OpenSSH
Overview
OpenSSH is the premier connectivity tool for remote login with the SSH protocol. It encrypts all traffic to eliminate eavesdropping, connection hijacking, and other attacks. In addition, OpenSSH provides a large suite of secure tunneling capabilities, several authentication methods, and sophisticated configuration options.
Event Categories
The following table lists the data source offered by this integration.
Data Source | Description |
---|---|
Authentication logs |
Several SSH authentication methods are supported |
In details, the following table denotes the type of events produced by this integration.
Name | Values |
---|---|
Kind | event |
Category | authentication , network , session |
Type | end , protocol , start |
Event Samples
Find below few samples of events and how they are normalized by Sekoia.io.
{
"message": " Accepted gssapi-with-mic for ubuntu from 1.2.3.4 port 51826 ssh2",
"event": {
"category": [
"authentication"
],
"kind": "event",
"outcome": "success",
"type": [
"start"
]
},
"action": {
"name": "session",
"outcome": "success",
"outcome_reason": "Accepted gssapi-with-mic for ubuntu from 1.2.3.4 port 51826 ssh2",
"target": "user",
"type": "open"
},
"observer": {
"product": "openssh",
"type": "server",
"vendor": "openbsd project"
},
"openssh": {
"auth": {
"method": "gssapi-with-mic"
}
},
"process": {
"name": "sshd"
},
"related": {
"ip": [
"1.2.3.4"
],
"user": [
"ubuntu"
]
},
"source": {
"address": "1.2.3.4",
"ip": "1.2.3.4",
"port": 51826,
"user": {
"name": "ubuntu"
}
},
"user": {
"name": "ubuntu"
}
}
{
"message": " Accepted password for ubuntu from 1.2.3.4 port 51826 ssh2",
"event": {
"category": [
"authentication"
],
"kind": "event",
"outcome": "success",
"type": [
"start"
]
},
"action": {
"name": "session",
"outcome": "success",
"outcome_reason": "Accepted password for ubuntu from 1.2.3.4 port 51826 ssh2",
"target": "user",
"type": "open"
},
"observer": {
"product": "openssh",
"type": "server",
"vendor": "openbsd project"
},
"openssh": {
"auth": {
"method": "password"
}
},
"process": {
"name": "sshd"
},
"related": {
"ip": [
"1.2.3.4"
],
"user": [
"ubuntu"
]
},
"source": {
"address": "1.2.3.4",
"ip": "1.2.3.4",
"port": 51826,
"user": {
"name": "ubuntu"
}
},
"user": {
"name": "ubuntu"
}
}
{
"message": " Accepted publickey for ubuntu from 1.2.3.4 port 51826 ssh2: RSA SHA256:AbpHGcgLb+kRsJGnwFEktk7uzpZOCcBY74+YBdrKVGs=",
"event": {
"category": [
"authentication"
],
"kind": "event",
"outcome": "success",
"type": [
"start"
]
},
"action": {
"name": "session",
"outcome": "success",
"outcome_reason": "Accepted publickey for ubuntu from 1.2.3.4 port 51826 ssh2: RSA SHA256:AbpHGcgLb+kRsJGnwFEktk7uzpZOCcBY74+YBdrKVGs=",
"target": "user",
"type": "open"
},
"file": {
"hash": {
"sha256": "AbpHGcgLb+kRsJGnwFEktk7uzpZOCcBY74+YBdrKVGs="
}
},
"observer": {
"product": "openssh",
"type": "server",
"vendor": "openbsd project"
},
"openssh": {
"auth": {
"method": "publickey"
}
},
"process": {
"name": "sshd"
},
"related": {
"hash": [
"AbpHGcgLb+kRsJGnwFEktk7uzpZOCcBY74+YBdrKVGs="
],
"ip": [
"1.2.3.4"
],
"user": [
"ubuntu"
]
},
"source": {
"address": "1.2.3.4",
"ip": "1.2.3.4",
"port": 51826,
"user": {
"name": "ubuntu"
}
},
"user": {
"name": "ubuntu"
}
}
{
"message": " error: maximum authentication attempts exceeded for invalid user support from ssh.example.org port 51219 ssh2 [preauth]",
"event": {
"category": [
"session"
],
"kind": "event",
"outcome": "failure",
"type": [
"end"
]
},
"action": {
"name": "connection",
"outcome": "failure",
"outcome_reason": "maximum authentication attempts exceeded",
"target": "user",
"type": "open"
},
"observer": {
"product": "openssh",
"type": "server",
"vendor": "openbsd project"
},
"process": {
"name": "sshd"
},
"related": {
"hosts": [
