OpenSSH
Overview
OpenSSH is the premier connectivity tool for remote login with the SSH protocol. It encrypts all traffic to eliminate eavesdropping, connection hijacking, and other attacks. In addition, OpenSSH provides a large suite of secure tunneling capabilities, several authentication methods, and sophisticated configuration options.
Related Built-in Rules
The following Sekoia.io built-in rules match the intake OpenSSH. This documentation is updated automatically and is based solely on the fields used by the intake which are checked against our rules. This means that some rules will be listed but might not be relevant with the intake.
SEKOIA.IO x OpenSSH on ATT&CK Navigator
Active Directory Data Export Using Csvde
Detects the use of Csvde, a command-line tool from Windows Server that can be used to export Active Directory data to CSV files. This export doesn't include password hashes, but can be used as a discovery tool to enumerate users, machines and group memberships.
- Effort: elementary
AdFind Usage
Detects the usage of the AdFind tool. AdFind.exe is a free tool that extracts information from Active Directory. Wizard Spider (Bazar, TrickBot, Ryuk), FIN6 and MAZE operators have used AdFind.exe to collect information about Active Directory organizational units and trust objects
- Effort: elementary
Adexplorer Usage
Detects the usage of Adexplorer, a legitimate tool from the Sysinternals suite that could be abused by attackers as it can saves snapshots of the Active Directory Database.
- Effort: advanced
Aspnet Compiler
Detects the starts of aspnet compiler.
- Effort: advanced
Certificate Authority Modification
Installation of new certificate(s) in the Certificate Authority can be used to trick user when spoofing website or to add trusted destinations.
- Effort: master
Cryptomining
Detection of domain names potentially related to cryptomining activities.
- Effort: master
DNS Query For Iplookup
Detects dns query of observables tagged as iplookup.
- Effort: master
Dynamic DNS Contacted
Detect communication with dynamic dns domain. This kind of domain is often used by attackers. This rule can trigger false positive in non-controlled environment because dynamic dns is not always malicious.
- Effort: master
Exfiltration And Tunneling Tools Execution
Execution of well known tools for data exfiltration and tunneling
- Effort: advanced
Exfiltration Domain
Detects traffic toward a domain flagged as a possible exfiltration vector.
- Effort: master
Kernel Module Alteration
Kernel module installation can be used to configure system settings to automatically execute a program during system boot or logon to maintain persistence or gain higher-level privileges on compromised systems.
- Effort: advanced
Network Scanning and Discovery
Tools and command lines used for network discovery from current system
- Effort: advanced
Network Sniffing
List of common tools used for network packages sniffing
- Effort: advanced
Network Sniffing Windows
Network sniffing refers to using the network interface on a system to monitor or capture information sent over a wired or wireless connection. An adversary may place a network interface into promiscuous mode to passively access data in transit over the network, or use span ports to capture a larger amount of data.
- Effort: intermediate
PasswordDump SecurityXploded Tool
Detects the execution of the PasswordDump SecurityXploded Tool
- Effort: elementary
PsExec Process
Detects PsExec execution, command line which contains pstools or installation of the PsExec service. PsExec is a SysInternals which can be used to execute a program on another computer. The tool is as much used by attackers as by administrators.
- Effort: advanced
RDP Session Discovery
Detects use of RDP session discovery via qwinsta or quser. Used by some threat actors to know if someone is working via RDP on a server.
- Effort: advanced
Remote Access Tool Domain
Detects traffic toward a domain flagged as a Remote Administration Tool (RAT).
- Effort: master
Remote Monitoring and Management Software - AnyDesk
Detect artifacts related to the installation or execution of the Remote Monitoring and Management tool AnyDesk.
- Effort: master
Remote Monitoring and Management Software - Atera
Detect artifacts related to the installation or execution of the Remote Monitoring and Management tool Atera.
- Effort: master
SEKOIA.IO Intelligence Feed
Detect threats based on indicators of compromise (IOCs) collected by SEKOIA's Threat and Detection Research team.
- Effort: elementary
Sekoia.io EICAR Detection
Detects observables in Sekoia.io CTI tagged as EICAR, which are fake samples meant to test detection.
- Effort: master
Suspicious Double Extension
Detects suspicious use of an .exe extension after a non-executable file extension like .pdf.exe, a set of spaces or underlines to cloak the executable file in spearphishing campaigns
- Effort: advanced
System Info Discovery
System info discovery, attempt to detects basic command use to fingerprint a host.
- Effort: master
TOR Usage Generic Rule
Detects TOR usage globally, whether the IP is a destination or source. TOR is short for The Onion Router, and it gets its name from how it works. TOR intercepts the network traffic from one or more apps on user’s computer, usually the user web browser, and shuffles it through a number of randomly-chosen computers before passing it on to its destination. This disguises user location, and makes it harder for servers to pick him/her out on repeat visits, or to tie together separate visits to different sites, this making tracking and surveillance more difficult. Before a network packet starts its journey, user’s computer chooses a random list of relays and repeatedly encrypts the data in multiple layers, like an onion. Each relay knows only enough to strip off the outermost layer of encryption, before passing what’s left on to the next relay in the list.
- Effort: master
WMI Persistence Command Line Event Consumer
Detects WMI command line event consumers.
- Effort: elementary
Event Categories
The following table lists the data source offered by this integration.
| Data Source | Description |
|---|---|
Authentication logs |
Several SSH authentication methods are supported |
In details, the following table denotes the type of events produced by this integration.
| Name | Values |
|---|---|
| Kind | `` |
| Category | authentication, configuration, library, network, session |
| Type | end, info, protocol, start |
Event Samples
Find below few samples of events and how they are normalized by Sekoia.io.
