{
  "schema_version": 1,
  "tool": {
    "name": "CYBERY di Mariani Yuri SSH Forensic Analyzer",
    "version": "1.0.1"
  },
  "source": {
    "filename": "sshd-syslog.log",
    "sha256": "34ed7d10be524737edb9ea246f1e5447d6d09df53e62db818ee07c179d34f04e",
    "bytes": 6165,
    "encoding": "UTF-8, replacement decoding if malformed",
    "decoding_replacement_characters": 0,
    "bsd_year": 2026,
    "bsd_timezone": "UTC"
  },
  "coverage": {
    "total_lines": 46,
    "unrelated_lines": 2,
    "unparsed_ssh_lines": 18,
    "parsed_event_lines": 26,
    "blank_lines": 0,
    "malformed_json_lines": 0
  },
  "parameters": {
    "threshold": 5,
    "window_seconds": 60,
    "inclusive_window": true
  },
  "statistics": {
    "event_count": 26,
    "counts_by_kind": {
      "authentication_failure": 5,
      "authentication_success": 2,
      "connection_refused": 7,
      "disconnect": 9,
      "source_penalty": 3
    },
    "counts_by_method": {
      "password": 7
    },
    "timestamp_origins": {
      "daemon_native": 26
    },
    "first_timestamp": "2026-10-10T19:11:19Z",
    "last_timestamp": "2026-10-10T19:12:25Z",
    "invalid_account_failures": 0,
    "by_source": {
      "127.0.0.1": {
        "authentication_failure": 5,
        "authentication_success": 2,
        "connection_refused": 7,
        "disconnect": 9
      }
    },
    "by_utc_hour": {
      "2026-10-10T19:00:00Z": {
        "authentication_failure": 5,
        "authentication_success": 2,
        "connection_refused": 7,
        "disconnect": 9,
        "source_penalty": 3
      }
    },
    "by_utc_minute": {
      "2026-10-10T19:11:00Z": {
        "authentication_failure": 1,
        "authentication_success": 2,
        "disconnect": 5,
        "source_penalty": 1
      },
      "2026-10-10T19:12:00Z": {
        "authentication_failure": 4,
        "connection_refused": 7,
        "disconnect": 4,
        "source_penalty": 2
      }
    },
    "by_supplied_scenario": {}
  },
  "alerts": [],
  "threshold_sensitivity": [
    {
      "threshold": 3,
      "qualifying_failure_endpoints": 2,
      "sources_with_concentrated_failures": 1,
      "success_after_failure_review_candidates": 0
    },
    {
      "threshold": 5,
      "qualifying_failure_endpoints": 0,
      "sources_with_concentrated_failures": 0,
      "success_after_failure_review_candidates": 0
    },
    {
      "threshold": 8,
      "qualifying_failure_endpoints": 0,
      "sources_with_concentrated_failures": 0,
      "success_after_failure_review_candidates": 0
    }
  ],
  "warnings": [
    "Some records were not parsed. Review unparsed_records before treating event counts as complete.",
    "BSD timestamps have an analyst-supplied year and fixed timezone offset; neither is established by the log bytes alone."
