title: SO IDH - SSH Accessed
id: b7a09f0a-88ca-4fe0-bc8a-92106133e231
status: experimental
description: Detects when the SSH service on a SO IDH node has had a new connection (logtype 4000) or login attempt (logtype 4002).
author: Security Onion Solutions
license: MIT
references: 
  - https://opencanary.readthedocs.io/en/latest/starting/configuration.html#services-configuration
  - https://github.com/thinkst/opencanary/blob/a0896adfcaf0328cfd5829fe10d2878c7445138e/opencanary/logger.py#L52
logsource:
  product: opencanary
detection:
  selection:
    logtype:
    - 4000 
    - 4001
    - 4002
  custom_filter:
    source.ip:
    - x.x.x.x
  condition: selection #and not custom_filter
falsepositives:
  - None
fields:
  - source.ip
level: critical