{
"message": " Accepted google_authenticator for root",
"event": {
"category": [
"authentication"
],
"outcome": "success",
"type": [
"start"
]
},
"action": {
"name": "session",
"outcome": "success",
"outcome_reason": "Accepted google_authenticator for root",
"target": "user",
"type": "open"
},
"observer": {
"product": "openssh",
"type": "server",
"vendor": "openbsd project"
},
"openssh": {
"auth": {
"method": "google_authenticator"
}
},
"process": {
"name": "sshd"
},
"related": {
"user": [
"root"
]
},
"source": {
"user": {
"name": "root"
}
},
"user": {
"name": "root"
}
}
{
"message": " Accepted gssapi-with-mic for ubuntu from 1.2.3.4 port 51826 ssh2",
"event": {
"category": [
"authentication"
],
"outcome": "success",
"type": [
"start"
]
},
"action": {
"name": "session",
"outcome": "success",
"outcome_reason": "Accepted gssapi-with-mic for ubuntu from 1.2.3.4 port 51826 ssh2",
"target": "user",
"type": "open"
},
"observer": {
"product": "openssh",
"type": "server",
"vendor": "openbsd project"
},
"openssh": {
"auth": {
"method": "gssapi-with-mic"
}
},
"process": {
"name": "sshd"
},
"related": {
"ip": [
"1.2.3.4"
],
"user": [
"ubuntu"
]
},
"source": {
"address": "1.2.3.4",
"ip": "1.2.3.4",
"port": 51826,
"user": {
"name": "ubuntu"
}
},
"user": {
"name": "ubuntu"
}
}
{
"message": " Accepted password for ubuntu from 1.2.3.4 port 51826 ssh2",
"event": {
"category": [
"authentication"
],
"outcome": "success",
"type": [
"start"
]
},
"action": {
"name": "session",
"outcome": "success",
"outcome_reason": "Accepted password for ubuntu from 1.2.3.4 port 51826 ssh2",
"target": "user",
"type": "open"
},
"observer": {
"product": "openssh",
"type": "server",
"vendor": "openbsd project"
},
"openssh": {
"auth": {
"method": "password"
}
},
"process": {
"name": "sshd"
},
"related": {
"ip": [
"1.2.3.4"
],
"user": [
"ubuntu"
]
},
"source": {
"address": "1.2.3.4",
"ip": "1.2.3.4",
"port": 51826,
"user": {
"name": "ubuntu"
}
},
"user": {
"name": "ubuntu"
}
}
{
"message": " Accepted publickey for ubuntu from 1.2.3.4 port 51826 ssh2: RSA SHA256:AbpHGcgLb+kRsJGnwFEktk7uzpZOCcBY74+YBdrKVGs=",
"event": {
"category": [
"authentication"
],
"outcome": "success",
"type": [
"start"
]
},
"action": {
"name": "session",
"outcome": "success",
"outcome_reason": "Accepted publickey for ubuntu from 1.2.3.4 port 51826 ssh2: RSA SHA256:AbpHGcgLb+kRsJGnwFEktk7uzpZOCcBY74+YBdrKVGs=",
"target": "user",
"type": "open"
},
"file": {
"hash": {
"sha256": "AbpHGcgLb+kRsJGnwFEktk7uzpZOCcBY74+YBdrKVGs="
}
},
"observer": {
"product": "openssh",
"type": "server",
"vendor": "openbsd project"
},
"openssh": {
"auth": {
"method": "publickey"
}
},
"process": {
"name": "sshd"
},
"related": {
"hash": [
"AbpHGcgLb+kRsJGnwFEktk7uzpZOCcBY74+YBdrKVGs="
],
"ip": [
"1.2.3.4"
],
"user": [
"ubuntu"
]
},
"source": {
"address": "1.2.3.4",
"ip": "1.2.3.4",
"port": 51826,
"user": {
"name": "ubuntu"
}
},
"user": {
"name": "ubuntu"
}
}
{
"message": " Accepted publickey for jdoe@example.local from 1.2.3.4 port 59294 ssh2: ED25519 SHA256:AbpHGcgLb+kRsJGnwFEktk7uzpZOCcBY74+YBdrKVGs=",
"event": {
"category": [
"authentication"
],
"outcome": "success",
"type": [
"start"
]
},
"action": {
"name": "session",
"outcome": "success",
"outcome_reason": "Accepted publickey for jdoe@example.local from 1.2.3.4 port 59294 ssh2: ED25519 SHA256:AbpHGcgLb+kRsJGnwFEktk7uzpZOCcBY74+YBdrKVGs=",
"target": "user",
"type": "open"
},
"file": {
"hash": {
"sha256": "AbpHGcgLb+kRsJGnwFEktk7uzpZOCcBY74+YBdrKVGs="
}
},
"observer": {
"product": "openssh",
"type": "server",
"vendor": "openbsd project"
},
"openssh": {
"auth": {
"method": "publickey"
}
},
"process": {
"name": "sshd"
},
"related": {
"hash": [
"AbpHGcgLb+kRsJGnwFEktk7uzpZOCcBY74+YBdrKVGs="
],
"hosts": [
"example.local"
],
"ip": [
"1.2.3.4"
],
"user": [
"jdoe"
]
},
"source": {
"address": "example.local",
"domain": "example.local",
"ip": "1.2.3.4",
"port": 59294,
"subdomain": "example",
"user": {
"name": "jdoe"
}
},
"user": {
"name": "jdoe"
}
}
{
"message": " Accepted key RSA SHA256:3cOMdwjvSk5BnU2zs6397YpKn/SNSVSAMtsQchY8dOo found at /home/star/.ssh/authorized_keys:2",
"event": {
"category": [
"authentication"
],
"outcome": "success",
"type": [
"start"
]
},
"action": {
"name": "session",
"outcome": "success",
"outcome_reason": "Accepted key RSA SHA256:3cOMdwjvSk5BnU2zs6397YpKn/SNSVSAMtsQchY8dOo found at /home/star/.ssh/authorized_keys:2",
"target": "user",
"type": "open"
},
"observer": {
"product": "openssh",
"type": "server",
"vendor": "openbsd project"
},
"process": {
"name": "sshd"
}
}
{
"message": " Accepted key RSA SHA256:3cOMdwjvSk5BnU2zs6397YpKn/SNSVSAMtsQchY8dOo found at /usr/local/nagios/.ssh/authorized_keys:1",
"event": {
"category": [
"authentication"
],
"outcome": "success",
"type": [
"start"
]
},
"action": {
"name": "session",
"outcome": "success",
"outcome_reason": "Accepted key RSA SHA256:3cOMdwjvSk5BnU2zs6397YpKn/SNSVSAMtsQchY8dOo found at /usr/local/nagios/.ssh/authorized_keys:1",
"target": "user",
"type": "open"
},
"observer": {
"product": "openssh",
"type": "server",
"vendor": "openbsd project"
},
"process": {
"name": "sshd"
}
}
{
"message": "main: sshd: ssh-rsa algorithm is disabled",
"event": {
"category": [
"configuration"
],
"outcome": "success",
"type": [
"info"
]
},
"action": {
"outcome_reason": "main: sshd: ssh-rsa algorithm is disabled"
},
"observer": {
"product": "openssh",
"type": "server",
"vendor": "openbsd project"
},
"process": {
"name": "sshd"
}
}
{
