OpenSSH
Overview
- Vendor:
- Supported environment:
- Version compatibility:
- Detection based on: Telemetry
- Supported application or feature: OpenSSH is the premier connectivity tool for remote login with the SSH protocol. It encrypts all traffic to eliminate eavesdropping, connection hijacking, and other attacks. In addition, OpenSSH provides a large suite of secure tunneling capabilities, several authentication methods, and sophisticated configuration options.
Configure
As of now, the main solution to collect OpenSSH logs leverages the Rsyslog recipe. Please share your experiences with other recipes by editing this documentation.
Rsyslog
Please refer to the documentation of OpenSSH to forward events to your rsyslog server. The reader can consult the Rsyslog Transport documentation to forward these logs to Sekoia.io.
Raw Events Samples
In this section, you will find examples of raw logs as generated natively by the source. These examples are provided to help integrators understand the data format before ingestion into Sekoia.io. It is crucial for setting up the correct parsing stages and ensuring that all relevant information is captured.
Accepted google_authenticator for root
Accepted gssapi-with-mic for ubuntu from 1.2.3.4 port 51826 ssh2
Accepted password for ubuntu from 1.2.3.4 port 51826 ssh2
Accepted publickey for ubuntu from 1.2.3.4 port 51826 ssh2: RSA SHA256:AbpHGcgLb+kRsJGnwFEktk7uzpZOCcBY74+YBdrKVGs=
Accepted publickey for jdoe@example.local from 1.2.3.4 port 59294 ssh2: ED25519 SHA256:AbpHGcgLb+kRsJGnwFEktk7uzpZOCcBY74+YBdrKVGs=
Accepted key RSA SHA256:3cOMdwjvSk5BnU2zs6397YpKn/SNSVSAMtsQchY8dOo found at /home/star/.ssh/authorized_keys:2
Accepted key RSA SHA256:3cOMdwjvSk5BnU2zs6397YpKn/SNSVSAMtsQchY8dOo found at /usr/local/nagios/.ssh/authorized_keys:1
main: sshd: ssh-rsa algorithm is disabled
error: maximum authentication attempts exceeded for invalid user support from ssh.example.org port 51219 ssh2 [preauth]
error: maximum authentication attempts exceeded for root from 1.2.3.4 port 63758 ssh2 [preauth]
Disconnecting invalid user support 1.2.3.4 port 51219: Too many authentication failures [preauth]
Bad protocol version identification '\003' from 1.2.3.4 port 407
Connection closed by 1.2.3.4 port 51488 [preauth]
Connection closed by 127.0.0.1
Connection closed by authenticating user backup 1.2.3.4 port 49424 [preauth]
Connection closed by illegal user default 1.2.3.4 port 49424 [preauth]
Connection closed by invalid user pi 1.2.3.4 port 42608 [preauth]
Connection closed by invalid user 1.2.3.4 port 36797 [preauth]
ssh_dispatch_run_fatal: Connection from 1.2.3.4 port 49065: Connection corrupted [preauth]
Connection from 127.0.0.1 port 58752 on 127.0.0.1 port 22
Connection reset by 1.2.3.4 port 45611 [preauth]
Mar 11 11:26:54 foobar sshd[3296336]: Received disconnect from 1.1.1.1 port 33980:11: Bye Bye
Disconnected from 1.2.3.4 port 39906 [preauth]
Disconnected from authenticating user backup 1.2.3.4 port 49424 [preauth]
Disconnected from illegal user default 1.2.3.4 port 48792 [preauth]
Disconnected from user ubuntu 1.2.3.4 port 44708
Disconnected from user jdoe@lexample.local 1.2.3.4 port 33480
Failed none for invalid user guest from 1.2.3.4 port 15806 ssh2
fatal: userauth_finish: send failure packet: Broken pipe [preauth]
Failed password for backup from 1.2.3.4 port 60150 ssh2
Failed password for invalid user ***** from 1.2.3.4 port 51894 ssh2
fatal: Timeout before authentication for 1.2.3.4 port 52076
Invalid user jdoe from ssh.example.org port 48792
input_userauth_request: invalid user jdoe [preauth]
Invalid user ***** from 1.2.3.4 port 51894
error: kex_exchange_identification: Connection closed by remote host
Did not receive identification string from 1.2.3.4 port 50622
pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=1.2.3.4
pam_unix(sshd:auth): check pass; user unknown
pam_faillock(sshd:auth): Consecutive login failures for user JDOE account temporarily locked
pam_faillock(sshd:auth): User unknown
PAM adding faulty module: pam_cracklib.so
PAM 2 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=1.2.3.4 user=root
PAM service(sshd) ignoring max retries; 6 > 3
pam_unix(sshd:session): session closed for user ubuntu
pam_systemd(sshd:session): Failed to create session: Maximum number of sessions (8192) reached, refusing further sessions.
pam_unix(sshd:session): session opened for user ubuntu by (uid=0)
pam_unix(sshd:session): session opened for user jdoe(uid=10357) by (uid=0)
PAM unable to dlopen(pam_cracklib.so): /lib/security/pam_cracklib.so: cannot open shared object file: No such file or directory
pam_winbind(sshd:account): user 'jdoe@example.local' granted access
Postponed publickey for star from 127.0.0.1 port 44690 ssh2 [preauth]
Received disconnect from 1.2.3.4 port 39906:11: Bye Bye [preauth]
Received disconnect from 1.2.3.4 port 16899:11: [preauth]
Received disconnect from 1.2.3.4 port 36958:11: Normal Shutdown, Thank you for playing [preauth]
Received disconnect from 1.2.3.4 port 44708:11: disconnected by user
Received disconnect from 127.0.0.1: 11: disconnected by user
Starting session: command for nagios from 127.0.0.1 port 58752 id 0
Starting session: command for star from 127.0.0.1 port 44690 id 0
Unable to negotiate with 1.2.3.4 port 27824: no matching cipher found. Their offer: aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,arcfour128,arcfour,3des-cbc,none [preauth]
Unable to negotiate with 1.2.3.4 port 5228: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1 [preauth]
User root from 1.2.3.4 not allowed because not listed in AllowUsers
User child is on pid 60225
Detection section
The following section provides information for those who wish to learn more about the detection capabilities enabled by collecting this intake. It includes details about the built-in rule catalog, event categories, and ECS fields extracted from raw events. This is essential for users aiming to create custom detection rules, perform hunting activities, or pivot in the events page.
Related Built-in Rules
The following Sekoia.io built-in rules match the intake OpenSSH. This documentation is updated automatically and is based solely on the fields used by the intake which are checked against our rules. This means that some rules will be listed but might not be relevant with the intake.
SEKOIA.IO x OpenSSH on ATT&CK Navigator
Cryptomining
Detection of domain names potentially related to cryptomining activities.
- Effort: master
DNS Query For Iplookup
Detects dns query of observables tagged as iplookup.
