{
  "title": "juniper_ssh_login_success",
  "description": "Juniper sshd Accepted password/keyboard-interactive",
  "source": "rule \"juniper_ssh_login_success\"\nwhen\n  contains(to_string($message.message), \"sshd\") && contains(to_string($message.message), \"Accepted \")\nthen\n  set_field(\"vendor\", \"juniper\");\n  set_field(\"event_type\", \"ssh_auth_success\");\n  let m = regex(\"Accepted (password|keyboard-interactive/pam) for (\\\\S+) from (\\\\S+) port (\\\\d+)\", to_string($message.message), [\"method\",\"user\",\"src_ip\",\"src_port\"]);\n  set_field(\"auth_method\", m[\"method\"]);\n  set_field(\"auth_user\", m[\"user\"]);\n  set_field(\"src_ip\", m[\"src_ip\"]);\nend"
}