SSH Server Messages

Server Stopping

Sub Rule

System Shutdown

Startup and Shutdown

Server File Closed

Sub Rule

Object Closed

Access Success

Directory Closed

Sub Rule

Object Closed

Access Success

Session Channel Closed

Sub Rule

Object Closed

Access Success

File Created

Sub Rule

Object Created

Access Success

File Renamed

Sub Rule

Object Renamed

Access Success

SSH Server Messages

Base Rule

Connection Information

Information

Server Starting

Sub Rule

Process/Service Starting

Startup and Shutdown

Connection Established

Sub Rule

Connection Established

Network Traffic

File Attributes Set

Sub Rule

Object Attribute Modified

Access Success

Server File Information Retrieved

Sub Rule

Object Accessed

Access Success

Server File Information Retrieved

Sub Rule

Object Accessed

Access Success

Server File Information Retrieved

Sub Rule

Object Accessed

Access Success

File Upload Begin

Sub Rule

Object Accessed

Access Success

File Upload End

Sub Rule

Object Accessed

Access Success

Server Disconnected

Sub Rule

Received Disconnect

Other Operations

Server Disconnected

Sub Rule

Received Disconnect

Other Operations

Server Opened File

Sub Rule

Object Read

Access Success

Directory Opened

Sub Rule

Object Read

Access Success

File Read

Sub Rule

Object Read

Access Success

Session Channel Open

Sub Rule

Object Read

Access Success

Server Connected

Sub Rule

Server Connection Restored

Information

Failed To Resolve Hostname

Sub Rule

Failed To Resolve Host

Error

Login

Sub Rule

User Logon

Authentication Success

Login

Sub Rule

User Logon

Authentication Success

Login

Sub Rule

User Logon

Authentication Success

Login

Sub Rule

User Logon

Authentication Success

Logout

Sub Rule

User Logoff

Authentication Success

Login Failure

Sub Rule

User Logon Failure

Authentication Failure

File Download Begin

Sub Rule

Object Downloaded

Access Success

File Download End

Sub Rule

Object Downloaded

Access Success

Server File Information Retrieval Failed

Sub Rule

Read Object Failure

Access Failure

Connection Denied

Sub Rule

Traffic Denied by Host Firewall

Network Deny

Device Key in Log Message

LogRhythm Schema

Data Type

N/A

<vmid>

Text\String

N/A

<login>

Text\String

N/A

<session>

Text\String

N/A

<sname>

Text\String

N/A

<dname>

Text\String

N/A

<object>

Text\String

N/A

<reason>

Text\String

N/A

<tag1>

Text\String

N/A

<tag2>

Text\String

N/A

<sip>

Number

N/A

<dip>

Number

N/A

<sport>

Number

N/A

<dport>

Number

N/A

<responsecode>

Number