Purple Team Simulator

Pick a rule on the left, choose which of its real log events actually happened, then run detection. See what fires, what almost fires, and what a rule needs that it didn't get — as a flow diagram, not just a pass/fail list.

cloud aws

Email Gateway

Firewall

linux

Sysmon

WAF

Web Server

Web Proxy

windows

LIN-2001

high

SSH Brute Force

Detects a burst of "Failed password" authentication events from sshd against the same source IP within a short window - password spraying or brute forcing against an exposed SSH service.

How this rule works

Fires when at least 10 event(s) matching `process` is "sshd" AND `action` is "auth_fail" happen from the same `src_ip` within 5 minute(s).

Available log events for this rule

[09:00:00] sshd failed auth from 198.51.100.23 (user: root)[09:00:05] sshd failed auth from 198.51.100.23 (user: root)[09:00:10] sshd failed auth from 198.51.100.23[09:00:15] sshd failed auth from 198.51.100.23[09:00:20] sshd failed auth from 198.51.100.23[09:00:25] sshd failed auth from 198.51.100.23[09:00:30] sshd failed auth from 198.51.100.23[09:00:35] sshd failed auth from 198.51.100.23[09:00:40] sshd failed auth from 198.51.100.23[09:00:45] sshd failed auth from 198.51.100.23[09:00:50] sshd failed auth from 198.51.100.23[09:05:00] sudo: svc-deploy ran "/usr/bin/systemctl restart nginx"

SignalHunt — detection engineering notes, a real rule catalogue, and incident write-ups. Rule content is synced from DetectionAuditTool, a CLI toolkit for rule lookup, log auditing, and attack simulation.