"message": " error: maximum authentication attempts exceeded for invalid user support from ssh.example.org port 51219 ssh2 [preauth]",
"event": {
"category": [
"session"
],
"outcome": "failure",
"type": [
"end"
]
},
"action": {
"name": "connection",
"outcome": "failure",
"outcome_reason": "maximum authentication attempts exceeded",
"target": "user",
"type": "open"
},
"observer": {
"product": "openssh",
"type": "server",
"vendor": "openbsd project"
},
"process": {
"name": "sshd"
},
"related": {
"hosts": [
"ssh.example.org"
],
"user": [
"support"
]
},
"source": {
"address": "ssh.example.org",
"domain": "ssh.example.org",
"port": 51219,
"registered_domain": "example.org",
"subdomain": "ssh",
"top_level_domain": "org",
"user": {
"name": "support"
}
},
"user": {
"name": "support"
}
}
{
"message": " error: maximum authentication attempts exceeded for root from 1.2.3.4 port 63758 ssh2 [preauth]",
"event": {
"category": [
"session"
],
"outcome": "failure",
"type": [
"end"
]
},
"action": {
"name": "connection",
"outcome": "failure",
"outcome_reason": "maximum authentication attempts exceeded",
"target": "user",
"type": "open"
},
"observer": {
"product": "openssh",
"type": "server",
"vendor": "openbsd project"
},
"process": {
"name": "sshd"
},
"related": {
"ip": [
"1.2.3.4"
],
"user": [
"root"
]
},
"source": {
"address": "1.2.3.4",
"ip": "1.2.3.4",
"port": 63758,
"user": {
"name": "root"
}
},
"user": {
"name": "root"
}
}
{
"message": " Disconnecting invalid user support 1.2.3.4 port 51219: Too many authentication failures [preauth]",
"event": {
"category": [
"authentication"
],
"outcome": "failure",
"type": [
"end"
]
},
"action": {
"name": "connection",
"outcome": "failure",
"outcome_reason": "Disconnecting",
"target": "user",
"type": "open"
},
"observer": {
"product": "openssh",
"type": "server",
"vendor": "openbsd project"
},
"process": {
"name": "sshd"
},
"related": {
"ip": [
"1.2.3.4"
],
"user": [
"support"
]
},
"source": {
"address": "1.2.3.4",
"ip": "1.2.3.4",
"port": 51219,
"user": {
"name": "support"
}
},
"user": {
"name": "support"
}
}
{
"message": " Bad protocol version identification '\\003' from 1.2.3.4 port 407",
"event": {
"category": [
"network"
],
"outcome": "failure",
"type": [
"protocol"
]
},
"action": {
"name": "negotiate",
"outcome": "failure",
"outcome_reason": "Bad protocol version",
"target": "user",
"type": "open"
},
"observer": {
"product": "openssh",
"type": "server",
"vendor": "openbsd project"
},
"process": {
"name": "sshd"
},
"related": {
"ip": [
"1.2.3.4"
]
},
"source": {
"address": "1.2.3.4",
"ip": "1.2.3.4",
"port": 407
}
}
{
"message": " Connection closed by 1.2.3.4 port 51488 [preauth]",
"event": {
"category": [
"network"
],
"outcome": "success",
"type": [
"end"
]
},
"action": {
"name": "connection",
"outcome": "success",
"outcome_reason": "Connection closed by 1.2.3.4 port 51488 [preauth]",
"target": "user",
"type": "close"
},
"observer": {
"product": "openssh",
"type": "server",
"vendor": "openbsd project"
},
"process": {
"name": "sshd"
},
"related": {
"ip": [
"1.2.3.4"
]
},
"source": {
"address": "1.2.3.4",
"ip": "1.2.3.4",
"port": 51488
}
}
{
"message": " Connection closed by 127.0.0.1",
"event": {
"category": [
"network"
],
"outcome": "success",
"type": [
"end"
]
},
"action": {
"name": "connection",
"outcome": "success",
"outcome_reason": "Connection closed by 127.0.0.1",
"target": "user",
"type": "close"
},
"observer": {
"product": "openssh",
"type": "server",
"vendor": "openbsd project"
},
"process": {
"name": "sshd"
},
"related": {
"ip": [
"127.0.0.1"
]
},
"source": {
"address": "127.0.0.1",
"ip": "127.0.0.1"
}
}
{
"message": " Connection closed by authenticating user backup 1.2.3.4 port 49424 [preauth]",
"event": {
"category": [
"network"
],
"outcome": "success",
"type": [
"end"
]
},
"action": {
"name": "connection",
"outcome": "success",
"outcome_reason": "Connection closed by authenticating user backup 1.2.3.4 port 49424 [preauth]",
"target": "user",
"type": "close"
},
"observer": {
"product": "openssh",
"type": "server",
"vendor": "openbsd project"
},
"process": {
"name": "sshd"
},
"related": {
"ip": [
"1.2.3.4"
],
"user": [
"backup"
]
},
"source": {
"address": "1.2.3.4",
"ip": "1.2.3.4",
"port": 49424,
"user": {
"name": "backup"
}
},
"user": {
"name": "backup"
}
}
{
"message": " Connection closed by illegal user default 1.2.3.4 port 49424 [preauth]",
"event": {
"category": [
"network"
],
"outcome": "success",
"type": [
"end"
]
},
"action": {
"name": "connection",
"outcome": "success",
"outcome_reason": "Connection closed by illegal user default 1.2.3.4 port 49424 [preauth]",
"target": "user",
"type": "close"
},
"observer": {
"product": "openssh",
"type": "server",
"vendor": "openbsd project"
},
"process": {
"name": "sshd"
},
"related": {
"ip": [
"1.2.3.4"
],
"user": [
"default"
]
},
"source": {
"address": "1.2.3.4",
"ip": "1.2.3.4",
"port": 49424,
"user": {
"name": "default"
}
},
"user": {
"name": "default"
}
}
{
"message": " Connection closed by invalid user pi 1.2.3.4 port 42608 [preauth]",
"event": {
"category": [
"network"
],
"outcome": "success",
"type": [
"end"
]
},
"action": {
"name": "connection",
"outcome": "success",
"outcome_reason": "Connection closed by invalid user pi 1.2.3.4 port 42608 [preauth]",
"target": "user",
"type": "close"
},
"observer": {
"product": "openssh",
"type": "server",
"vendor": "openbsd project"
},
"process": {
"name": "sshd"
},
"related": {
"ip": [
"1.2.3.4"
],
"user": [
"pi"
]
},
"source": {