  ],
  "events": [
    {
      "kind": "authentication_success",
      "method": "password",
      "user": "labuser",
      "source_address": "127.0.0.1",
      "source_port": 41084,
      "invalid_user": false,
      "event_id": "L00000004",
      "source_line_number": 4,
      "source_line": "Oct 10 19:11:19 cybery-ssh-lab auth.info sshd-session[1807]: Accepted password for labuser from 127.0.0.1 port 41084 ssh2",
      "raw_message": "Oct 10 19:11:19 cybery-ssh-lab auth.info sshd-session[1807]: Accepted password for labuser from 127.0.0.1 port 41084 ssh2",
      "message": "Accepted password for labuser from 127.0.0.1 port 41084 ssh2",
      "timestamp": "2026-10-10T19:11:19Z",
      "timestamp_origin": "daemon_native",
      "original_timestamp": "Oct 10 19:11:19",
      "collector_received_at": null,
      "pid": 1807,
      "daemon": "sshd-session",
      "host": "cybery-ssh-lab",
      "scenario": null,
      "source_network": null,
      "penalty_state": null,
      "penalty_seconds": null,
      "policy_reason": null,
      "destination_address": null,
      "destination_port": null,
      "connection_index": null
    },
    {
      "kind": "disconnect",
      "method": null,
      "user": null,
      "source_address": "127.0.0.1",
      "source_port": 41084,
      "invalid_user": false,
      "event_id": "L00000007",
      "source_line_number": 7,
      "source_line": "Oct 10 19:11:19 cybery-ssh-lab auth.info sshd-session[1811]: Received disconnect from 127.0.0.1 port 41084:11: disconnected by user",
      "raw_message": "Oct 10 19:11:19 cybery-ssh-lab auth.info sshd-session[1811]: Received disconnect from 127.0.0.1 port 41084:11: disconnected by user",
      "message": "Received disconnect from 127.0.0.1 port 41084:11: disconnected by user",
      "timestamp": "2026-10-10T19:11:19Z",
      "timestamp_origin": "daemon_native",
      "original_timestamp": "Oct 10 19:11:19",
      "collector_received_at": null,
      "pid": 1811,
      "daemon": "sshd-session",
      "host": "cybery-ssh-lab",
      "scenario": null,
      "source_network": null,
      "penalty_state": null,
      "penalty_seconds": null,
      "policy_reason": null,
      "destination_address": null,
      "destination_port": null,
      "connection_index": null
    },
    {
      "kind": "disconnect",
      "method": null,
      "user": "labuser",
      "source_address": "127.0.0.1",
      "source_port": 41084,
      "invalid_user": false,
      "event_id": "L00000008",
      "source_line_number": 8,
      "source_line": "Oct 10 19:11:19 cybery-ssh-lab auth.info sshd-session[1811]: Disconnected from user labuser 127.0.0.1 port 41084",
      "raw_message": "Oct 10 19:11:19 cybery-ssh-lab auth.info sshd-session[1811]: Disconnected from user labuser 127.0.0.1 port 41084",
      "message": "Disconnected from user labuser 127.0.0.1 port 41084",
      "timestamp": "2026-10-10T19:11:19Z",
      "timestamp_origin": "daemon_native",
      "original_timestamp": "Oct 10 19:11:19",
      "collector_received_at": null,
      "pid": 1811,
      "daemon": "sshd-session",
      "host": "cybery-ssh-lab",
      "scenario": null,
      "source_network": null,
      "penalty_state": null,
      "penalty_seconds": null,
      "policy_reason": null,
      "destination_address": null,
      "destination_port": null,
      "connection_index": null
    },
    {
      "kind": "authentication_success",
      "method": "password",
      "user": "labuser",
      "source_address": "127.0.0.1",
      "source_port": 41096,
      "invalid_user": false,
      "event_id": "L00000010",
      "source_line_number": 10,
      "source_line": "Oct 10 19:11:19 cybery-ssh-lab auth.info sshd-session[1816]: Accepted password for labuser from 127.0.0.1 port 41096 ssh2",
      "raw_message": "Oct 10 19:11:19 cybery-ssh-lab auth.info sshd-session[1816]: Accepted password for labuser from 127.0.0.1 port 41096 ssh2",
      "message": "Accepted password for labuser from 127.0.0.1 port 41096 ssh2",
      "timestamp": "2026-10-10T19:11:19Z",
      "timestamp_origin": "daemon_native",
      "original_timestamp": "Oct 10 19:11:19",
      "collector_received_at": null,
      "pid": 1816,
