Detecting and Neutralizing a Brute-Force Attack: A Hands-On Lab with Splunk, Hydra, and UFW Introduction In modern cybersecurity, visibility is the difference between a minor incident and a total breach. For my latest project, I built a "Lab Environment" to simulate a real-world brute-force attack on a Linux server. My goal was to experience the full lifecycle of an incident: from the initial vulnerability to the final remediation. The Architecture Victim Server: An Ubuntu instance hosted on Google Cloud Platform (GCP). Attacker Hub: A Kali Linux/Ubuntu instance used to launch the simulation. SIEM: Splunk Enterprise, ingesting logs via the Splunk Universal Forwarder. Step 1: Creating the Vulnerability (Hardening in Reverse) Most secure servers use SSH keys, but to simulate a password-guessing attack, I intentionally enabled PasswordAuthentication in the sshd_config .…