<span class="pill kill-chain">id.orig_h</span>
<span class="pill kill-chain">id.orig_p</span>
<span class="pill kill-chain">id.resp_h</span>
<span class="pill kill-chain">id.resp_p</span>
<span class="pill kill-chain">client</span>
<span class="pill kill-chain">server</span>
<span class="pill kill-chain">uid</span>
</div>
Data Source: Zeek SSH
Description
Logs SSH handshakes analyzed by Zeek, including client and server banners and connection endpoints.
Details
| Property | Value |
|---|---|
| Source | ssh.log |
| Sourcetype | zeek:ssh |
Related Detections
| Name | Technique | Type |
|---|---|---|
| Unusual SSH Client Banner | SSH, Protocol Tunneling | Anomaly |
Supported Apps
- TA for Zeek (version 1.0.11)
Event Fields
Fields
Example Log
1{"_path":"ssh","_write_ts":"2026-01-15T09:21:33.456789Z","ts":"2026-01-15T09:21:32.987654Z","uid":"CkLmNo2Yp3qrStUv56","id.orig_h":"192.168.20.75","id.orig_p":53874,"id.resp_h":"198.51.100.20","id.resp_p":2222,"version":2,"auth_success":true,"auth_attempts":1,"direction":"OUTBOUND","client":"SSH-2.0-SecureBlackbox","server":"SSH-2.0-OpenSSH_8.9p1 Ubuntu-3ubuntu0.17","cipher_alg":"aes256-ctr","mac_alg":"hmac-sha1","compression_alg":"none","kex_alg":"diffie-hellman-group-exchange-sha256","host_key_alg":"ssh-ed25519","host_key":"11:22:33:44:55:66:77:88:99:aa:bb:cc:dd:ee:ff:00","remote_location.country_code":"US","remote_location.region":"MD","remote_location.city":"Baltimore","remote_location.latitude":39.2904,"remote_location.longitude":-76.6122}
Required Output Fields
-
id.orig_h
-
id.resp_h
-
id.resp_p
-
client
Source: GitHub | Version: 1