- Effort: master
Dumpert LSASS Process Dumper
Detects the use of Dumpert process dumper, which dumps the lsass.exe process memory
- Effort: elementary
Dynamic DNS Contacted
Detect communication with dynamic dns domain. This kind of domain is often used by attackers. This rule can trigger false positive in non-controlled environment because dynamic dns is not always malicious.
- Effort: master
Exfiltration Domain
Detects traffic toward a domain flagged as a possible exfiltration vector.
- Effort: master
Remote Access Tool Domain
Detects traffic toward a domain flagged as a Remote Administration Tool (RAT).
- Effort: master
SEKOIA.IO Intelligence Feed
Detect threats based on indicators of compromise (IOCs) collected by SEKOIA's Threat and Detection Research team.
- Effort: elementary
Sekoia.io EICAR Detection
Detects observables in Sekoia.io CTI tagged as EICAR, which are fake samples meant to test detection.
- Effort: master
TOR Usage Generic Rule
Detects TOR usage globally, whether the IP is a destination or source. TOR is short for The Onion Router, and it gets its name from how it works. TOR intercepts the network traffic from one or more apps on user’s computer, usually the user web browser, and shuffles it through a number of randomly-chosen computers before passing it on to its destination. This disguises user location, and makes it harder for servers to pick him/her out on repeat visits, or to tie together separate visits to different sites, this making tracking and surveillance more difficult. Before a network packet starts its journey, user’s computer chooses a random list of relays and repeatedly encrypts the data in multiple layers, like an onion. Each relay knows only enough to strip off the outermost layer of encryption, before passing what’s left on to the next relay in the list.
- Effort: master
Event Categories
The following table lists the data source offered by this integration.
| Data Source | Description |
|---|---|
Authentication logs |
Several SSH authentication methods are supported |
In details, the following table denotes the type of events produced by this integration.
| Name | Values |
|---|---|
| Kind | `` |
| Category | authentication, configuration, library, network, session |
| Type | end, info, protocol, start |
Transformed Events Samples after Ingestion
This section demonstrates how the raw logs will be transformed by our parsers. It shows the extracted fields that will be available for use in the built-in detection rules and hunting activities in the events page. Understanding these transformations is essential for analysts to create effective detection mechanisms with custom detection rules and to leverage the full potential of the collected data.
{
"message": " Accepted google_authenticator for root",
"event": {
"category": [
"authentication"
],
"outcome": "success",
"type": [
"start"
]
},
"action": {
"name": "session",
"outcome": "success",
"outcome_reason": "Accepted google_authenticator for root",
"target": "user",
"type": "open"
},
"observer": {
"product": "openssh",
"type": "server",
"vendor": "openbsd project"
},
"openssh": {
"auth": {
"method": "google_authenticator"
}
},
"process": {
"name": "sshd"
},
"related": {
"user": [
"root"
]
},
"source": {
"user": {
"name": "root"
}
},
"user": {
"name": "root"
}
}
{
"message": " Accepted gssapi-with-mic for ubuntu from 1.2.3.4 port 51826 ssh2",
"event": {
"category": [
"authentication"
],
"outcome": "success",
"type": [
"start"
]
},
"action": {
"name": "session",
"outcome": "success",
"outcome_reason": "Accepted gssapi-with-mic for ubuntu from 1.2.3.4 port 51826 ssh2",
"target": "user",
"type": "open"
},
"observer": {
"product": "openssh",
"type": "server",
"vendor": "openbsd project"
},
"openssh": {
"auth": {
"method": "gssapi-with-mic"
}
},
"process": {
"name": "sshd"
},
"related": {
"ip": [
"1.2.3.4"
],
"user": [
"ubuntu"
]
},
"source": {
"address": "1.2.3.4",
"ip": "1.2.3.4",
"port": 51826,
"user": {
"name": "ubuntu"
}
},
"user": {
"name": "ubuntu"
}
}
{
"message": " Accepted password for ubuntu from 1.2.3.4 port 51826 ssh2",
"event": {
"category": [
"authentication"
],
"outcome": "success",
"type": [
"start"
]
},
"action": {
"name": "session",
"outcome": "success",
"outcome_reason": "Accepted password for ubuntu from 1.2.3.4 port 51826 ssh2",
"target": "user",
"type": "open"
},
"observer": {
"product": "openssh",
"type": "server",
"vendor": "openbsd project"
},
"openssh": {
"auth": {
"method": "password"
}
},
"process": {
"name": "sshd"
},
"related": {
"ip": [
"1.2.3.4"
],
"user": [
"ubuntu"
]
},
"source": {
"address": "1.2.3.4",
"ip": "1.2.3.4",
"port": 51826,
"user": {
"name": "ubuntu"
}
},
"user": {
"name": "ubuntu"
}
}
{
"message": " Accepted publickey for ubuntu from 1.2.3.4 port 51826 ssh2: RSA SHA256:AbpHGcgLb+kRsJGnwFEktk7uzpZOCcBY74+YBdrKVGs=",
"event": {
"category": [
"authentication"
],
"outcome": "success",
"type": [
"start"
]
},
"action": {
"name": "session",
"outcome": "success",
"outcome_reason": "Accepted publickey for ubuntu from 1.2.3.4 port 51826 ssh2: RSA SHA256:AbpHGcgLb+kRsJGnwFEktk7uzpZOCcBY74+YBdrKVGs=",
"target": "user",
"type": "open"
},
"file": {
"hash": {
"sha256": "AbpHGcgLb+kRsJGnwFEktk7uzpZOCcBY74+YBdrKVGs="
}
},
"observer": {
"product": "openssh",
"type": "server",
"vendor": "openbsd project"
},
"openssh": {
"auth": {
"method": "publickey"
}
},
"process": {
"name": "sshd"
},
"related": {
"hash": [
"AbpHGcgLb+kRsJGnwFEktk7uzpZOCcBY74+YBdrKVGs="
],
"ip": [
"1.2.3.4"
],
"user": [
"ubuntu"
]
},
"source": {
"address": "1.2.3.4",
"ip": "1.2.3.4",
"port": 51826,
"user": {
"name": "ubuntu"
}
},
"user": {
"name": "ubuntu"
}
}
{
"message": " Accepted publickey for jdoe@example.local from 1.2.3.4 port 59294 ssh2: ED25519 SHA256:AbpHGcgLb+kRsJGnwFEktk7uzpZOCcBY74+YBdrKVGs=",
"event": {