"ssh.example.org"
],
"user": [
"support"
]
},
"source": {
"address": "ssh.example.org",
"domain": "ssh.example.org",
"port": 51219,
"registered_domain": "example.org",
"subdomain": "ssh",
"top_level_domain": "org",
"user": {
"name": "support"
}
},
"user": {
"name": "support"
}
}
{
"message": " Disconnecting invalid user support 1.2.3.4 port 51219: Too many authentication failures [preauth]",
"event": {
"category": [
"authentication"
],
"kind": "event",
"outcome": "failure",
"type": [
"end"
]
},
"action": {
"name": "connection",
"outcome": "failure",
"outcome_reason": "Disconnecting",
"target": "user",
"type": "open"
},
"observer": {
"product": "openssh",
"type": "server",
"vendor": "openbsd project"
},
"process": {
"name": "sshd"
},
"related": {
"ip": [
"1.2.3.4"
],
"user": [
"support"
]
},
"source": {
"address": "1.2.3.4",
"ip": "1.2.3.4",
"port": 51219,
"user": {
"name": "support"
}
},
"user": {
"name": "support"
}
}
{
"message": " Bad protocol version identification '\\003' from 1.2.3.4 port 407",
"event": {
"category": [
"network"
],
"kind": "event",
"outcome": "failure",
"type": [
"protocol"
]
},
"action": {
"name": "negotiate",
"outcome": "failure",
"outcome_reason": "Bad protocol version",
"target": "user",
"type": "open"
},
"observer": {
"product": "openssh",
"type": "server",
"vendor": "openbsd project"
},
"process": {
"name": "sshd"
},
"related": {
"ip": [
"1.2.3.4"
]
},
"source": {
"address": "1.2.3.4",
"ip": "1.2.3.4",
"port": 407
}
}
{
"message": " Connection closed by 1.2.3.4 port 51488 [preauth]",
"event": {
"category": [
"network"
],
"kind": "event",
"outcome": "success",
"type": [
"end"
]
},
"action": {
"name": "connection",
"outcome": "success",
"outcome_reason": "Connection closed by 1.2.3.4 port 51488 [preauth]",
"target": "user",
"type": "close"
},
"observer": {
"product": "openssh",
"type": "server",
"vendor": "openbsd project"
},
"process": {
"name": "sshd"
},
"related": {
"ip": [
"1.2.3.4"
]
},
"source": {
"address": "1.2.3.4",
"ip": "1.2.3.4",
"port": 51488
}
}
{
"message": " Connection closed by authenticating user backup 1.2.3.4 port 49424 [preauth]",
"event": {
"category": [
"network"
],
"kind": "event",
"outcome": "success",
"type": [
"end"
]
},
"action": {
"name": "connection",
"outcome": "success",
"outcome_reason": "Connection closed by authenticating user backup 1.2.3.4 port 49424 [preauth]",
"target": "user",
"type": "close"
},
"observer": {
"product": "openssh",
"type": "server",
"vendor": "openbsd project"
},
"process": {
"name": "sshd"
},
"related": {
"ip": [
"1.2.3.4"
],
"user": [
"backup"
]
},
"source": {
"address": "1.2.3.4",
"ip": "1.2.3.4",
"port": 49424,
"user": {
"name": "backup"
}
},
"user": {
"name": "backup"
}
}
{
"message": " Connection closed by illegal user default 1.2.3.4 port 49424 [preauth]",
"event": {
"category": [
"network"
],
"kind": "event",
"outcome": "success",
"type": [
"end"
]
},
"action": {
"name": "connection",
"outcome": "success",
"outcome_reason": "Connection closed by illegal user default 1.2.3.4 port 49424 [preauth]",
"target": "user",
"type": "close"
},
"observer": {
"product": "openssh",
"type": "server",
"vendor": "openbsd project"
},
"process": {
"name": "sshd"
},
"related": {
"ip": [
"1.2.3.4"
],
"user": [
"default"
]
},
"source": {
"address": "1.2.3.4",
"ip": "1.2.3.4",
"port": 49424,
"user": {
"name": "default"
}
},
"user": {
"name": "default"
}
}
{
"message": " Connection closed by invalid user pi 1.2.3.4 port 42608 [preauth]",
"event": {
"category": [
"network"
],
"kind": "event",
"outcome": "success",
"type": [
"end"
]
},
"action": {
"name": "connection",
"outcome": "success",
"outcome_reason": "Connection closed by invalid user pi 1.2.3.4 port 42608 [preauth]",
"target": "user",
"type": "close"
},
"observer": {
"product": "openssh",
