SSH Server Messages

Classification

Rule Name	Rule Type	Common Event	Classification
Server Stopping	Sub Rule	System Shutdown	Startup and Shutdown
Server File Closed	Sub Rule	Object Closed	Access Success
Directory Closed	Sub Rule	Object Closed	Access Success
Session Channel Closed	Sub Rule	Object Closed	Access Success
File Created	Sub Rule	Object Created	Access Success
File Renamed	Sub Rule	Object Renamed	Access Success
SSH Server Messages	Base Rule	Connection Information	Information
Server Starting	Sub Rule	Process/Service Starting	Startup and Shutdown
Connection Established	Sub Rule	Connection Established	Network Traffic
File Attributes Set	Sub Rule	Object Attribute Modified	Access Success
Server File Information Retrieved	Sub Rule	Object Accessed	Access Success
Server File Information Retrieved	Sub Rule	Object Accessed	Access Success
Server File Information Retrieved	Sub Rule	Object Accessed	Access Success
File Upload Begin	Sub Rule	Object Accessed	Access Success
File Upload End	Sub Rule	Object Accessed	Access Success
Server Disconnected	Sub Rule	Received Disconnect	Other Operations
Server Disconnected	Sub Rule	Received Disconnect	Other Operations
Server Opened File	Sub Rule	Object Read	Access Success
Directory Opened	Sub Rule	Object Read	Access Success
File Read	Sub Rule	Object Read	Access Success
Session Channel Open	Sub Rule	Object Read	Access Success
Server Connected	Sub Rule	Server Connection Restored	Information
Failed To Resolve Hostname	Sub Rule	Failed To Resolve Host	Error
Login	Sub Rule	User Logon	Authentication Success
Login	Sub Rule	User Logon	Authentication Success
Login	Sub Rule	User Logon	Authentication Success
Login	Sub Rule	User Logon	Authentication Success
Logout	Sub Rule	User Logoff	Authentication Success
Login Failure	Sub Rule	User Logon Failure	Authentication Failure
File Download Begin	Sub Rule	Object Downloaded	Access Success
File Download End	Sub Rule	Object Downloaded	Access Success
Server File Information Retrieval Failed	Sub Rule	Read Object Failure	Access Failure
Connection Denied	Sub Rule	Traffic Denied by Host Firewall	Network Deny

Mapping with LogRhythm Schema  

Device Key in Log Message	LogRhythm Schema	Data Type
N/A	<vmid>	Text\String
N/A	<login>	Text\String
N/A	<session>	Text\String
N/A	<sname>	Text\String
N/A	<dname>	Text\String
N/A	<object>	Text\String
N/A	<reason>	Text\String
N/A	<tag1>	Text\String
N/A	<tag2>	Text\String
N/A	<sip>	Number
N/A	<dip>	Number
N/A	<sport>	Number
N/A	<dport>	Number
N/A	<responsecode>	Number

×