"address": "1.2.3.4",
"ip": "1.2.3.4",
"port": 42608,
"user": {
"name": "pi"
}
},
"user": {
"name": "pi"
}
}
{
"message": " Connection closed by invalid user 1.2.3.4 port 36797 [preauth]",
"event": {
"category": [
"network"
],
"outcome": "success",
"type": [
"end"
]
},
"action": {
"name": "connection",
"outcome": "success",
"outcome_reason": "Connection closed by invalid user 1.2.3.4 port 36797 [preauth]",
"target": "user",
"type": "close"
},
"observer": {
"product": "openssh",
"type": "server",
"vendor": "openbsd project"
},
"process": {
"name": "sshd"
},
"related": {
"ip": [
"1.2.3.4"
]
},
"source": {
"address": "1.2.3.4",
"ip": "1.2.3.4",
"port": 36797
}
}
{
"message": " ssh_dispatch_run_fatal: Connection from 1.2.3.4 port 49065: Connection corrupted [preauth]",
"event": {
"category": [
"network"
],
"outcome": "failure",
"type": [
"protocol"
]
},
"action": {
"name": "negotiate",
"outcome": "failure",
"outcome_reason": "ssh_dispatch_run_fatal:",
"target": "user",
"type": "open"
},
"observer": {
"product": "openssh",
"type": "server",
"vendor": "openbsd project"
},
"process": {
"name": "sshd"
},
"related": {
"ip": [
"1.2.3.4"
]
},
"source": {
"address": "1.2.3.4",
"ip": "1.2.3.4",
"port": 49065
}
}
{
"message": " Connection from 127.0.0.1 port 58752 on 127.0.0.1 port 22",
"event": {
"category": [
"network"
],
"outcome": "success",
"type": [
"start"
]
},
"action": {
"name": "connection",
"outcome": "success",
"outcome_reason": "Connection from 127.0.0.1 port 58752 on 127.0.0.1 port 22",
"target": "user",
"type": "open"
},
"destination": {
"address": "127.0.0.1",
"ip": "127.0.0.1",
"port": 22
},
"observer": {
"product": "openssh",
"type": "server",
"vendor": "openbsd project"
},
"process": {
"name": "sshd"
},
"related": {
"ip": [
"127.0.0.1"
]
},
"source": {
"address": "127.0.0.1",
"ip": "127.0.0.1",
"port": 58752
}
}
{
"message": " Connection reset by 1.2.3.4 port 45611 [preauth]",
"event": {
"category": [
"network"
],
"outcome": "success",
"type": [
"end"
]
},
"action": {
"name": "connection",
"outcome": "success",
"outcome_reason": "reset",
"target": "user",
"type": "close"
},
"observer": {
"product": "openssh",
"type": "server",
"vendor": "openbsd project"
},
"process": {
"name": "sshd"
},
"related": {
"ip": [
"1.2.3.4"
]
},
"source": {
"address": "1.2.3.4",
"ip": "1.2.3.4",
"port": 45611
}
}
{
"message": "Mar 11 11:26:54 foobar sshd[3296336]: Received disconnect from 1.1.1.1 port 33980:11: Bye Bye",
"event": {
"category": [
"network"
],
"outcome": "success",
"type": [
"end"
]
},
"action": {
"name": "connection",
"outcome": "success",
"outcome_reason": "Bye Bye",
"target": "user",
"type": "close"
},
"observer": {
"product": "openssh",
"type": "server",
"vendor": "openbsd project"
},
"process": {
"name": "sshd"
},
"related": {
"ip": [
"1.1.1.1"
]
},
"source": {
"address": "1.1.1.1",
"ip": "1.1.1.1",
"port": 33980
}
}
{
"message": " Disconnected from 1.2.3.4 port 39906 [preauth]",
"event": {
"category": [
"network"
],
"outcome": "success",
"type": [
"end"
]
},
"action": {
"name": "connection",
"outcome": "success",
"outcome_reason": "Disconnected from 1.2.3.4 port 39906 [preauth]",
"target": "user",
"type": "close"
},
"observer": {
"product": "openssh",
"type": "server",
"vendor": "openbsd project"
},
"process": {
"name": "sshd"
},
"related": {
"ip": [
"1.2.3.4"
]
},
"source": {
"address": "1.2.3.4",
"ip": "1.2.3.4",
"port": 39906
}
}
{
"message": " Disconnected from authenticating user backup 1.2.3.4 port 49424 [preauth]",
"event": {
"category": [
"network"
],
"outcome": "success",
"type": [
"end"
]
},
"action": {
"name": "connection",
"outcome": "success",
"outcome_reason": "Disconnected from authenticating user backup 1.2.3.4 port 49424 [preauth]",
"target": "user",
"type": "close"
},
"observer": {
"product": "openssh",
"type": "server",
"vendor": "openbsd project"
},
"process": {
"name": "sshd"
},
"related": {
"ip": [
"1.2.3.4"
],
"user": [
"backup"
]
},
"source": {
"address": "1.2.3.4",
"ip": "1.2.3.4",
"port": 49424,
"user": {
"name": "backup"
}
},
"user": {
"name": "backup"
}
}
{
"message": " Disconnected from illegal user default 1.2.3.4 port 48792 [preauth]",
"event": {
"category": [
"network"
],
"outcome": "success",
"type": [
"end"
]
},
"action": {
"name": "connection",
"outcome": "success",
"outcome_reason": "Disconnected from illegal user default 1.2.3.4 port 48792 [preauth]",
"target": "user",
"type": "close"
},
"observer": {
"product": "openssh",
"type": "server",
"vendor": "openbsd project"
},
"process": {
"name": "sshd"
},
"related": {
"ip": [
"1.2.3.4"
],
"user": [
"default"
]
},
"source": {
"address": "1.2.3.4",
"ip": "1.2.3.4",
"port": 48792,
"user": {
"name": "default"
}
},
"user": {
"name": "default"
}
}
{
"message": " Disconnected from user ubuntu 1.2.3.4 port 44708",
"event": {
"category": [
"network"
],
"outcome": "success",
"type": [
"end"
]
},
"action": {
"name": "connection",
"outcome": "success",
"outcome_reason": "Disconnected from user ubuntu 1.2.3.4 port 44708",
"target": "user",
"type": "close"
},
"observer": {
"product": "openssh",
"type": "server",
"vendor": "openbsd project"
},
"process": {
"name": "sshd"
},
"related": {
"ip": [
"1.2.3.4"
],
"user": [
"ubuntu"
]
},
"source": {
"address": "1.2.3.4",
"ip": "1.2.3.4",
"port": 44708,
"user": {
"name": "ubuntu"
}
},
"user": {
"name": "ubuntu"
}
}
{
"message": " Disconnected from user jdoe@lexample.local 1.2.3.4 port 33480",
"event": {
"category": [
"network"
],