"category": [
"authentication"
],
"outcome": "success",
"type": [
"start"
]
},
"action": {
"name": "session",
"outcome": "success",
"outcome_reason": "Accepted publickey for jdoe@example.local from 1.2.3.4 port 59294 ssh2: ED25519 SHA256:AbpHGcgLb+kRsJGnwFEktk7uzpZOCcBY74+YBdrKVGs=",
"target": "user",
"type": "open"
},
"file": {
"hash": {
"sha256": "AbpHGcgLb+kRsJGnwFEktk7uzpZOCcBY74+YBdrKVGs="
}
},
"observer": {
"product": "openssh",
"type": "server",
"vendor": "openbsd project"
},
"openssh": {
"auth": {
"method": "publickey"
}
},
"process": {
"name": "sshd"
},
"related": {
"hash": [
"AbpHGcgLb+kRsJGnwFEktk7uzpZOCcBY74+YBdrKVGs="
],
"hosts": [
"example.local"
],
"ip": [
"1.2.3.4"
],
"user": [
"jdoe"
]
},
"source": {
"address": "example.local",
"domain": "example.local",
"ip": "1.2.3.4",
"port": 59294,
"subdomain": "example",
"user": {
"name": "jdoe"
}
},
"user": {
"name": "jdoe"
}
}
{
"message": " Accepted key RSA SHA256:3cOMdwjvSk5BnU2zs6397YpKn/SNSVSAMtsQchY8dOo found at /home/star/.ssh/authorized_keys:2",
"event": {
"category": [
"authentication"
],
"outcome": "success",
"type": [
"start"
]
},
"action": {
"name": "session",
"outcome": "success",
"outcome_reason": "Accepted key RSA SHA256:3cOMdwjvSk5BnU2zs6397YpKn/SNSVSAMtsQchY8dOo found at /home/star/.ssh/authorized_keys:2",
"target": "user",
"type": "open"
},
"observer": {
"product": "openssh",
"type": "server",
"vendor": "openbsd project"
},
"process": {
"name": "sshd"
}
}
{
"message": " Accepted key RSA SHA256:3cOMdwjvSk5BnU2zs6397YpKn/SNSVSAMtsQchY8dOo found at /usr/local/nagios/.ssh/authorized_keys:1",
"event": {
"category": [
"authentication"
],
"outcome": "success",
"type": [
"start"
]
},
"action": {
"name": "session",
"outcome": "success",
"outcome_reason": "Accepted key RSA SHA256:3cOMdwjvSk5BnU2zs6397YpKn/SNSVSAMtsQchY8dOo found at /usr/local/nagios/.ssh/authorized_keys:1",
"target": "user",
"type": "open"
},
"observer": {
"product": "openssh",
"type": "server",
"vendor": "openbsd project"
},
"process": {
"name": "sshd"
}
}
{
"message": "main: sshd: ssh-rsa algorithm is disabled",
"event": {
"category": [
"configuration"
],
"outcome": "success",
"type": [
"info"
]
},
"action": {
"outcome_reason": "main: sshd: ssh-rsa algorithm is disabled"
},
"observer": {
"product": "openssh",
"type": "server",
"vendor": "openbsd project"
},
"process": {
"name": "sshd"
}
}
{
"message": " error: maximum authentication attempts exceeded for invalid user support from ssh.example.org port 51219 ssh2 [preauth]",
"event": {
"category": [
"session"
],
"outcome": "failure",
"type": [
"end"
]
},
"action": {
"name": "connection",
"outcome": "failure",
"outcome_reason": "maximum authentication attempts exceeded",
"target": "user",
"type": "open"
},
"observer": {
"product": "openssh",
"type": "server",
"vendor": "openbsd project"
},
"process": {
"name": "sshd"
},
"related": {
"hosts": [
"ssh.example.org"
],
"user": [
"support"
]
},
"source": {
"address": "ssh.example.org",
"domain": "ssh.example.org",
"port": 51219,
"registered_domain": "example.org",
"subdomain": "ssh",
"top_level_domain": "org",
"user": {
"name": "support"
}
},
"user": {
"name": "support"
}
}
{
"message": " error: maximum authentication attempts exceeded for root from 1.2.3.4 port 63758 ssh2 [preauth]",
"event": {
"category": [
"session"
],
"outcome": "failure",
"type": [
"end"
]
},
"action": {
"name": "connection",
"outcome": "failure",
"outcome_reason": "maximum authentication attempts exceeded",
"target": "user",
"type": "open"
},
"observer": {
"product": "openssh",
"type": "server",
"vendor": "openbsd project"
},
"process": {
"name": "sshd"
},
"related": {
"ip": [
"1.2.3.4"
],
"user": [
"root"
]
},
"source": {
"address": "1.2.3.4",
"ip": "1.2.3.4",
"port": 63758,
"user": {
"name": "root"
}
},
"user": {
"name": "root"
}
}
{
"message": " Disconnecting invalid user support 1.2.3.4 port 51219: Too many authentication failures [preauth]",
"event": {
"category": [
"authentication"
],
"outcome": "failure",
"type": [
"end"
]
},
"action": {
"name": "connection",
"outcome": "failure",
"outcome_reason": "Disconnecting",
"target": "user",
"type": "open"
},
"observer": {
"product": "openssh",
"type": "server",
"vendor": "openbsd project"
},
"process": {
"name": "sshd"
},
"related": {
"ip": [
"1.2.3.4"
],
"user": [
"support"
]
},
"source": {
"address": "1.2.3.4",
"ip": "1.2.3.4",
"port": 51219,
"user": {
"name": "support"
}
},
"user": {
"name": "support"
}
}
{
"message": " Bad protocol version identification '\\003' from 1.2.3.4 port 407",
"event": {
"category": [
"network"
],
"outcome": "failure",
"type": [
"protocol"
]
},
"action": {
"name": "negotiate",
"outcome": "failure",
"outcome_reason": "Bad protocol version",
"target": "user",
"type": "open"
},
"observer": {
"product": "openssh",
"type": "server",
"vendor": "openbsd project"
},
"process": {
"name": "sshd"
},
"related": {
"ip": [
"1.2.3.4"
]
},
"source": {
"address": "1.2.3.4",
"ip": "1.2.3.4",
"port": 407
}
}
{
"message": " Connection closed by 1.2.3.4 port 51488 [preauth]",
"event": {
"category": [
"network"
],
"outcome": "success",
"type": [
"end"
]
},
"action": {
"name": "connection",
"outcome": "success",
"outcome_reason": "Connection closed by 1.2.3.4 port 51488 [preauth]",
"target": "user",
"type": "close"
},
"observer": {
"product": "openssh",
"type": "server",
"vendor": "openbsd project"
},
"process": {
"name": "sshd"
},
"related": {
"ip": [
"1.2.3.4"
]
},
"source": {
"address": "1.2.3.4",
"ip": "1.2.3.4",
"port": 51488
}
}
{
"message": " Connection closed by 127.0.0.1",
"event": {
"category": [
"network"
],
"outcome": "success",
"type": [
"end"
]
},
"action": {
"name": "connection",
"outcome": "success",
"outcome_reason": "Connection closed by 127.0.0.1",
"target": "user",
"type": "close"
},
"observer": {
"product": "openssh",
"type": "server",