"type": "server",
"vendor": "openbsd project"
},
"process": {
"name": "sshd"
},
"related": {
"ip": [
"1.2.3.4"
],
"user": [
"pi"
]
},
"source": {
"address": "1.2.3.4",
"ip": "1.2.3.4",
"port": 42608,
"user": {
"name": "pi"
}
},
"user": {
"name": "pi"
}
}
{
"message": " Connection reset by 1.2.3.4 port 45611 [preauth]",
"event": {
"category": [
"network"
],
"kind": "event",
"outcome": "success",
"type": [
"end"
]
},
"action": {
"name": "connection",
"outcome": "success",
"outcome_reason": "reset",
"target": "user",
"type": "close"
},
"observer": {
"product": "openssh",
"type": "server",
"vendor": "openbsd project"
},
"process": {
"name": "sshd"
},
"related": {
"ip": [
"1.2.3.4"
]
},
"source": {
"address": "1.2.3.4",
"ip": "1.2.3.4",
"port": 45611
}
}
{
"message": "Mar 11 11:26:54 foobar sshd[3296336]: Received disconnect from 1.1.1.1 port 33980:11: Bye Bye",
"event": {
"category": [
"network"
],
"kind": "event",
"outcome": "success",
"type": [
"end"
]
},
"action": {
"name": "connection",
"outcome": "success",
"outcome_reason": "Bye Bye",
"target": "user",
"type": "close"
},
"observer": {
"product": "openssh",
"type": "server",
"vendor": "openbsd project"
},
"process": {
"name": "sshd"
},
"related": {
"ip": [
"1.1.1.1"
]
},
"source": {
"address": "1.1.1.1",
"ip": "1.1.1.1",
"port": 33980
}
}
{
"message": " Disconnected from 1.2.3.4 port 39906 [preauth]",
"event": {
"category": [
"network"
],
"kind": "event",
"outcome": "success",
"type": [
"end"
]
},
"action": {
"name": "connection",
"outcome": "success",
"outcome_reason": "Disconnected from 1.2.3.4 port 39906 [preauth]",
"target": "user",
"type": "close"
},
"observer": {
"product": "openssh",
"type": "server",
"vendor": "openbsd project"
},
"process": {
"name": "sshd"
},
"related": {
"ip": [
"1.2.3.4"
]
},
"source": {
"address": "1.2.3.4",
"ip": "1.2.3.4",
"port": 39906
}
}
{
"message": " Disconnected from authenticating user backup 1.2.3.4 port 49424 [preauth]",
"event": {
"category": [
"network"
],
"kind": "event",
"outcome": "success",
"type": [
"end"
]
},
"action": {
"name": "connection",
"outcome": "success",
"outcome_reason": "Disconnected from authenticating user backup 1.2.3.4 port 49424 [preauth]",
"target": "user",
"type": "close"
},
"observer": {
"product": "openssh",
"type": "server",
"vendor": "openbsd project"
},
"process": {
"name": "sshd"
},
"related": {
"ip": [
"1.2.3.4"
],
"user": [
"backup"
]
},
"source": {
"address": "1.2.3.4",
"ip": "1.2.3.4",
"port": 49424,
"user": {
"name": "backup"
}
},
"user": {
"name": "backup"
}
}
{
"message": " Disconnected from illegal user default 1.2.3.4 port 48792 [preauth]",
"event": {
"category": [
"network"
],
"kind": "event",
"outcome": "success",
"type": [
"end"
]
},
"action": {
"name": "connection",
"outcome": "success",
"outcome_reason": "Disconnected from illegal user default 1.2.3.4 port 48792 [preauth]",
"target": "user",
"type": "close"
},
"observer": {
"product": "openssh",
"type": "server",
"vendor": "openbsd project"
},
"process": {
"name": "sshd"
},
"related": {
"ip": [
"1.2.3.4"
],
"user": [
"default"
]
},
"source": {
"address": "1.2.3.4",
"ip": "1.2.3.4",
"port": 48792,
"user": {
"name": "default"
}
},
"user": {
"name": "default"
}
}
{
"message": " Disconnected from user ubuntu 1.2.3.4 port 44708",
"event": {
"category": [
"network"
],
"kind": "event",
"outcome": "success",
"type": [
"end"
]
},
"action": {
"name": "connection",
"outcome": "success",
"outcome_reason": "Disconnected from user ubuntu 1.2.3.4 port 44708",
"target": "user",
"type": "close"
},
"observer": {
"product": "openssh",
"type": "server",
"vendor": "openbsd project"
},
"process": {
"name": "sshd"
},
"related": {
"ip": [
"1.2.3.4"
],
"user": [
"ubuntu"
]
},
"source": {
"address": "1.2.3.4",
"ip": "1.2.3.4",
