examples/01_ssh_bruteforce.json

{
  "timestamp": "2026-06-06T02:14:33.120+0000",
  "rule": {
    "level": 10,
    "description": "sshd: Multiple authentication failures.",
    "id": "5712",
    "groups": ["syslog", "sshd", "authentication_failures"],
    "mitre": {"id": ["T1110"], "tactic": ["Credential Access"], "technique": ["Brute Force"]}
  },
  "agent": {"id": "004", "name": "vps-edge-01"},
  "data": {"srcip": "203.0.113.45", "srcuser": "root"},
  "full_log": "Jun  6 02:14:33 vps-edge-01 sshd[20913]: Failed password for root from 203.0.113.45 port 51244 ssh2"
}