OpenSSH

OpenSSH server logs documenting auth success/fail, key exchange, session open/close and port-forward activity.

Global Fields (4)

FieldType
ngs.id
Unique identifier for the log entry.
string
ngs.createdAt
Timestamp when the event was created locally.
pdate
ngs.indexedAt
Timestamp when the log was indexed into the SIEM.
pdate
ngs.source
Origin or source system of the log.
string

Reference-Specific Fields (9)

FieldType
ssh.action
SSH action field indicating the operation performed (e.g., connect, disconnect, command execution).
string
ssh.result
SSH result field indicating the outcome of the action (e.g., success, failure).
string
ssh.reason
SSH reason field providing additional information about the result (e.g., authentication error, timeout).
text_general
ssh.authMethod
SSH authentication method field specifying how the user authenticated (e.g., password, publickey).
string
ssh.username
SSH username field containing the account name used for the session.
text_general
ssh.uid
SSH user ID field representing the numeric identifier of the user on the system.
pint
ssh.procID
SSH process ID field indicating the operating system process ID handling the SSH session.
pint
ssh.srcPort
SSH source port field specifying the TCP port on the client side.
pint
ssh.srcIP
SSH source IP field containing the IP address of the client initiating the connection.
text_general

Sample Log Event

Below is a representative JSON log entry showing key fields as they’re emitted by the system. Depending on the context of the event, some fields may be omitted if they’re not applicable.