"port": 44708,
"user": {
"name": "ubuntu"
}
},
"user": {
"name": "ubuntu"
}
}
{
"message": " Failed password for backup from 1.2.3.4 port 60150 ssh2",
"event": {
"category": [
"authentication"
],
"kind": "event",
"outcome": "failure",
"type": [
"end"
]
},
"action": {
"name": "connection",
"outcome": "failure",
"outcome_reason": "Failed password",
"target": "user",
"type": "open"
},
"observer": {
"product": "openssh",
"type": "server",
"vendor": "openbsd project"
},
"process": {
"name": "sshd"
},
"related": {
"ip": [
"1.2.3.4"
],
"user": [
"backup"
]
},
"source": {
"address": "1.2.3.4",
"ip": "1.2.3.4",
"port": 60150,
"user": {
"name": "backup"
}
},
"user": {
"name": "backup"
}
}
{
"message": " Invalid user jdoe from ssh.example.org port 48792",
"event": {
"category": [
"authentication"
],
"kind": "event",
"outcome": "failure",
"type": [
"end"
]
},
"action": {
"name": "connection",
"outcome": "failure",
"outcome_reason": "Invalid user jdoe from ssh.example.org port 48792",
"target": "user",
"type": "open"
},
"observer": {
"product": "openssh",
"type": "server",
"vendor": "openbsd project"
},
"process": {
"name": "sshd"
},
"related": {
"hosts": [
"ssh.example.org"
],
"user": [
"jdoe"
]
},
"source": {
"address": "ssh.example.org",
"domain": "ssh.example.org",
"port": 48792,
"registered_domain": "example.org",
"subdomain": "ssh",
"top_level_domain": "org",
"user": {
"name": "jdoe"
}
},
"user": {
"name": "jdoe"
}
}
{
"message": " input_userauth_request: invalid user jdoe [preauth]",
"event": {
"category": [
"authentication"
],
"kind": "event",
"outcome": "failure",
"type": [
"end"
]
},
"action": {
"name": "connection",
"outcome": "failure",
"outcome_reason": "invalid user",
"target": "user",
"type": "open"
},
"observer": {
"product": "openssh",
"type": "server",
"vendor": "openbsd project"
},
"process": {
"name": "sshd"
},
"related": {
"user": [
"jdoe"
]
},
"source": {
"user": {
"name": "jdoe"
}
},
"user": {
"name": "jdoe"
}
}
{
"message": " error: kex_exchange_identification: Connection closed by remote host",
"event": {
"category": [
"session"
],
"kind": "event",
"outcome": "failure",
"type": [
"end"
]
},
"action": {
"name": "connection",
"outcome": "failure",
"outcome_reason": "Connection closed by remote host",
"target": "user",
"type": "open"
},
"observer": {
"product": "openssh",
"type": "server",
"vendor": "openbsd project"
},
"process": {
"name": "sshd"
}
}
{
"message": " Did not receive identification string from 1.2.3.4 port 50622",
"event": {
"category": [
"session"
],
"kind": "event",
"outcome": "failure",
"type": [
"end"
]
},
"action": {
"name": "connection",
"outcome": "failure",
"outcome_reason": "Did not receive identification string",
"target": "user",
"type": "open"
},
"observer": {
"product": "openssh",
"type": "server",
"vendor": "openbsd project"
},
"process": {
"name": "sshd"
},
"related": {
"ip": [
"1.2.3.4"
]
},
"source": {
"address": "1.2.3.4",
"ip": "1.2.3.4",
"port": 50622
}
}
{
"message": " pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=1.2.3.4",
"event": {
"category": [
"authentication"
],
"kind": "event",
"outcome": "failure",
"type": [
"end"
]
},
"action": {
"name": "sshd:auth",
"outcome": "failure",
"outcome_reason": "pam_unix(sshd:auth): authentication failure;",
"target": "user",
"type": "authentication"
},
"observer": {
"product": "openssh",
"type": "server",
"vendor": "openbsd project"
},
"process": {
"name": "sshd"
},
"related": {
"ip": [
"1.2.3.4"
]
},
"source": {
"address": "1.2.3.4",
"ip": "1.2.3.4"
}
}
{
"message": " pam_unix(sshd:auth): check pass; user unknown",
"event": {
"category": [
"authentication"
],
"kind": "event",
"outcome": "success",
"type": [
"start"
]
},
"action": {
"name": "sshd:auth",
"outcome": "success",