"outcome": "success",
"type": [
"end"
]
},
"action": {
"name": "connection",
"outcome": "success",
"outcome_reason": "Disconnected from user jdoe@lexample.local 1.2.3.4 port 33480",
"target": "user",
"type": "close"
},
"observer": {
"product": "openssh",
"type": "server",
"vendor": "openbsd project"
},
"process": {
"name": "sshd"
},
"related": {
"hosts": [
"lexample.local"
],
"ip": [
"1.2.3.4"
],
"user": [
"jdoe"
]
},
"source": {
"address": "lexample.local",
"domain": "lexample.local",
"ip": "1.2.3.4",
"port": 33480,
"subdomain": "lexample",
"user": {
"name": "jdoe"
}
},
"user": {
"name": "jdoe"
}
}
{
"message": "Failed none for invalid user guest from 1.2.3.4 port 15806 ssh2",
"event": {
"category": [
"authentication"
],
"outcome": "failure",
"type": [
"end"
]
},
"action": {
"name": "connection",
"outcome": "failure",
"outcome_reason": "Failed none",
"target": "user",
"type": "open"
},
"observer": {
"product": "openssh",
"type": "server",
"vendor": "openbsd project"
},
"process": {
"name": "sshd"
},
"related": {
"ip": [
"1.2.3.4"
],
"user": [
"guest"
]
},
"source": {
"address": "1.2.3.4",
"ip": "1.2.3.4",
"port": 15806,
"user": {
"name": "guest"
}
},
"user": {
"name": "guest"
}
}
{
"message": "fatal: userauth_finish: send failure packet: Broken pipe [preauth]",
"event": {
"category": [
"session"
],
"outcome": "failure",
"type": [
"end"
]
},
"action": {
"name": "connection",
"outcome": "failure",
"outcome_reason": "userauth_finish: send failure packet: Broken pipe [preauth]",
"target": "user",
"type": "open"
},
"observer": {
"product": "openssh",
"type": "server",
"vendor": "openbsd project"
},
"process": {
"name": "sshd"
}
}
{
"message": " Failed password for backup from 1.2.3.4 port 60150 ssh2",
"event": {
"category": [
"authentication"
],
"outcome": "failure",
"type": [
"end"
]
},
"action": {
"name": "connection",
"outcome": "failure",
"outcome_reason": "Failed password",
"target": "user",
"type": "open"
},
"observer": {
"product": "openssh",
"type": "server",
"vendor": "openbsd project"
},
"process": {
"name": "sshd"
},
"related": {
"ip": [
"1.2.3.4"
],
"user": [
"backup"
]
},
"source": {
"address": "1.2.3.4",
"ip": "1.2.3.4",
"port": 60150,
"user": {
"name": "backup"
}
},
"user": {
"name": "backup"
}
}
{
"message": " Failed password for invalid user ***** from 1.2.3.4 port 51894 ssh2",
"event": {
"category": [
"authentication"
],
"outcome": "failure",
"type": [
"end"
]
},
"action": {
"name": "connection",
"outcome": "failure",
"outcome_reason": "Failed password",
"target": "user",
"type": "open"
},
"observer": {
"product": "openssh",
"type": "server",
"vendor": "openbsd project"
},
"process": {
"name": "sshd"
},
"related": {
"ip": [
"1.2.3.4"
]
},
"source": {
"address": "1.2.3.4",
"ip": "1.2.3.4",
"port": 51894
}
}
{
"message": "fatal: Timeout before authentication for 1.2.3.4 port 52076",
"event": {
"category": [
"session"
],
"outcome": "failure",
"type": [
"end"
]
},
"action": {
"name": "connection",
"outcome": "failure",
"outcome_reason": "Timeout before authentication",
"target": "user",
"type": "open"
},
"observer": {
"product": "openssh",
"type": "server",
"vendor": "openbsd project"
},
"process": {
"name": "sshd"
},
"related": {
"ip": [
"1.2.3.4"
]
},
"source": {
"address": "1.2.3.4",
"ip": "1.2.3.4",
"port": 52076
}
}
{
"message": " Invalid user jdoe from ssh.example.org port 48792",
"event": {
"category": [
"authentication"
],
"outcome": "failure",
"type": [
"end"
]
},
"action": {
"name": "connection",
"outcome": "failure",
"outcome_reason": "Invalid user",
"target": "user",
"type": "open"
},
"observer": {
"product": "openssh",
"type": "server",
"vendor": "openbsd project"
},
"process": {
"name": "sshd"
},
"related": {
"hosts": [
"ssh.example.org"
],
"user": [
"jdoe"
]
},
"source": {
"address": "ssh.example.org",
"domain": "ssh.example.org",
"port": 48792,
"registered_domain": "example.org",
"subdomain": "ssh",
"top_level_domain": "org",
"user": {
"name": "jdoe"
}
},
"user": {
"name": "jdoe"
}
}
{
"message": " input_userauth_request: invalid user jdoe [preauth]",
"event": {
"category": [
"authentication"
],
"outcome": "failure",
"type": [
"end"
]
},
"action": {
"name": "connection",
"outcome": "failure",
"outcome_reason": "invalid user",
"target": "user",
"type": "open"
},
"observer": {
"product": "openssh",
"type": "server",
"vendor": "openbsd project"
},
"process": {
"name": "sshd"
},
"related": {
"user": [
"jdoe"
]
},
"source": {
"user": {
"name": "jdoe"
}
},
"user": {
"name": "jdoe"
}
}
{
"message": " Invalid user ***** from 1.2.3.4 port 51894",
"event": {
"category": [
"authentication"
],
"outcome": "failure",
"type": [
"end"
]
},
"action": {
"name": "connection",
"outcome": "failure",
"outcome_reason": "Invalid user",
"target": "user",
"type": "open"
},
"observer": {
"product": "openssh",
"type": "server",
"vendor": "openbsd project"
},
"process": {
"name": "sshd"
},
"related": {
"ip": [
"1.2.3.4"
]
},
"source": {
"address": "1.2.3.4",
"ip": "1.2.3.4",
"port": 51894
}
}
{
"message": " error: kex_exchange_identification: Connection closed by remote host",
"event": {
"category": [
"session"
],
"outcome": "failure",
"type": [
"end"
]
},
"action": {
"name": "connection",
"outcome": "failure",
"outcome_reason": "Connection closed by remote host",
"target": "user",
"type": "open"
},
"observer": {
"product": "openssh",
"type": "server",
"vendor": "openbsd project"
},
"process": {
"name": "sshd"
}
}
{
