

Opens BotBento. Paste the prompt into a bot; nothing is preconfigured.

- On a scheduleNightly log run
- ThenParse auth attempts and cluster IPs
- ResultDraft security report and banlist

Monitors honeypot or SSH server access logs to extract unauthorized login attempts, catalog common credentials, identify attacking IP addresses by geographic origin, and prepare periodic summaries with recommended firewall ban rules.

## Prompt to start with

BotBentoRecommended

```
Read incoming SSH access logs or honeypot event records via the terminal. Parse attempted usernames, passwords, source IP addresses, and timestamps into the database. Aggregate top attack sources and identify persistent hostile subnets. Compile a summary report detailing daily attack volume, recurring credential pairs, and recommended IP ban rules. Post the summary to chat and wait for approval before applying any firewall or blocklist modifications.
```

Copy

## Tools it uses

TerminalDatabaseChat

## Works with

BotBento

## Tags

- security
- ssh
- sysadmin
- firewall
- logs

## Source

[Show HN: Knock-Knock.net – Visualizing the bots knocking on my server's door](https://news.ycombinator.com/item?id=47025338)
Hacker News · checked 2026-10-15

Summarized in our own words. Any results described there are the authors’ own, not measured by BotBento.

By BotBento Editorial · Added 2026-10-15 · Updated 2026-10-15 · [Suggest a correction](/contact/)

## Related use cases

-

Operationsintermediate

## [Monitoring and analyzing SSH honeypot logs](/usecases/monitoring-and-analyzing-ssh-honeypot-logs/)

Track unauthorized login attempts, inspect shell commands, and summarize threat patterns

TerminalDatabaseChat
-

Operationsadvanced

## [Auditing autonomous agent execution logs](/usecases/auditing-autonomous-agent-execution-logs/)

Inspect system-level process, network, and file activity recorded during automated sessions

TerminalDatabaseChat
-

Operationsadvanced

## [Investigating production issues via safe read-only terminal commands](/usecases/investigating-production-issues-via-safe-read-only/)

Inspect server logs and execute read-only database queries to troubleshoot infrastructure incidents

TerminalDatabaseChat