> For the complete documentation index, see [llms.txt](https://docs.elastiflow.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.elastiflow.com/data_platforms/elastic/ml/netsec/netsec_bruteforce/cli.md).

# Brute Force CLI Access

Identifying brute force Command Line Interface (CLI) access attempts, particularly through protocols like SSH (Secure Shell) and telnet, is crucial in safeguarding network security. Brute force attacks involve repeated attempts to guess login credentials and gain unauthorized access to systems. These attacks pose a significant threat as they can lead to compromised systems, data breaches, and unauthorized control over critical network resources. In the context of SSH and telnet, which are commonly used for secure administrative access to devices and servers, detecting brute force attempts is paramount. Early detection allows network administrators to implement countermeasures, such as blocking malicious IP addresses, enforcing strong password policies, or setting up additional authentication mechanisms, thereby mitigating potential security risks.

ElastiFlow provides a collection of anomaly detection jobs designed to identify brute force CLI access attempts through SSH and telnet, including several targeted monitoring and analysis strategies.

## Attributes

| Attribute                       | Information                                                                    |
| ------------------------------- | ------------------------------------------------------------------------------ |
| **Analysis Type**               | population                                                                     |
| **MITRE ATT\&CK Technique**     | [Brute Force (T1110)](https://attack.mitre.org/techniques/T1110)               |
| **MITRE ATT\&CK Sub-Technique** | [Password Guessing (T1110.001)](https://attack.mitre.org/techniques/T1110/001) |
| **MITRE ATT\&CK Tactic**        | [Credential Access (TA0006)](https://attack.mitre.org/tactics/TA0006)          |