"vendor": "openbsd project"
},
"process": {
"name": "sshd"
},
"related": {
"ip": [
"127.0.0.1"
]
},
"source": {
"address": "127.0.0.1",
"ip": "127.0.0.1"
}
}
{
"message": " Connection closed by authenticating user backup 1.2.3.4 port 49424 [preauth]",
"event": {
"category": [
"network"
],
"outcome": "success",
"type": [
"end"
]
},
"action": {
"name": "connection",
"outcome": "success",
"outcome_reason": "Connection closed by authenticating user backup 1.2.3.4 port 49424 [preauth]",
"target": "user",
"type": "close"
},
"observer": {
"product": "openssh",
"type": "server",
"vendor": "openbsd project"
},
"process": {
"name": "sshd"
},
"related": {
"ip": [
"1.2.3.4"
],
"user": [
"backup"
]
},
"source": {
"address": "1.2.3.4",
"ip": "1.2.3.4",
"port": 49424,
"user": {
"name": "backup"
}
},
"user": {
"name": "backup"
}
}
{
"message": " Connection closed by illegal user default 1.2.3.4 port 49424 [preauth]",
"event": {
"category": [
"network"
],
"outcome": "success",
"type": [
"end"
]
},
"action": {
"name": "connection",
"outcome": "success",
"outcome_reason": "Connection closed by illegal user default 1.2.3.4 port 49424 [preauth]",
"target": "user",
"type": "close"
},
"observer": {
"product": "openssh",
"type": "server",
"vendor": "openbsd project"
},
"process": {
"name": "sshd"
},
"related": {
"ip": [
"1.2.3.4"
],
"user": [
"default"
]
},
"source": {
"address": "1.2.3.4",
"ip": "1.2.3.4",
"port": 49424,
"user": {
"name": "default"
}
},
"user": {
"name": "default"
}
}
{
"message": " Connection closed by invalid user pi 1.2.3.4 port 42608 [preauth]",
"event": {
"category": [
"network"
],
"outcome": "success",
"type": [
"end"
]
},
"action": {
"name": "connection",
"outcome": "success",
"outcome_reason": "Connection closed by invalid user pi 1.2.3.4 port 42608 [preauth]",
"target": "user",
"type": "close"
},
"observer": {
"product": "openssh",
"type": "server",
"vendor": "openbsd project"
},
"process": {
"name": "sshd"
},
"related": {
"ip": [
"1.2.3.4"
],
"user": [
"pi"
]
},
"source": {
"address": "1.2.3.4",
"ip": "1.2.3.4",
"port": 42608,
"user": {
"name": "pi"
}
},
"user": {
"name": "pi"
}
}
{
"message": " Connection closed by invalid user 1.2.3.4 port 36797 [preauth]",
"event": {
"category": [
"network"
],
"outcome": "success",
"type": [
"end"
]
},
"action": {
"name": "connection",
"outcome": "success",
"outcome_reason": "Connection closed by invalid user 1.2.3.4 port 36797 [preauth]",
"target": "user",
"type": "close"
},
"observer": {
"product": "openssh",
"type": "server",
"vendor": "openbsd project"
},
"process": {
"name": "sshd"
},
"related": {
"ip": [
"1.2.3.4"
]
},
"source": {
"address": "1.2.3.4",
"ip": "1.2.3.4",
"port": 36797
}
}
{
"message": " ssh_dispatch_run_fatal: Connection from 1.2.3.4 port 49065: Connection corrupted [preauth]",
"event": {
"category": [
"network"
],
"outcome": "failure",
"type": [
"protocol"
]
},
"action": {
"name": "negotiate",
"outcome": "failure",
"outcome_reason": "ssh_dispatch_run_fatal:",
"target": "user",
"type": "open"
},
"observer": {
"product": "openssh",
"type": "server",
"vendor": "openbsd project"
},
"process": {
"name": "sshd"
},
"related": {
"ip": [
"1.2.3.4"
]
},
"source": {
"address": "1.2.3.4",
"ip": "1.2.3.4",
"port": 49065
}
}
{
"message": " Connection from 127.0.0.1 port 58752 on 127.0.0.1 port 22",
"event": {
"category": [
"network"
],
"outcome": "success",
"type": [
"start"
]
},
"action": {
"name": "connection",
"outcome": "success",
"outcome_reason": "Connection from 127.0.0.1 port 58752 on 127.0.0.1 port 22",
"target": "user",
"type": "open"
},
"destination": {
"address": "127.0.0.1",
"ip": "127.0.0.1",
"port": 22
},
"observer": {
"product": "openssh",
"type": "server",
"vendor": "openbsd project"
},
"process": {
"name": "sshd"
},
"related": {
"ip": [
"127.0.0.1"
]
},
"source": {
"address": "127.0.0.1",
"ip": "127.0.0.1",
"port": 58752
}
}
{
"message": " Connection reset by 1.2.3.4 port 45611 [preauth]",
"event": {
"category": [
"network"
],
"outcome": "success",
"type": [
"end"
]
},
"action": {
"name": "connection",
"outcome": "success",
"outcome_reason": "reset",
"target": "user",
"type": "close"
},
"observer": {
"product": "openssh",
"type": "server",
"vendor": "openbsd project"
},
"process": {
"name": "sshd"
},
"related": {
"ip": [
"1.2.3.4"
]
},
"source": {
"address": "1.2.3.4",
"ip": "1.2.3.4",
"port": 45611
}
}
{
"message": "Mar 11 11:26:54 foobar sshd[3296336]: Received disconnect from 1.1.1.1 port 33980:11: Bye Bye",
"event": {
"category": [
"network"
],
"outcome": "success",
"type": [
"end"
]
},
"action": {
"name": "connection",
"outcome": "success",
"outcome_reason": "Bye Bye",
"target": "user",
"type": "close"
},
"observer": {
"product": "openssh",
"type": "server",
"vendor": "openbsd project"
},
"process": {
"name": "sshd"
},
"related": {
"ip": [
"1.1.1.1"
]
},
"source": {
"address": "1.1.1.1",
"ip": "1.1.1.1",
"port": 33980
}
}
{
"message": " Disconnected from 1.2.3.4 port 39906 [preauth]",
"event": {
"category": [
"network"
],
"outcome": "success",
"type": [
"end"
]
},
"action": {
"name": "connection",
"outcome": "success",
"outcome_reason": "Disconnected from 1.2.3.4 port 39906 [preauth]",
"target": "user",
"type": "close"
},
"observer": {
"product": "openssh",
"type": "server",
"vendor": "openbsd project"
},
"process": {
"name": "sshd"
},
"related": {
"ip": [
"1.2.3.4"
]
},
"source": {
"address": "1.2.3.4",
"ip": "1.2.3.4",
"port": 39906
}
}
{
"message": " Disconnected from authenticating user backup 1.2.3.4 port 49424 [preauth]",
"event": {
"category": [
"network"
],
"outcome": "success",
"type": [
"end"
]
},
"action": {
"name": "connection",
"outcome": "success",
"outcome_reason": "Disconnected from authenticating user backup 1.2.3.4 port 49424 [preauth]",
"target": "user",
"type": "close"
},
"observer": {
"product": "openssh",
