fubar9463
No user record in our sample, but fubar9463 has activity below (stories or comments). Likely we have partial data — the full bulk-load will fill profiles in.
No user record in our sample, but fubar9463 has activity below (stories or comments). Likely we have partial data — the full bulk-load will fill profiles in.
In any case the ROI for correlating SSH logs against network traffic is potentially error prone and may be more noisy than useful (can you differentiate in logs between SSH logins from a private IP and a public one?).…
You would be sending logs to a log collector (a SIEM) in security terms, and then you could join your firewall logs against your SSH auth logs. This kind of anomaly detection is possible. Not sure how common it is. I…