## Downloads

| Schema    | Vector          | Perspective  | Window   | Link                                                                                                                                                                                                             |
| --------- | --------------- | ------------ | -------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **CODEX** | **direct**      | **edge**     | **fast** | [elastiflow\_codex\_netsec\_bruteforce\_direct\_cli\_edge\_fast](https://github.com/elastiflow/elastiflow_for_elasticsearch/raw/master/ml/codex/netsec_bruteforce/netsec_bruteforce_direct_cli_edge_fast.json)   |
| **CODEX** | **direct**      | **edge**     | **slow** | [elastiflow\_codex\_netsec\_bruteforce\_direct\_cli\_edge\_slow](https://github.com/elastiflow/elastiflow_for_elasticsearch/raw/master/ml/codex/netsec_bruteforce/netsec_bruteforce_direct_cli_edge_fast.json)   |
| **CODEX** | **direct**      | **inbound**  | **fast** | [elastiflow\_codex\_netsec\_bruteforce\_direct\_cli\_in\_fast](https://github.com/elastiflow/elastiflow_for_elasticsearch/raw/master/ml/codex/netsec_bruteforce/netsec_bruteforce_direct_cli_in_fast.json)       |
| **CODEX** | **direct**      | **inbound**  | **slow** | [elastiflow\_codex\_netsec\_bruteforce\_direct\_cli\_in\_slow](https://github.com/elastiflow/elastiflow_for_elasticsearch/raw/master/ml/codex/netsec_bruteforce/netsec_bruteforce_direct_cli_in_slow.json)       |
| **CODEX** | **direct**      | **outbound** | **fast** | [elastiflow\_codex\_netsec\_bruteforce\_direct\_cli\_out\_fast](https://github.com/elastiflow/elastiflow_for_elasticsearch/raw/master/ml/codex/netsec_bruteforce/netsec_bruteforce_direct_cli_out_fast.json)     |
| **CODEX** | **direct**      | **outbound** | **slow** | [elastiflow\_codex\_netsec\_bruteforce\_direct\_cli\_out\_slow](https://github.com/elastiflow/elastiflow_for_elasticsearch/raw/master/ml/codex/netsec_bruteforce/netsec_bruteforce_direct_cli_out_slow.json)     |
| **CODEX** | **direct**      | **private**  | **fast** | [elastiflow\_codex\_netsec\_bruteforce\_direct\_cli\_priv\_fast](https://github.com/elastiflow/elastiflow_for_elasticsearch/raw/master/ml/codex/netsec_bruteforce/netsec_bruteforce_direct_cli_priv_fast.json)   |
| **CODEX** | **direct**      | **private**  | **slow** | [elastiflow\_codex\_netsec\_bruteforce\_direct\_cli\_priv\_slow](https://github.com/elastiflow/elastiflow_for_elasticsearch/raw/master/ml/codex/netsec_bruteforce/netsec_bruteforce_direct_cli_priv_slow.json)   |
| **CODEX** | **distributed** | **edge**     | **fast** | [elastiflow\_codex\_netsec\_bruteforce\_distrib\_cli\_edge\_fast](https://github.com/elastiflow/elastiflow_for_elasticsearch/raw/master/ml/codex/netsec_bruteforce/netsec_bruteforce_distrib_cli_edge_fast.json) |
| **CODEX** | **distributed** | **edge**     | **slow** | [elastiflow\_codex\_netsec\_bruteforce\_distrib\_cli\_edge\_slow](https://github.com/elastiflow/elastiflow_for_elasticsearch/raw/master/ml/codex/netsec_bruteforce/netsec_bruteforce_distrib_cli_edge_slow.json) |
| **CODEX** | **distributed** | **inbound**  | **fast** | [elastiflow\_codex\_netsec\_bruteforce\_distrib\_cli\_in\_fast](https://github.com/elastiflow/elastiflow_for_elasticsearch/raw/master/ml/codex/netsec_bruteforce/netsec_bruteforce_distrib_cli_in_fast.json)     |
| **CODEX** | **distributed** | **inbound**  | **slow** | [elastiflow\_codex\_netsec\_bruteforce\_distrib\_cli\_in\_slow](https://github.com/elastiflow/elastiflow_for_elasticsearch/raw/master/ml/codex/netsec_bruteforce/netsec_bruteforce_distrib_cli_in_slow.json)     |
| **CODEX** | **distributed** | **outbound** | **fast** | [elastiflow\_codex\_netsec\_bruteforce\_distrib\_cli\_out\_fast](https://github.com/elastiflow/elastiflow_for_elasticsearch/raw/master/ml/codex/netsec_bruteforce/netsec_bruteforce_distrib_cli_out_fast.json)   |
| **CODEX** | **distributed** | **outbound** | **slow** | [elastiflow\_codex\_netsec\_bruteforce\_distrib\_cli\_out\_slow](https://github.com/elastiflow/elastiflow_for_elasticsearch/raw/master/ml/codex/netsec_bruteforce/netsec_bruteforce_distrib_cli_out_slow.json)   |
| **CODEX** | **distributed** | **private**  | **fast** | [elastiflow\_codex\_netsec\_bruteforce\_distrib\_cli\_priv\_fast](https://github.com/elastiflow/elastiflow_for_elasticsearch/raw/master/ml/codex/netsec_bruteforce/netsec_bruteforce_distrib_cli_priv_fast.json) |
| **CODEX** | **distributed** | **private**  | **slow** | [elastiflow\_codex\_netsec\_bruteforce\_distrib\_cli\_priv\_slow](https://github.com/elastiflow/elastiflow_for_elasticsearch/raw/master/ml/codex/netsec_bruteforce/netsec_bruteforce_distrib_cli_priv_slow.json) |
| **ECS**   | **direct**      | **edge**     | **fast** | [elastiflow\_ecs\_netsec\_bruteforce\_direct\_cli\_edge\_fast](https://github.com/elastiflow/elastiflow_for_elasticsearch/raw/master/ml/ecs/netsec_bruteforce/netsec_bruteforce_direct_cli_edge_fast.json)       |
