SSHD Messages | LogRhythm Documentation

Classification

Rule Name	Rule Type	Common Event	Classification
SSHD Messages	Base Rule	SSHD Notice	Information
Accepted Keyboard-interactive/pam	Sub Rule	General SSHD Audit Message	Other Audit
Authentication Failure	Sub Rule	Authentication Failure Activity	Authentication Failure
Check Pass	Sub Rule	General Authentication Information	Information
Connection Closed	Sub Rule	Session Closed	Information
Identification String Not Received	Sub Rule	Connection Information	Information
Failed With Invalid Argument	Sub Rule	Authentication Failure Activity	Authentication Failure
User Does Not Exist	Sub Rule	User Identity Missing	Warning
Postponed Keyboard-interactive	Sub Rule	SSHD Information Message	Information
Received Disconnect	Sub Rule	Session Disconnected	Other Audit Success
Session Closed For User	Sub Rule	Session Closed For User	Other Audit Success
Session Opened	Sub Rule	Session Started	Other Audit Success
User Not Known	Sub Rule	Ambiguous User	Warning
Sshtest User Not Known	Sub Rule	Ambiguous User	Warning