"type": "server",
"vendor": "openbsd project"
},
"process": {
"name": "sshd"
},
"related": {
"ip": [
"1.2.3.4"
],
"user": [
"backup"
]
},
"source": {
"address": "1.2.3.4",
"ip": "1.2.3.4",
"port": 49424,
"user": {
"name": "backup"
}
},
"user": {
"name": "backup"
}
}
{
"message": " Disconnected from illegal user default 1.2.3.4 port 48792 [preauth]",
"event": {
"category": [
"network"
],
"outcome": "success",
"type": [
"end"
]
},
"action": {
"name": "connection",
"outcome": "success",
"outcome_reason": "Disconnected from illegal user default 1.2.3.4 port 48792 [preauth]",
"target": "user",
"type": "close"
},
"observer": {
"product": "openssh",
"type": "server",
"vendor": "openbsd project"
},
"process": {
"name": "sshd"
},
"related": {
"ip": [
"1.2.3.4"
],
"user": [
"default"
]
},
"source": {
"address": "1.2.3.4",
"ip": "1.2.3.4",
"port": 48792,
"user": {
"name": "default"
}
},
"user": {
"name": "default"
}
}
{
"message": " Disconnected from user ubuntu 1.2.3.4 port 44708",
"event": {
"category": [
"network"
],
"outcome": "success",
"type": [
"end"
]
},
"action": {
"name": "connection",
"outcome": "success",
"outcome_reason": "Disconnected from user ubuntu 1.2.3.4 port 44708",
"target": "user",
"type": "close"
},
"observer": {
"product": "openssh",
"type": "server",
"vendor": "openbsd project"
},
"process": {
"name": "sshd"
},
"related": {
"ip": [
"1.2.3.4"
],
"user": [
"ubuntu"
]
},
"source": {
"address": "1.2.3.4",
"ip": "1.2.3.4",
"port": 44708,
"user": {
"name": "ubuntu"
}
},
"user": {
"name": "ubuntu"
}
}
{
"message": " Disconnected from user jdoe@lexample.local 1.2.3.4 port 33480",
"event": {
"category": [
"network"
],
"outcome": "success",
"type": [
"end"
]
},
"action": {
"name": "connection",
"outcome": "success",
"outcome_reason": "Disconnected from user jdoe@lexample.local 1.2.3.4 port 33480",
"target": "user",
"type": "close"
},
"observer": {
"product": "openssh",
"type": "server",
"vendor": "openbsd project"
},
"process": {
"name": "sshd"
},
"related": {
"hosts": [
"lexample.local"
],
"ip": [
"1.2.3.4"
],
"user": [
"jdoe"
]
},
"source": {
"address": "lexample.local",
"domain": "lexample.local",
"ip": "1.2.3.4",
"port": 33480,
"subdomain": "lexample",
"user": {
"name": "jdoe"
}
},
"user": {
"name": "jdoe"
}
}
{
"message": "Failed none for invalid user guest from 1.2.3.4 port 15806 ssh2",
"event": {
"category": [
"authentication"
],
"outcome": "failure",
"type": [
"end"
]
},
"action": {
"name": "connection",
"outcome": "failure",
"outcome_reason": "Failed none",
"target": "user",
"type": "open"
},
"observer": {
"product": "openssh",
"type": "server",
"vendor": "openbsd project"
},
"process": {
"name": "sshd"
},
"related": {
"ip": [
"1.2.3.4"
],
"user": [
"guest"
]
},
"source": {
"address": "1.2.3.4",
"ip": "1.2.3.4",
"port": 15806,
"user": {
"name": "guest"
}
},
"user": {
"name": "guest"
}
}
{
"message": "fatal: userauth_finish: send failure packet: Broken pipe [preauth]",
"event": {
"category": [
"session"
],
"outcome": "failure",
"type": [
"end"
]
},
"action": {
"name": "connection",
"outcome": "failure",
"outcome_reason": "userauth_finish: send failure packet: Broken pipe [preauth]",
"target": "user",
"type": "open"
},
"observer": {
"product": "openssh",
"type": "server",
"vendor": "openbsd project"
},
"process": {
"name": "sshd"
}
}
{
"message": " Failed password for backup from 1.2.3.4 port 60150 ssh2",
"event": {
"category": [
"authentication"
],
"outcome": "failure",
"type": [
"end"
]
},
"action": {
"name": "connection",
"outcome": "failure",
"outcome_reason": "Failed password",
"target": "user",
"type": "open"
},
"observer": {
"product": "openssh",
"type": "server",
"vendor": "openbsd project"
},
"process": {
"name": "sshd"
},
"related": {
"ip": [
"1.2.3.4"
],
"user": [
"backup"
]
},
"source": {
"address": "1.2.3.4",
"ip": "1.2.3.4",
"port": 60150,
"user": {
"name": "backup"
}
},
"user": {
"name": "backup"
}
}
{
"message": " Failed password for invalid user ***** from 1.2.3.4 port 51894 ssh2",
"event": {
"category": [
"authentication"
],
"outcome": "failure",
"type": [
"end"
]
},
"action": {
"name": "connection",
"outcome": "failure",
"outcome_reason": "Failed password",
"target": "user",
"type": "open"
},
"observer": {
"product": "openssh",
"type": "server",
"vendor": "openbsd project"
},
"process": {
"name": "sshd"
},
"related": {
"ip": [
"1.2.3.4"
]
},
"source": {
"address": "1.2.3.4",
"ip": "1.2.3.4",
"port": 51894
}
}
{
"message": "fatal: Timeout before authentication for 1.2.3.4 port 52076",
"event": {
"category": [
"session"
],
"outcome": "failure",
"type": [
"end"
]
},
"action": {
"name": "connection",
"outcome": "failure",
"outcome_reason": "Timeout before authentication",
"target": "user",
"type": "open"
},
"observer": {
"product": "openssh",
"type": "server",
"vendor": "openbsd project"
},
"process": {
"name": "sshd"
},
"related": {
"ip": [
"1.2.3.4"
]
},
"source": {
"address": "1.2.3.4",
"ip": "1.2.3.4",
"port": 52076
}
}
{
"message": " Invalid user jdoe from ssh.example.org port 48792",
"event": {
"category": [
"authentication"
],
"outcome": "failure",
"type": [
"end"
]
},
"action": {
"name": "connection",
"outcome": "failure",
"outcome_reason": "Invalid user",
"target": "user",
"type": "open"
},
"observer": {
"product": "openssh",
"type": "server",
"vendor": "openbsd project"
},
"process": {
"name": "sshd"
},
"related": {
"hosts": [
"ssh.example.org"
],
"user": [
"jdoe"
]
},
"source": {
"address": "ssh.example.org",
"domain": "ssh.example.org",
"port": 48792,
"registered_domain": "example.org",
"subdomain": "ssh",
"top_level_domain": "org",
"user": {
"name": "jdoe"
}
},
"user": {
"name": "jdoe"
}
}
{
"message": " input_userauth_request: invalid user jdoe [preauth]",
"event": {
"category": [
"authentication"
],
"outcome": "failure",
"type": [
"end"
]
},
"action": {