| **ECS**   | **direct**      | **edge**     | **slow** | [elastiflow\_ecs\_netsec\_bruteforce\_direct\_cli\_edge\_slow](https://github.com/elastiflow/elastiflow_for_elasticsearch/raw/master/ml/ecs/netsec_bruteforce/netsec_bruteforce_direct_cli_edge_slow.json)       |
| **ECS**   | **direct**      | **inbound**  | **fast** | [elastiflow\_ecs\_netsec\_bruteforce\_direct\_cli\_in\_fast](https://github.com/elastiflow/elastiflow_for_elasticsearch/raw/master/ml/ecs/netsec_bruteforce/netsec_bruteforce_direct_cli_in_fast.json)           |
| **ECS**   | **direct**      | **inbound**  | **slow** | [elastiflow\_ecs\_netsec\_bruteforce\_direct\_cli\_in\_slow](https://github.com/elastiflow/elastiflow_for_elasticsearch/raw/master/ml/ecs/netsec_bruteforce/netsec_bruteforce_direct_cli_in_slow.json)           |
| **ECS**   | **direct**      | **outbound** | **fast** | [elastiflow\_ecs\_netsec\_bruteforce\_direct\_cli\_out\_fast](https://github.com/elastiflow/elastiflow_for_elasticsearch/raw/master/ml/ecs/netsec_bruteforce/netsec_bruteforce_direct_cli_out_fast.json)         |
| **ECS**   | **direct**      | **outbound** | **slow** | [elastiflow\_ecs\_netsec\_bruteforce\_direct\_cli\_out\_slow](https://github.com/elastiflow/elastiflow_for_elasticsearch/raw/master/ml/ecs/netsec_bruteforce/netsec_bruteforce_direct_cli_out_slow.json)         |
| **ECS**   | **direct**      | **private**  | **fast** | [elastiflow\_ecs\_netsec\_bruteforce\_direct\_cli\_priv\_fast](https://github.com/elastiflow/elastiflow_for_elasticsearch/raw/master/ml/ecs/netsec_bruteforce/netsec_bruteforce_direct_cli_priv_fast.json)       |
| **ECS**   | **direct**      | **private**  | **slow** | [elastiflow\_ecs\_netsec\_bruteforce\_direct\_cli\_priv\_slow](https://github.com/elastiflow/elastiflow_for_elasticsearch/raw/master/ml/ecs/netsec_bruteforce/netsec_bruteforce_direct_cli_priv_slow.json)       |
| **ECS**   | **distributed** | **edge**     | **fast** | [elastiflow\_ecs\_netsec\_bruteforce\_distrib\_cli\_edge\_fast](https://github.com/elastiflow/elastiflow_for_elasticsearch/raw/master/ml/ecs/netsec_bruteforce/netsec_bruteforce_distrib_cli_edge_fast.json)     |
| **ECS**   | **distributed** | **edge**     | **slow** | [elastiflow\_ecs\_netsec\_bruteforce\_distrib\_cli\_edge\_slow](https://github.com/elastiflow/elastiflow_for_elasticsearch/raw/master/ml/ecs/netsec_bruteforce/netsec_bruteforce_distrib_cli_edge_slow.json)     |
| **ECS**   | **distributed** | **inbound**  | **fast** | [elastiflow\_ecs\_netsec\_bruteforce\_distrib\_cli\_in\_fast](https://github.com/elastiflow/elastiflow_for_elasticsearch/raw/master/ml/ecs/netsec_bruteforce/netsec_bruteforce_distrib_cli_in_fast.json)         |
| **ECS**   | **distributed** | **inbound**  | **slow** | [elastiflow\_ecs\_netsec\_bruteforce\_distrib\_cli\_in\_slow](https://github.com/elastiflow/elastiflow_for_elasticsearch/raw/master/ml/ecs/netsec_bruteforce/netsec_bruteforce_distrib_cli_in_slow.json)         |
| **ECS**   | **distributed** | **outbound** | **fast** | [elastiflow\_ecs\_netsec\_bruteforce\_distrib\_cli\_out\_fast](https://github.com/elastiflow/elastiflow_for_elasticsearch/raw/master/ml/ecs/netsec_bruteforce/netsec_bruteforce_distrib_cli_out_fast.json)       |
| **ECS**   | **distributed** | **outbound** | **slow** | [elastiflow\_ecs\_netsec\_bruteforce\_distrib\_cli\_out\_slow](https://github.com/elastiflow/elastiflow_for_elasticsearch/raw/master/ml/ecs/netsec_bruteforce/netsec_bruteforce_distrib_cli_out_slow.json)       |
| **ECS**   | **distributed** | **private**  | **fast** | [elastiflow\_ecs\_netsec\_bruteforce\_distrib\_cli\_priv\_fast](https://github.com/elastiflow/elastiflow_for_elasticsearch/raw/master/ml/ecs/netsec_bruteforce/netsec_bruteforce_distrib_cli_priv_fast.json)     |
| **ECS**   | **distributed** | **private**  | **slow** | [elastiflow\_ecs\_netsec\_bruteforce\_distrib\_cli\_priv\_slow](https://github.com/elastiflow/elastiflow_for_elasticsearch/raw/master/ml/ecs/netsec_bruteforce/netsec_bruteforce_distrib_cli_priv_slow.json)     |

By deploying this suite of anomaly detection jobs, organizations can effectively monitor for and rapidly identify brute force access attempts on SSH and telnet interfaces. Prompt detection is essential for taking immediate action to secure the network against unauthorized access, ensuring the protection of sensitive data and the integrity of network operations. This proactive approach to network security is a critical aspect of modern network management in an increasingly connected and security-conscious digital environment.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.elastiflow.com/data_platforms/elastic/ml/netsec/netsec_bruteforce/cli.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.