kqlElastic-2.0from elastic/detection-rules
Successful SSH Authentication from Unusual IP Address
Quality
92
FP risk
—
Forks
0
Views
0
Rule sourcerules/linux/initial_access_successful_ssh_authentication_by_unusual_ip.toml
event.category:authentication and host.os.type:linux and event.action:ssh_login and event.outcome:success