5 lines
694 B
JSON
5 lines
694 B
JSON
{
|
|
"title": "juniper_ssh_login_success",
|
|
"description": "Juniper sshd Accepted password/keyboard-interactive",
|
|
"source": "rule \"juniper_ssh_login_success\"\nwhen\n contains(to_string($message.message), \"sshd\") && contains(to_string($message.message), \"Accepted \")\nthen\n set_field(\"vendor\", \"juniper\");\n set_field(\"event_type\", \"ssh_auth_success\");\n let m = regex(\"Accepted (password|keyboard-interactive/pam) for (\\\\S+) from (\\\\S+) port (\\\\d+)\", to_string($message.message), [\"method\",\"user\",\"src_ip\",\"src_port\"]);\n set_field(\"auth_method\", m[\"method\"]);\n set_field(\"auth_user\", m[\"user\"]);\n set_field(\"src_ip\", m[\"src_ip\"]);\nend"
|
|
}
|