"name": "connection",
"outcome": "failure",
"outcome_reason": "invalid user",
"target": "user",
"type": "open"
},
"observer": {
"product": "openssh",
"type": "server",
"vendor": "openbsd project"
},
"process": {
"name": "sshd"
},
"related": {
"user": [
"jdoe"
]
},
"source": {
"user": {
"name": "jdoe"
}
},
"user": {
"name": "jdoe"
}
}
{
"message": " Invalid user ***** from 1.2.3.4 port 51894",
"event": {
"category": [
"authentication"
],
"outcome": "failure",
"type": [
"end"
]
},
"action": {
"name": "connection",
"outcome": "failure",
"outcome_reason": "Invalid user",
"target": "user",
"type": "open"
},
"observer": {
"product": "openssh",
"type": "server",
"vendor": "openbsd project"
},
"process": {
"name": "sshd"
},
"related": {
"ip": [
"1.2.3.4"
]
},
"source": {
"address": "1.2.3.4",
"ip": "1.2.3.4",
"port": 51894
}
}
{
"message": " error: kex_exchange_identification: Connection closed by remote host",
"event": {
"category": [
"session"
],
"outcome": "failure",
"type": [
"end"
]
},
"action": {
"name": "connection",
"outcome": "failure",
"outcome_reason": "Connection closed by remote host",
"target": "user",
"type": "open"
},
"observer": {
"product": "openssh",
"type": "server",
"vendor": "openbsd project"
},
"process": {
"name": "sshd"
}
}
{
"message": " Did not receive identification string from 1.2.3.4 port 50622",
"event": {
"category": [
"session"
],
"outcome": "failure",
"type": [
"end"
]
},
"action": {
"name": "connection",
"outcome": "failure",
"outcome_reason": "Did not receive identification string",
"target": "user",
"type": "open"
},
"observer": {
"product": "openssh",
"type": "server",
"vendor": "openbsd project"
},
"process": {
"name": "sshd"
},
"related": {
"ip": [
"1.2.3.4"
]
},
"source": {
"address": "1.2.3.4",
"ip": "1.2.3.4",
"port": 50622
}
}
{
"message": " pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=1.2.3.4",
"event": {
"category": [
"authentication"
],
"outcome": "failure",
"type": [
"end"
]
},
"action": {
"name": "sshd:auth",
"outcome": "failure",
"outcome_reason": "pam_unix(sshd:auth): authentication failure;",
"target": "user",
"type": "authentication"
},
"observer": {
"product": "openssh",
"type": "server",
"vendor": "openbsd project"
},
"process": {
"name": "sshd"
},
"related": {
"ip": [
"1.2.3.4"
]
},
"source": {
"address": "1.2.3.4",
"ip": "1.2.3.4"
}
}
{
"message": " pam_unix(sshd:auth): check pass; user unknown",
"event": {
"category": [
"authentication"
],
"outcome": "success",
"type": [
"start"
]
},
"action": {
"name": "sshd:auth",
"outcome": "success",
"outcome_reason": "pam_unix(sshd:auth): check pass; user unknown",
"target": "user",
"type": "check"
},
"observer": {
"product": "openssh",
"type": "server",
"vendor": "openbsd project"
},
"process": {
"name": "sshd"
},
"related": {
"user": [
"unknown"
]
},
"source": {
"user": {
"name": "unknown"
}
},
"user": {
"name": "unknown"
}
}
{
"message": "pam_faillock(sshd:auth): Consecutive login failures for user JDOE account temporarily locked",
"event": {
"category": [
"authentication"
],
"outcome": "failure",
"type": [
"end"
]
},
"action": {
"name": "sshd:auth",
"outcome": "failure",
"outcome_reason": "Consecutive login failures for user JDOE account temporarily locked",
"target": "user",
"type": "authentication"
},
"observer": {
"product": "openssh",
"type": "server",
"vendor": "openbsd project"
},
"process": {
"name": "sshd"
},
"related": {
"user": [
"JDOE"
]
},
"source": {
"user": {
"name": "JDOE"
}
},
"user": {
"name": "JDOE"
}
}
{
"message": "pam_faillock(sshd:auth): User unknown",
"event": {
"category": [
"authentication"
],
"outcome": "failure",
"type": [
"end"
]
},
"action": {
"name": "sshd:auth",
"outcome": "failure",
"outcome_reason": "User unknown",
"target": "user",
"type": "authentication"
},
"observer": {
"product": "openssh",
"type": "server",
"vendor": "openbsd project"
},
"process": {
"name": "sshd"
}
}
{
"message": "PAM adding faulty module: pam_cracklib.so",
"event": {
"category": [
"library"
],
"outcome": "failure",
"type": [
"start"
]
},
"action": {
"outcome": "failure",
"outcome_reason": "PAM adding faulty module: pam_cracklib.so"
},
"dll": {
"name": "pam_cracklib.so"
},
"observer": {
"product": "openssh",
"type": "server",
"vendor": "openbsd project"
},
"process": {
"name": "sshd"
}
}
{
"message": "PAM 2 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=1.2.3.4 user=root",
"event": {
"category": [
"authentication"
],
"outcome": "failure",
"type": [
"end"
]
},
"action": {
"name": "sshd:auth",
"outcome": "failure",
"outcome_reason": "PAM 2 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=1.2.3.4 user=root",
"target": "user",
"type": "authentication"
},
"observer": {
"product": "openssh",
"type": "server",
"vendor": "openbsd project"
},
"process": {
"name": "sshd"
},
"related": {
"ip": [
"1.2.3.4"
],
"user": [
"root"
]
},
"source": {
"address": "1.2.3.4",
"ip": "1.2.3.4",
"user": {
"name": "root"
}
},
"user": {
"euid": "0",
"id": "0",
"name": "root"
}
}
{
"message": "PAM service(sshd) ignoring max retries; 6 > 3",
"event": {
"category": [
"session"
],
"outcome": "failure",
"type": [
"start"
]
},
"action": {
"name": "connection",
"outcome": "failure",
"outcome_reason": "ignoring max retries; 6 > 3",
"target": "user",
"type": "open"
},
"observer": {
"product": "openssh",
"type": "server",
"vendor": "openbsd project"
},
"process": {
"name": "sshd"
}
}
{
"message": " pam_unix(sshd:session): session closed for user ubuntu",
"event": {
"category": [
"session"
],
"outcome": "success",
"type": [
"end"
]
},
"action": {
"name": "sshd:session",
"outcome": "success",
"outcome_reason": "pam_unix(sshd:session): session closed for user ubuntu",
"target": "user",
"type": "close"
},
"observer": {
"product": "openssh",
"type": "server",
"vendor": "openbsd project"
},
"process": {
"name": "sshd"