"message": " Did not receive identification string from 1.2.3.4 port 50622",
"event": {
"category": [
"session"
],
"outcome": "failure",
"type": [
"end"
]
},
"action": {
"name": "connection",
"outcome": "failure",
"outcome_reason": "Did not receive identification string",
"target": "user",
"type": "open"
},
"observer": {
"product": "openssh",
"type": "server",
"vendor": "openbsd project"
},
"process": {
"name": "sshd"
},
"related": {
"ip": [
"1.2.3.4"
]
},
"source": {
"address": "1.2.3.4",
"ip": "1.2.3.4",
"port": 50622
}
}
{
"message": " pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=1.2.3.4",
"event": {
"category": [
"authentication"
],
"outcome": "failure",
"type": [
"end"
]
},
"action": {
"name": "sshd:auth",
"outcome": "failure",
"outcome_reason": "pam_unix(sshd:auth): authentication failure;",
"target": "user",
"type": "authentication"
},
"observer": {
"product": "openssh",
"type": "server",
"vendor": "openbsd project"
},
"process": {
"name": "sshd"
},
"related": {
"ip": [
"1.2.3.4"
]
},
"source": {
"address": "1.2.3.4",
"ip": "1.2.3.4"
}
}
{
"message": " pam_unix(sshd:auth): check pass; user unknown",
"event": {
"category": [
"authentication"
],
"outcome": "success",
"type": [
"start"
]
},
"action": {
"name": "sshd:auth",
"outcome": "success",
"outcome_reason": "pam_unix(sshd:auth): check pass; user unknown",
"target": "user",
"type": "check"
},
"observer": {
"product": "openssh",
"type": "server",
"vendor": "openbsd project"
},
"process": {
"name": "sshd"
},
"related": {
"user": [
"unknown"
]
},
"source": {
"user": {
"name": "unknown"
}
},
"user": {
"name": "unknown"
}
}
{
"message": "pam_faillock(sshd:auth): Consecutive login failures for user JDOE account temporarily locked",
"event": {
"category": [
"authentication"
],
"outcome": "failure",
"type": [
"end"
]
},
"action": {
"name": "sshd:auth",
"outcome": "failure",
"outcome_reason": "Consecutive login failures for user JDOE account temporarily locked",
"target": "user",
"type": "authentication"
},
"observer": {
"product": "openssh",
"type": "server",
"vendor": "openbsd project"
},
"process": {
"name": "sshd"
},
"related": {
"user": [
"JDOE"
]
},
"source": {
"user": {
"name": "JDOE"
}
},
"user": {
"name": "JDOE"
}
}
{
"message": "pam_faillock(sshd:auth): User unknown",
"event": {
"category": [
"authentication"
],
"outcome": "failure",
"type": [
"end"
]
},
"action": {
"name": "sshd:auth",
"outcome": "failure",
"outcome_reason": "User unknown",
"target": "user",
"type": "authentication"
},
"observer": {
"product": "openssh",
"type": "server",
"vendor": "openbsd project"
},
"process": {
"name": "sshd"
}
}
{
"message": "PAM adding faulty module: pam_cracklib.so",
"event": {
"category": [
"library"
],
"outcome": "failure",
"type": [
"start"
]
},
"action": {
"outcome": "failure",
"outcome_reason": "PAM adding faulty module: pam_cracklib.so"
},
"dll": {
"name": "pam_cracklib.so"
},
"observer": {
"product": "openssh",
"type": "server",
"vendor": "openbsd project"
},
"process": {
"name": "sshd"
}
}
{
"message": "PAM 2 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=1.2.3.4 user=root",
"event": {
"category": [
"authentication"
],
"outcome": "failure",
"type": [
"end"
]
},
"action": {
"name": "sshd:auth",
"outcome": "failure",
"outcome_reason": "PAM 2 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=1.2.3.4 user=root",
"target": "user",
"type": "authentication"
},
"observer": {
"product": "openssh",
"type": "server",
"vendor": "openbsd project"
},
"process": {
"name": "sshd"
},
"related": {
"ip": [
"1.2.3.4"
],
"user": [
"root"
]
},
"source": {
"address": "1.2.3.4",
"ip": "1.2.3.4",
"user": {
"name": "root"
}
},
"user": {
"euid": "0",
"id": "0",
"name": "root"
}
}
{
"message": "PAM service(sshd) ignoring max retries; 6 > 3",
"event": {
"category": [
"session"
],
"outcome": "failure",
"type": [
"start"
]
},
"action": {
"name": "connection",
"outcome": "failure",
"outcome_reason": "ignoring max retries; 6 > 3",
"target": "user",
"type": "open"
},
"observer": {
"product": "openssh",
"type": "server",
"vendor": "openbsd project"
},
"process": {
"name": "sshd"
}
}
{
"message": " pam_unix(sshd:session): session closed for user ubuntu",
"event": {
"category": [
"session"
],
"outcome": "success",
"type": [
"end"
]
},
"action": {
"name": "sshd:session",
"outcome": "success",
"outcome_reason": "pam_unix(sshd:session): session closed for user ubuntu",
"target": "user",
"type": "close"
},
"observer": {
"product": "openssh",
"type": "server",
"vendor": "openbsd project"
},
"process": {
"name": "sshd"
},
"related": {
"user": [
"ubuntu"
]
},
"source": {
"user": {
"name": "ubuntu"
}
},
"user": {
"name": "ubuntu"
}
}
{
"message": " pam_systemd(sshd:session): Failed to create session: Maximum number of sessions (8192) reached, refusing further sessions.",
"event": {
"category": [
"session"
],
"outcome": "failure",
"type": [
"end"
]
},
"action": {
"name": "connection",
"outcome": "failure",
"outcome_reason": "Maximum number of sessions (8192) reached, refusing further sessions.",
"target": "user",
"type": "open"
},
"observer": {
"product": "openssh",
"type": "server",
"vendor": "openbsd project"
},
"process": {
"name": "sshd"
}
}
{
"message": " pam_unix(sshd:session): session opened for user ubuntu by (uid=0)",
"event": {
"category": [
"session"
],
"outcome": "success",
"type": [
"start"
]
},
"action": {
"name": "sshd:session",
"outcome": "success",
"outcome_reason": "pam_unix(sshd:session): session opened for user ubuntu by (uid=0)",
