SSHD Messages 1 | LogRhythm Documentation

Classification

Rule Name	Rule Type	Common Event	Classification
SSHD Messages	Base Rule	SSHD Information Message	Information
SSHD : Unknown Host	Sub Rule	Unknown Host	Information
SSHD : Terminating Session	Sub Rule	SSH Session Closed	Other Operations
SSHD : Authentication Failure	Sub Rule	User Logon Failure	Authentication Failure
SSHD : Session Opened	Sub Rule	SSH Session Opened	Network Traffic
SSHD : Session Closed	Sub Rule	SSH Session Closed	Other Operations
SSHD : Server Listening	Sub Rule	Server Listening On IP And Port	Information
SSHD : Received Disconnect	Sub Rule	Session Disconnected	Other Audit Success
SSHD : Failed Password	Sub Rule	User Logon Failure : Bad Password	Authentication Failure
SSHD : Connection Closed	Sub Rule	SSH Session Closed	Other Operations
SSHD : Cannot Bind Any Address	Sub Rule	Cannot Bind Connection	Error
SSHD : Bind To Port Failed	Sub Rule	Failed To Bind Port	Warning
SSHD : Authentication Failures	Sub Rule	User Logon Failure	Authentication Failure
SSHD : Accepted Password	Sub Rule	User Logon	Authentication Success