      "daemon": "sshd-session",
      "host": "cybery-ssh-lab",
      "scenario": null,
      "source_network": null,
      "penalty_state": null,
      "penalty_seconds": null,
      "policy_reason": null,
      "destination_address": null,
      "destination_port": null,
      "connection_index": null
    },
    {
      "kind": "disconnect",
      "method": null,
      "user": null,
      "source_address": "127.0.0.1",
      "source_port": 41096,
      "invalid_user": false,
      "event_id": "L00000013",
      "source_line_number": 13,
      "source_line": "Oct 10 19:11:19 cybery-ssh-lab auth.info sshd-session[1820]: Received disconnect from 127.0.0.1 port 41096:11: disconnected by user",
      "raw_message": "Oct 10 19:11:19 cybery-ssh-lab auth.info sshd-session[1820]: Received disconnect from 127.0.0.1 port 41096:11: disconnected by user",
      "message": "Received disconnect from 127.0.0.1 port 41096:11: disconnected by user",
      "timestamp": "2026-10-10T19:11:19Z",
      "timestamp_origin": "daemon_native",
      "original_timestamp": "Oct 10 19:11:19",
      "collector_received_at": null,
      "pid": 1820,
      "daemon": "sshd-session",
      "host": "cybery-ssh-lab",
      "scenario": null,
      "source_network": null,
      "penalty_state": null,
      "penalty_seconds": null,
      "policy_reason": null,
      "destination_address": null,
      "destination_port": null,
      "connection_index": null
    },
    {
      "kind": "disconnect",
      "method": null,
      "user": "labuser",
      "source_address": "127.0.0.1",
      "source_port": 41096,
      "invalid_user": false,
      "event_id": "L00000014",
      "source_line_number": 14,
      "source_line": "Oct 10 19:11:19 cybery-ssh-lab auth.info sshd-session[1820]: Disconnected from user labuser 127.0.0.1 port 41096",
      "raw_message": "Oct 10 19:11:19 cybery-ssh-lab auth.info sshd-session[1820]: Disconnected from user labuser 127.0.0.1 port 41096",
      "message": "Disconnected from user labuser 127.0.0.1 port 41096",
      "timestamp": "2026-10-10T19:11:19Z",
      "timestamp_origin": "daemon_native",
      "original_timestamp": "Oct 10 19:11:19",
      "collector_received_at": null,
      "pid": 1820,
      "daemon": "sshd-session",
      "host": "cybery-ssh-lab",
      "scenario": null,
      "source_network": null,
      "penalty_state": null,
      "penalty_seconds": null,
      "policy_reason": null,
      "destination_address": null,
      "destination_port": null,
      "connection_index": null
    },
    {
      "kind": "authentication_failure",
      "method": "password",
      "user": "labuser",
      "source_address": "127.0.0.1",
      "source_port": 41104,
      "invalid_user": false,
      "event_id": "L00000016",
      "source_line_number": 16,
      "source_line": "Oct 10 19:11:19 cybery-ssh-lab auth.info sshd-session[1825]: Failed password for labuser from 127.0.0.1 port 41104 ssh2",
      "raw_message": "Oct 10 19:11:19 cybery-ssh-lab auth.info sshd-session[1825]: Failed password for labuser from 127.0.0.1 port 41104 ssh2",
      "message": "Failed password for labuser from 127.0.0.1 port 41104 ssh2",
      "timestamp": "2026-10-10T19:11:19Z",
      "timestamp_origin": "daemon_native",
      "original_timestamp": "Oct 10 19:11:19",
      "collector_received_at": null,
      "pid": 1825,
      "daemon": "sshd-session",
      "host": "cybery-ssh-lab",
      "scenario": null,
      "source_network": null,
      "penalty_state": null,
      "penalty_seconds": null,
      "policy_reason": null,
      "destination_address": null,
      "destination_port": null,
      "connection_index": null
    },
    {
      "kind": "disconnect",
      "method": null,
      "user": "labuser",
      "source_address": "127.0.0.1",
      "source_port": 41104,
      "invalid_user": false,
      "event_id": "L00000018",
      "source_line_number": 18,
      "source_line": "Oct 10 19:11:19 cybery-ssh-lab auth.info sshd-session[1825]: Disconnecting authenticating user labuser 127.0.0.1 port 41104: Too many authentication failures [preauth]",