"target": "user",
"type": "open"
},
"observer": {
"product": "openssh",
"type": "server",
"vendor": "openbsd project"
},
"process": {
"name": "sshd"
},
"related": {
"user": [
"ubuntu"
]
},
"source": {
"user": {
"name": "ubuntu"
}
},
"user": {
"name": "ubuntu"
}
}
{
"message": " pam_unix(sshd:session): session opened for user jdoe(uid=10357) by (uid=0)",
"event": {
"category": [
"session"
],
"outcome": "success",
"type": [
"start"
]
},
"action": {
"name": "sshd:session",
"outcome": "success",
"outcome_reason": "pam_unix(sshd:session): session opened for user jdoe(uid=10357) by (uid=0)",
"target": "user",
"type": "open"
},
"observer": {
"product": "openssh",
"type": "server",
"vendor": "openbsd project"
},
"process": {
"name": "sshd"
},
"related": {
"user": [
"jdoe"
]
},
"source": {
"user": {
"name": "jdoe"
}
},
"user": {
"euid": "10357",
"id": "10357",
"name": "jdoe"
}
}
{
"message": "PAM unable to dlopen(pam_cracklib.so): /lib/security/pam_cracklib.so: cannot open shared object file: No such file or directory",
"event": {
"category": [
"library"
],
"outcome": "failure",
"type": [
"start"
]
},
"action": {
"outcome": "failure",
"outcome_reason": "cannot open shared object file: No such file or directory"
},
"dll": {
"name": "pam_cracklib.so",
"path": "/lib/security/pam_cracklib.so"
},
"observer": {
"product": "openssh",
"type": "server",
"vendor": "openbsd project"
},
"process": {
"name": "sshd"
}
}
{
"message": " pam_winbind(sshd:account): user 'jdoe@example.local' granted access",
"event": {
"category": [
"session"
],
"outcome": "success",
"type": [
"start"
]
},
"action": {
"name": "sshd:session",
"outcome": "success",
"outcome_reason": "pam_winbind(sshd:account): user 'jdoe@example.local' granted access",
"target": "user",
"type": "open"
},
"observer": {
"product": "openssh",
"type": "server",
"vendor": "openbsd project"
},
"process": {
"name": "sshd"
},
"related": {
"hosts": [
"example.local"
],
"user": [
"jdoe"
]
},
"source": {
"address": "example.local",
"domain": "example.local",
"subdomain": "example",
"user": {
"name": "jdoe"
}
},
"user": {
"name": "jdoe"
}
}
{
"message": " Postponed publickey for star from 127.0.0.1 port 44690 ssh2 [preauth]",
"event": {
"category": [
"authentication"
],
"outcome": "success",
"type": [
"start"
]
},
"action": {
"name": "session",
"outcome": "success",
"outcome_reason": "Postponed publickey for star from 127.0.0.1 port 44690 ssh2 [preauth]",
"target": "user",
"type": "open"
},
"observer": {
"product": "openssh",
"type": "server",
"vendor": "openbsd project"
},
"openssh": {
"auth": {
"method": "publickey"
}
},
"process": {
"name": "sshd"
},
"related": {
"ip": [
"127.0.0.1"
],
"user": [
"star"
]
},
"source": {
"address": "127.0.0.1",
"ip": "127.0.0.1",
"port": 44690,
"user": {
"name": "star"
}
},
"user": {
"name": "star"
}
}
{
"message": " Received disconnect from 1.2.3.4 port 39906:11: Bye Bye [preauth]",
"event": {
"category": [
"network"
],
"outcome": "success",
"type": [
"end"
]
},
"action": {
"name": "connection",
"outcome": "success",
"outcome_reason": "Bye Bye",
"target": "user",
"type": "close"
},
"observer": {
"product": "openssh",
"type": "server",
"vendor": "openbsd project"
},
"process": {
"name": "sshd"
},
"related": {
"ip": [
"1.2.3.4"
]
},
"source": {
"address": "1.2.3.4",
"ip": "1.2.3.4",
"port": 39906
}
}
{
"message": " Received disconnect from 1.2.3.4 port 16899:11: [preauth]",
"event": {
"category": [
"network"
],
"outcome": "success",
"type": [
"end"
]
},
"action": {
"name": "connection",
"outcome": "success",
"outcome_reason": "Received disconnect from 1.2.3.4 port 16899:11: [preauth]",
"target": "user",
"type": "close"
},
"observer": {
"product": "openssh",
"type": "server",
"vendor": "openbsd project"
},
"process": {
"name": "sshd"
},
"related": {
"ip": [
"1.2.3.4"
]
},
"source": {
"address": "1.2.3.4",
"ip": "1.2.3.4",
"port": 16899
}
}
{
"message": " Received disconnect from 1.2.3.4 port 36958:11: Normal Shutdown, Thank you for playing [preauth]",
"event": {
"category": [
"network"
],
"outcome": "success",
"type": [
"end"
]
},
"action": {
"name": "connection",
"outcome": "success",
"outcome_reason": "Normal Shutdown, Thank you for playing",
"target": "user",
"type": "close"
},
"observer": {
"product": "openssh",
"type": "server",
"vendor": "openbsd project"
},
"process": {
"name": "sshd"
},
"related": {
"ip": [
"1.2.3.4"
]
},
"source": {
"address": "1.2.3.4",
"ip": "1.2.3.4",
"port": 36958
}
}
{
"message": " Received disconnect from 1.2.3.4 port 44708:11: disconnected by user",
"event": {
"category": [
"network"
],
"outcome": "success",
"type": [
"end"
]
},
"action": {
"name": "connection",
"outcome": "success",
"outcome_reason": "disconnected by user",
"target": "user",
"type": "close"
},
"observer": {
"product": "openssh",
"type": "server",
"vendor": "openbsd project"
},
"process": {
"name": "sshd"
},
"related": {
"ip": [
"1.2.3.4"
]
},
"source": {
"address": "1.2.3.4",
"ip": "1.2.3.4",
"port": 44708
}
}
{
"message": " Received disconnect from 127.0.0.1: 11: disconnected by user",
"event": {
"category": [
"network"
],
"outcome": "success",
"type": [
"end"
]
},
"action": {
"name": "connection",
"outcome": "success",
"outcome_reason": "disconnected by user",
"target": "user",
"type": "close"
},
"observer": {
"product": "openssh",
"type": "server",
"vendor": "openbsd project"
},
"process": {
"name": "sshd"
},
"related": {
"ip": [
"127.0.0.1"
]
},
"source": {
"address": "127.0.0.1",