"outcome_reason": "pam_unix(sshd:auth): check pass; user unknown",
"target": "user",
"type": "check"
},
"observer": {
"product": "openssh",
"type": "server",
"vendor": "openbsd project"
},
"process": {
"name": "sshd"
},
"related": {
"user": [
"unknown"
]
},
"source": {
"user": {
"name": "unknown"
}
},
"user": {
"name": "unknown"
}
}
{
"message": "PAM 2 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=1.2.3.4 user=root",
"event": {
"category": [
"authentication"
],
"kind": "event",
"outcome": "failure",
"type": [
"end"
]
},
"action": {
"name": "sshd:auth",
"outcome": "failure",
"outcome_reason": "PAM 2 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=1.2.3.4 user=root",
"target": "user",
"type": "authentication"
},
"observer": {
"product": "openssh",
"type": "server",
"vendor": "openbsd project"
},
"process": {
"name": "sshd"
},
"related": {
"ip": [
"1.2.3.4"
],
"user": [
"root"
]
},
"source": {
"address": "1.2.3.4",
"ip": "1.2.3.4",
"user": {
"name": "root"
}
},
"user": {
"euid": "0",
"id": "0",
"name": "root"
}
}
{
"message": " pam_unix(sshd:session): session closed for user ubuntu",
"event": {
"category": [
"session"
],
"kind": "event",
"outcome": "success",
"type": [
"end"
]
},
"action": {
"name": "sshd:session",
"outcome": "success",
"outcome_reason": "pam_unix(sshd:session): session closed for user ubuntu",
"target": "user",
"type": "close"
},
"observer": {
"product": "openssh",
"type": "server",
"vendor": "openbsd project"
},
"process": {
"name": "sshd"
},
"related": {
"user": [
"ubuntu"
]
},
"source": {
"user": {
"name": "ubuntu"
}
},
"user": {
"name": "ubuntu"
}
}
{
"message": " pam_unix(sshd:session): session opened for user ubuntu by (uid=0)",
"event": {
"category": [
"session"
],
"kind": "event",
"outcome": "success",
"type": [
"start"
]
},
"action": {
"name": "sshd:session",
"outcome": "success",
"outcome_reason": "pam_unix(sshd:session): session opened for user ubuntu by (uid=0)",
"target": "user",
"type": "open"
},
"observer": {
"product": "openssh",
"type": "server",
"vendor": "openbsd project"
},
"process": {
"name": "sshd"
},
"related": {
"user": [
"ubuntu"
]
},
"source": {
"user": {
"name": "ubuntu"
}
},
"user": {
"name": "ubuntu"
}
}
{
"message": " Received disconnect from 1.2.3.4 port 39906:11: Bye Bye [preauth]",
"event": {
"category": [
"network"
],
"kind": "event",
"outcome": "success",
"type": [
"end"
]
},
"action": {
"name": "connection",
"outcome": "success",
"outcome_reason": "Bye Bye",
"target": "user",
"type": "close"
},
"observer": {
"product": "openssh",
"type": "server",
"vendor": "openbsd project"
},
"process": {
"name": "sshd"
},
"related": {
"ip": [
"1.2.3.4"
]
},
"source": {
"address": "1.2.3.4",
"ip": "1.2.3.4",
"port": 39906
}
}
{
"message": " Received disconnect from 1.2.3.4 port 16899:11: [preauth]",
"event": {
"category": [
"network"
],
"kind": "event",
"outcome": "success",
"type": [
"end"
]
},
"action": {
"name": "connection",
"outcome": "success",
"outcome_reason": "Received disconnect from 1.2.3.4 port 16899:11: [preauth]",
"target": "user",
"type": "close"
},
"observer": {
"product": "openssh",
"type": "server",
"vendor": "openbsd project"
},
"process": {
"name": "sshd"
},
"related": {
"ip": [
"1.2.3.4"
]
},
"source": {
"address": "1.2.3.4",
"ip": "1.2.3.4",
"port": 16899
}
}
{
"message": " Received disconnect from 1.2.3.4 port 36958:11: Normal Shutdown, Thank you for playing [preauth]",
"event": {
"category": [
"network"
],
"kind": "event",
"outcome": "success",
"type": [
"end"
]
},
"action": {
"name": "connection",
"outcome": "success",
"outcome_reason": "Normal Shutdown, Thank you for playing",
"target": "user",
"type": "close"
},
"observer": {
"product": "openssh",
"type": "server",
"vendor": "openbsd project"
},
"process": {
"name": "sshd"
},
"related": {