},
"related": {
"user": [
"ubuntu"
]
},
"source": {
"user": {
"name": "ubuntu"
}
},
"user": {
"name": "ubuntu"
}
}
{
"message": " pam_systemd(sshd:session): Failed to create session: Maximum number of sessions (8192) reached, refusing further sessions.",
"event": {
"category": [
"session"
],
"outcome": "failure",
"type": [
"end"
]
},
"action": {
"name": "connection",
"outcome": "failure",
"outcome_reason": "Maximum number of sessions (8192) reached, refusing further sessions.",
"target": "user",
"type": "open"
},
"observer": {
"product": "openssh",
"type": "server",
"vendor": "openbsd project"
},
"process": {
"name": "sshd"
}
}
{
"message": " pam_unix(sshd:session): session opened for user ubuntu by (uid=0)",
"event": {
"category": [
"session"
],
"outcome": "success",
"type": [
"start"
]
},
"action": {
"name": "sshd:session",
"outcome": "success",
"outcome_reason": "pam_unix(sshd:session): session opened for user ubuntu by (uid=0)",
"target": "user",
"type": "open"
},
"observer": {
"product": "openssh",
"type": "server",
"vendor": "openbsd project"
},
"process": {
"name": "sshd"
},
"related": {
"user": [
"ubuntu"
]
},
"source": {
"user": {
"name": "ubuntu"
}
},
"user": {
"name": "ubuntu"
}
}
{
"message": " pam_unix(sshd:session): session opened for user jdoe(uid=10357) by (uid=0)",
"event": {
"category": [
"session"
],
"outcome": "success",
"type": [
"start"
]
},
"action": {
"name": "sshd:session",
"outcome": "success",
"outcome_reason": "pam_unix(sshd:session): session opened for user jdoe(uid=10357) by (uid=0)",
"target": "user",
"type": "open"
},
"observer": {
"product": "openssh",
"type": "server",
"vendor": "openbsd project"
},
"process": {
"name": "sshd"
},
"related": {
"user": [
"jdoe"
]
},
"source": {
"user": {
"name": "jdoe"
}
},
"user": {
"euid": "10357",
"id": "10357",
"name": "jdoe"
}
}
{
"message": "PAM unable to dlopen(pam_cracklib.so): /lib/security/pam_cracklib.so: cannot open shared object file: No such file or directory",
"event": {
"category": [
"library"
],
"outcome": "failure",
"type": [
"start"
]
},
"action": {
"outcome": "failure",
"outcome_reason": "cannot open shared object file: No such file or directory"
},
"dll": {
"name": "pam_cracklib.so",
"path": "/lib/security/pam_cracklib.so"
},
"observer": {
"product": "openssh",
"type": "server",
"vendor": "openbsd project"
},
"process": {
"name": "sshd"
}
}
{
"message": " pam_winbind(sshd:account): user 'jdoe@example.local' granted access",
"event": {
"category": [
"session"
],
"outcome": "success",
"type": [
"start"
]
},
"action": {
"name": "sshd:session",
"outcome": "success",
"outcome_reason": "pam_winbind(sshd:account): user 'jdoe@example.local' granted access",
"target": "user",
"type": "open"
},
"observer": {
"product": "openssh",
"type": "server",
"vendor": "openbsd project"
},
"process": {
"name": "sshd"
},
"related": {
"hosts": [
"example.local"
],
"user": [
"jdoe"
]
},
"source": {
"address": "example.local",
"domain": "example.local",
"subdomain": "example",
"user": {
"name": "jdoe"
}
},
"user": {
"name": "jdoe"
}
}
{
"message": " Postponed publickey for star from 127.0.0.1 port 44690 ssh2 [preauth]",
"event": {
"category": [
"authentication"
],
"outcome": "success",
"type": [
"start"
]
},
"action": {
"name": "session",
"outcome": "success",
"outcome_reason": "Postponed publickey for star from 127.0.0.1 port 44690 ssh2 [preauth]",
"target": "user",
"type": "open"
},
"observer": {
"product": "openssh",
"type": "server",
"vendor": "openbsd project"
},
"openssh": {
"auth": {
"method": "publickey"
}
},
"process": {
"name": "sshd"
},
"related": {
"ip": [
"127.0.0.1"
],
"user": [
"star"
]
},
"source": {
"address": "127.0.0.1",
"ip": "127.0.0.1",
"port": 44690,
"user": {
"name": "star"
}
},
"user": {
"name": "star"
}
}
{
"message": " Received disconnect from 1.2.3.4 port 39906:11: Bye Bye [preauth]",
"event": {
"category": [
"network"
],
"outcome": "success",
"type": [
"end"
]
},
"action": {
"name": "connection",
"outcome": "success",
"outcome_reason": "Bye Bye",
"target": "user",
"type": "close"
},
"observer": {
"product": "openssh",
"type": "server",
"vendor": "openbsd project"
},
"process": {
"name": "sshd"
},
"related": {
"ip": [
"1.2.3.4"
]
},
"source": {
"address": "1.2.3.4",
"ip": "1.2.3.4",
"port": 39906
}
}
{
"message": " Received disconnect from 1.2.3.4 port 16899:11: [preauth]",
"event": {
"category": [
"network"
],
"outcome": "success",
"type": [
"end"
]
},
"action": {
"name": "connection",
"outcome": "success",
"outcome_reason": "Received disconnect from 1.2.3.4 port 16899:11: [preauth]",
"target": "user",
"type": "close"
},
"observer": {
"product": "openssh",
"type": "server",
"vendor": "openbsd project"
},
"process": {
"name": "sshd"
},
"related": {
"ip": [
"1.2.3.4"
]
},
"source": {
"address": "1.2.3.4",
"ip": "1.2.3.4",
"port": 16899
}
}
{
"message": " Received disconnect from 1.2.3.4 port 36958:11: Normal Shutdown, Thank you for playing [preauth]",
"event": {
"category": [
"network"
],
"outcome": "success",
"type": [
"end"
]
},
"action": {
"name": "connection",
"outcome": "success",
"outcome_reason": "Normal Shutdown, Thank you for playing",
"target": "user",
"type": "close"
},
"observer": {
"product": "openssh",
"type": "server",
"vendor": "openbsd project"
},
"process": {
"name": "sshd"
},
"related": {
"ip": [
"1.2.3.4"
]
},
"source": {
"address": "1.2.3.4",
"ip": "1.2.3.4",
"port": 36958
}
}
{
"message": " Received disconnect from 1.2.3.4 port 44708:11: disconnected by user",
"event": {
"category": [
"network"
],
"outcome": "success",
"type": [
"end"
]
},
"action": {
"name": "connection",
"outcome": "success",
"outcome_reason": "disconnected by user",
"target": "user",
"type": "close"
},
"observer": {
"product": "openssh",
"type": "server",
"vendor": "openbsd project"
},
"process": {
"name": "sshd"
},