"ip": "127.0.0.1"
}
}
{
"message": " Starting session: command for nagios from 127.0.0.1 port 58752 id 0",
"event": {
"outcome": "success"
},
"action": {
"outcome_reason": "Starting session: command for nagios from 127.0.0.1 port 58752 id 0"
},
"observer": {
"product": "openssh",
"type": "server",
"vendor": "openbsd project"
},
"process": {
"name": "sshd"
},
"related": {
"ip": [
"127.0.0.1"
],
"user": [
"nagios"
]
},
"source": {
"address": "127.0.0.1",
"ip": "127.0.0.1",
"port": 58752,
"user": {
"name": "nagios"
}
},
"user": {
"name": "nagios"
}
}
{
"message": " Starting session: command for star from 127.0.0.1 port 44690 id 0",
"event": {
"outcome": "success"
},
"action": {
"outcome_reason": "Starting session: command for star from 127.0.0.1 port 44690 id 0"
},
"observer": {
"product": "openssh",
"type": "server",
"vendor": "openbsd project"
},
"process": {
"name": "sshd"
},
"related": {
"ip": [
"127.0.0.1"
],
"user": [
"star"
]
},
"source": {
"address": "127.0.0.1",
"ip": "127.0.0.1",
"port": 44690,
"user": {
"name": "star"
}
},
"user": {
"name": "star"
}
}
{
"message": " Unable to negotiate with 1.2.3.4 port 27824: no matching cipher found. Their offer: aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,arcfour128,arcfour,3des-cbc,none [preauth]",
"event": {
"category": [
"session"
],
"outcome": "failure",
"type": [
"end"
]
},
"action": {
"name": "negotiate",
"outcome": "failure",
"outcome_reason": "Unable to negotiate with 1.2.3.4 port 27824: no matching cipher found. Their offer: aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,arcfour128,arcfour,3des-cbc,none [preauth]",
"target": "user",
"type": "open"
},
"observer": {
"product": "openssh",
"type": "server",
"vendor": "openbsd project"
},
"process": {
"name": "sshd"
},
"related": {
"ip": [
"1.2.3.4"
]
},
"source": {
"address": "1.2.3.4",
"ip": "1.2.3.4",
"port": 27824
}
}
{
"message": " Unable to negotiate with 1.2.3.4 port 5228: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1 [preauth]",
"event": {
"category": [
"session"
],
"outcome": "failure",
"type": [
"end"
]
},
"action": {
"name": "negotiate",
"outcome": "failure",
"outcome_reason": "Unable to negotiate with 1.2.3.4 port 5228: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1 [preauth]",
"target": "user",
"type": "open"
},
"observer": {
"product": "openssh",
"type": "server",
"vendor": "openbsd project"
},
"process": {
"name": "sshd"
},
"related": {
"ip": [
"1.2.3.4"
]
},
"source": {
"address": "1.2.3.4",
"ip": "1.2.3.4",
"port": 5228
}
}
{
"message": " User root from 1.2.3.4 not allowed because not listed in AllowUsers",
"event": {
"category": [
"authentication"
],
"outcome": "failure",
"type": [
"end"
]
},
"action": {
"name": "connection",
"outcome": "failure",
"outcome_reason": "not allowed because not listed in AllowUsers",
"target": "user",
"type": "open"
},
"observer": {
"product": "openssh",
"type": "server",
"vendor": "openbsd project"
},
"process": {
"name": "sshd"
},
"related": {
"ip": [
"1.2.3.4"
],
"user": [
"root"
]
},
"source": {
"address": "1.2.3.4",
"ip": "1.2.3.4",
"user": {
"name": "root"
}
},
"user": {
"name": "root"
}
}
{
"message": " User child is on pid 60225",
"event": {
"category": [
"session"
],
"outcome": "success",
"type": [
"start"
]
},
"action": {
"name": "connection",
"outcome": "success",
"outcome_reason": "is on pid 60225",
"target": "user",
"type": "open"
},
"observer": {
"product": "openssh",
"type": "server",
"vendor": "openbsd project"
},
"process": {
"name": "sshd",
"pid": 60225
},
"related": {
"user": [
"child"
]
},
"source": {
"user": {
"name": "child"
}
},
"user": {
"name": "child"
}
}
Extracted Fields
The following table lists the fields that are extracted, normalized under the ECS format, analyzed and indexed by the parser. It should be noted that infered fields are not listed.
| Name | Type | Description |
|---|---|---|
action.target |
keyword |
|
destination.ip |
ip |
IP address of the destination. |
destination.port |
long |
Port of the destination. |
dll.name |
keyword |
Name of the library. |
dll.path |
keyword |
Full file path of the library. |
event.category |
keyword |
Event category. The second categorization field in the hierarchy. |
event.outcome |
keyword |
The outcome of the event. The lowest level categorization field in the hierarchy. |
event.type |
keyword |
Event type. The third categorization field in the hierarchy. |
file.hash.sha256 |
keyword |
SHA256 hash. |
observer.product |
keyword |
The product name of the observer. |
observer.type |
keyword |
The type of the observer the data is coming from. |
observer.vendor |
keyword |
Vendor name of the observer. |
openssh.auth.method |
keyword |
|
process.name |
keyword |
Process name. |
process.pid |
long |
Process id. |
source.domain |
keyword |
The domain name of the source. |
source.ip |
ip |
IP address of the source. |
source.port |
long |
Port of the source. |
source.user.name |
keyword |
Short name or login of the user. |
user.euid |
keyword |
|
user.id |
keyword |
Unique identifier of the user. |
user.name |
keyword |
Short name or login of the user. |
Configure
As of now, the main solution to collect OpenSSH logs leverages the Rsyslog recipe. Please share your experiences with other recipes by editing this documentation.
Rsyslog
Please refer to the documentation of OpenSSH to forward events to your rsyslog server. The reader can consult the Rsyslog Transport documentation to forward these logs to Sekoia.io.