"ip": [
"1.2.3.4"
]
},
"source": {
"address": "1.2.3.4",
"ip": "1.2.3.4",
"port": 36958
}
}
{
"message": " Received disconnect from 1.2.3.4 port 44708:11: disconnected by user",
"event": {
"category": [
"network"
],
"kind": "event",
"outcome": "success",
"type": [
"end"
]
},
"action": {
"name": "connection",
"outcome": "success",
"outcome_reason": "disconnected by user",
"target": "user",
"type": "close"
},
"observer": {
"product": "openssh",
"type": "server",
"vendor": "openbsd project"
},
"process": {
"name": "sshd"
},
"related": {
"ip": [
"1.2.3.4"
]
},
"source": {
"address": "1.2.3.4",
"ip": "1.2.3.4",
"port": 44708
}
}
{
"message": " Unable to negotiate with 1.2.3.4 port 27824: no matching cipher found. Their offer: aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,arcfour128,arcfour,3des-cbc,none [preauth]",
"event": {
"category": [
"session"
],
"kind": "event",
"outcome": "failure",
"type": [
"end"
]
},
"action": {
"name": "negotiate",
"outcome": "failure",
"outcome_reason": "Unable to negotiate with 1.2.3.4 port 27824: no matching cipher found. Their offer: aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,arcfour128,arcfour,3des-cbc,none [preauth]",
"target": "user",
"type": "open"
},
"observer": {
"product": "openssh",
"type": "server",
"vendor": "openbsd project"
},
"process": {
"name": "sshd"
},
"related": {
"ip": [
"1.2.3.4"
]
},
"source": {
"address": "1.2.3.4",
"ip": "1.2.3.4",
"port": 27824
}
}
{
"message": " User root from 1.2.3.4 not allowed because not listed in AllowUsers",
"event": {
"category": [
"authentication"
],
"kind": "event",
"outcome": "failure",
"type": [
"end"
]
},
"action": {
"name": "connection",
"outcome": "failure",
"outcome_reason": "not allowed because not listed in AllowUsers",
"target": "user",
"type": "open"
},
"observer": {
"product": "openssh",
"type": "server",
"vendor": "openbsd project"
},
"process": {
"name": "sshd"
},
"related": {
"ip": [
"1.2.3.4"
],
"user": [
"root"
]
},
"source": {
"address": "1.2.3.4",
"ip": "1.2.3.4",
"user": {
"name": "root"
}
},
"user": {
"name": "root"
}
}
Extracted Fields
The following table lists the fields that are extracted, normalized under the ECS format, analyzed and indexed by the parser. It should be noted that infered fields are not listed.
Name | Type | Description |
---|---|---|
action.target |
keyword |
|
event.category |
keyword |
Event category. The second categorization field in the hierarchy. |
event.kind |
keyword |
The kind of the event. The highest categorization field in the hierarchy. |
event.outcome |
keyword |
The outcome of the event. The lowest level categorization field in the hierarchy. |
event.type |
keyword |
Event type. The third categorization field in the hierarchy. |
file.hash.sha256 |
keyword |
SHA256 hash. |
observer.product |
keyword |
The product name of the observer. |
observer.type |
keyword |
The type of the observer the data is coming from. |
observer.vendor |
keyword |
Vendor name of the observer. |
openssh.auth.method |
keyword |
|
process.name |
keyword |
Process name. |
source.domain |
keyword |
The domain name of the source. |
source.ip |
ip |
IP address of the source. |
source.port |
long |
Port of the source. |
source.user.name |
keyword |
Short name or login of the user. |
user.euid |
keyword |
|
user.id |
keyword |
Unique identifier of the user. |
user.name |
keyword |
Short name or login of the user. |
Configure
As of now, the main solution to collect OpenSSH logs leverages the Rsyslog recipe. Please share your experiences with other recipes by editing this documentation.
Rsyslog
Please refer to the documentation of OpenSSH to forward events to your rsyslog server. The reader can consult the Rsyslog Transport documentation to forward these logs to Sekoia.io.