"related": {
"ip": [
"1.2.3.4"
]
},
"source": {
"address": "1.2.3.4",
"ip": "1.2.3.4",
"port": 44708
}
}
{
"message": " Received disconnect from 127.0.0.1: 11: disconnected by user",
"event": {
"category": [
"network"
],
"outcome": "success",
"type": [
"end"
]
},
"action": {
"name": "connection",
"outcome": "success",
"outcome_reason": "disconnected by user",
"target": "user",
"type": "close"
},
"observer": {
"product": "openssh",
"type": "server",
"vendor": "openbsd project"
},
"process": {
"name": "sshd"
},
"related": {
"ip": [
"127.0.0.1"
]
},
"source": {
"address": "127.0.0.1",
"ip": "127.0.0.1"
}
}
{
"message": " Starting session: command for nagios from 127.0.0.1 port 58752 id 0",
"event": {
"outcome": "success"
},
"action": {
"outcome_reason": "Starting session: command for nagios from 127.0.0.1 port 58752 id 0"
},
"observer": {
"product": "openssh",
"type": "server",
"vendor": "openbsd project"
},
"process": {
"name": "sshd"
},
"related": {
"ip": [
"127.0.0.1"
],
"user": [
"nagios"
]
},
"source": {
"address": "127.0.0.1",
"ip": "127.0.0.1",
"port": 58752,
"user": {
"name": "nagios"
}
},
"user": {
"name": "nagios"
}
}
{
"message": " Starting session: command for star from 127.0.0.1 port 44690 id 0",
"event": {
"outcome": "success"
},
"action": {
"outcome_reason": "Starting session: command for star from 127.0.0.1 port 44690 id 0"
},
"observer": {
"product": "openssh",
"type": "server",
"vendor": "openbsd project"
},
"process": {
"name": "sshd"
},
"related": {
"ip": [
"127.0.0.1"
],
"user": [
"star"
]
},
"source": {
"address": "127.0.0.1",
"ip": "127.0.0.1",
"port": 44690,
"user": {
"name": "star"
}
},
"user": {
"name": "star"
}
}
{
"message": " Unable to negotiate with 1.2.3.4 port 27824: no matching cipher found. Their offer: aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,arcfour128,arcfour,3des-cbc,none [preauth]",
"event": {
"category": [
"session"
],
"outcome": "failure",
"type": [
"end"
]
},
"action": {
"name": "negotiate",
"outcome": "failure",
"outcome_reason": "Unable to negotiate with 1.2.3.4 port 27824: no matching cipher found. Their offer: aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,arcfour128,arcfour,3des-cbc,none [preauth]",
"target": "user",
"type": "open"
},
"observer": {
"product": "openssh",
"type": "server",
"vendor": "openbsd project"
},
"process": {
"name": "sshd"
},
"related": {
"ip": [
"1.2.3.4"
]
},
"source": {
"address": "1.2.3.4",
"ip": "1.2.3.4",
"port": 27824
}
}
{
"message": " Unable to negotiate with 1.2.3.4 port 5228: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1 [preauth]",
"event": {
"category": [
"session"
],
"outcome": "failure",
"type": [
"end"
]
},
"action": {
"name": "negotiate",
"outcome": "failure",
"outcome_reason": "Unable to negotiate with 1.2.3.4 port 5228: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1 [preauth]",
"target": "user",
"type": "open"
},
"observer": {
"product": "openssh",
"type": "server",
"vendor": "openbsd project"
},
"process": {
"name": "sshd"
},
"related": {
"ip": [
"1.2.3.4"
]
},
"source": {
"address": "1.2.3.4",
"ip": "1.2.3.4",
"port": 5228
}
}
{
"message": " User root from 1.2.3.4 not allowed because not listed in AllowUsers",
"event": {
"category": [
"authentication"
],
"outcome": "failure",
"type": [
"end"
]
},
"action": {
"name": "connection",
"outcome": "failure",
"outcome_reason": "not allowed because not listed in AllowUsers",
"target": "user",
"type": "open"
},
"observer": {
"product": "openssh",
"type": "server",
"vendor": "openbsd project"
},
"process": {
"name": "sshd"
},
"related": {
"ip": [
"1.2.3.4"
],
"user": [
"root"
]
},
"source": {
"address": "1.2.3.4",
"ip": "1.2.3.4",
"user": {
"name": "root"
}
},
"user": {
"name": "root"
}
}
{
"message": " User child is on pid 60225",
"event": {
"category": [
"session"
],
"outcome": "success",
"type": [
"start"
]
},
"action": {
"name": "connection",
"outcome": "success",
"outcome_reason": "is on pid 60225",
"target": "user",
"type": "open"
},
"observer": {
"product": "openssh",
"type": "server",
"vendor": "openbsd project"
},
"process": {
"name": "sshd",
"pid": 60225
},
"related": {
"user": [
"child"
]
},
"source": {
"user": {
"name": "child"
}
},
"user": {
"name": "child"
}
}
Extracted Fields
The following table lists the fields that are extracted, normalized under the ECS format, analyzed and indexed by the parser. It should be noted that infered fields are not listed.
| Name | Type | Description |
|---|---|---|
action.target |
keyword |
|
destination.ip |
ip |
IP address of the destination. |
destination.port |
long |
Port of the destination. |
dll.name |
keyword |
Name of the library. |
dll.path |
keyword |
Full file path of the library. |
event.category |
keyword |
Event category. The second categorization field in the hierarchy. |
event.outcome |
keyword |
The outcome of the event. The lowest level categorization field in the hierarchy. |
event.type |
keyword |
Event type. The third categorization field in the hierarchy. |
file.hash.sha256 |
keyword |
SHA256 hash. |
observer.product |
keyword |
The product name of the observer. |
observer.type |
keyword |
The type of the observer the data is coming from. |
observer.vendor |
keyword |
Vendor name of the observer. |
openssh.auth.method |
keyword |
|
process.name |
keyword |
Process name. |
process.pid |
long |
Process id. |
source.domain |
keyword |
The domain name of the source. |
source.ip |
ip |
IP address of the source. |
source.port |
long |
Port of the source. |
source.user.name |
keyword |
Short name or login of the user. |
user.euid |
keyword |
|
user.id |
keyword |
Unique identifier of the user. |
user.name |
keyword |
Short name or login of the user. |
For more information on the Intake Format, please find the code of the Parser, Smart Descriptions, and Supported Events here.