      "raw_message": "Oct 10 19:11:19 cybery-ssh-lab auth.info sshd-session[1825]: Disconnecting authenticating user labuser 127.0.0.1 port 41104: Too many authentication failures [preauth]",
      "message": "Disconnecting authenticating user labuser 127.0.0.1 port 41104: Too many authentication failures [preauth]",
      "timestamp": "2026-10-10T19:11:19Z",
      "timestamp_origin": "daemon_native",
      "original_timestamp": "Oct 10 19:11:19",
      "collector_received_at": null,
      "pid": 1825,
      "daemon": "sshd-session",
      "host": "cybery-ssh-lab",
      "scenario": null,
      "source_network": null,
      "penalty_state": null,
      "penalty_seconds": null,
      "policy_reason": null,
      "destination_address": null,
      "destination_port": null,
      "connection_index": null
    },
    {
      "kind": "source_penalty",
      "method": null,
      "user": null,
      "source_address": null,
      "source_port": null,
      "invalid_user": false,
      "source_network": "127.0.0.1/32",
      "penalty_state": "deferred",
      "penalty_seconds": "5.000",
      "policy_reason": "penalty: failed authentication",
      "event_id": "L00000019",
      "source_line_number": 19,
      "source_line": "Oct 10 19:11:19 cybery-ssh-lab auth.info sshd[1792]: srclimit_penalise: ipv4: new 127.0.0.1/32 deferred penalty of 5.000 seconds for penalty: failed authentication",
      "raw_message": "Oct 10 19:11:19 cybery-ssh-lab auth.info sshd[1792]: srclimit_penalise: ipv4: new 127.0.0.1/32 deferred penalty of 5.000 seconds for penalty: failed authentication",
      "message": "srclimit_penalise: ipv4: new 127.0.0.1/32 deferred penalty of 5.000 seconds for penalty: failed authentication",
      "timestamp": "2026-10-10T19:11:19Z",
      "timestamp_origin": "daemon_native",
      "original_timestamp": "Oct 10 19:11:19",
      "collector_received_at": null,
      "pid": 1792,
      "daemon": "sshd",
      "host": "cybery-ssh-lab",
      "scenario": null,
      "destination_address": null,
      "destination_port": null,
      "connection_index": null
    },
    {
      "kind": "authentication_failure",
      "method": "password",
      "user": "labuser",
      "source_address": "127.0.0.1",
      "source_port": 55774,
      "invalid_user": false,
      "event_id": "L00000021",
      "source_line_number": 21,
      "source_line": "Oct 10 19:12:24 cybery-ssh-lab auth.info sshd-session[1833]: Failed password for labuser from 127.0.0.1 port 55774 ssh2",
      "raw_message": "Oct 10 19:12:24 cybery-ssh-lab auth.info sshd-session[1833]: Failed password for labuser from 127.0.0.1 port 55774 ssh2",
      "message": "Failed password for labuser from 127.0.0.1 port 55774 ssh2",
      "timestamp": "2026-10-10T19:12:24Z",
      "timestamp_origin": "daemon_native",
      "original_timestamp": "Oct 10 19:12:24",
      "collector_received_at": null,
      "pid": 1833,
      "daemon": "sshd-session",
      "host": "cybery-ssh-lab",
      "scenario": null,
      "source_network": null,
      "penalty_state": null,
      "penalty_seconds": null,
      "policy_reason": null,
      "destination_address": null,
      "destination_port": null,
      "connection_index": null
    },
    {
      "kind": "disconnect",
      "method": null,
      "user": "labuser",
      "source_address": "127.0.0.1",
      "source_port": 55774,
      "invalid_user": false,
      "event_id": "L00000023",
      "source_line_number": 23,
      "source_line": "Oct 10 19:12:24 cybery-ssh-lab auth.info sshd-session[1833]: Disconnecting authenticating user labuser 127.0.0.1 port 55774: Too many authentication failures [preauth]",
      "raw_message": "Oct 10 19:12:24 cybery-ssh-lab auth.info sshd-session[1833]: Disconnecting authenticating user labuser 127.0.0.1 port 55774: Too many authentication failures [preauth]",
      "message": "Disconnecting authenticating user labuser 127.0.0.1 port 55774: Too many authentication failures [preauth]",
      "timestamp": "2026-10-10T19:12:24Z",
      "timestamp_origin": "daemon_native",
      "original_timestamp": "Oct 10 19:12:24",
      "collector_received_at": null,
      "pid": 1833,
      "daemon": "sshd-session",
      "host": "cybery-ssh-lab",
      "scenario": null,
      "source_network": null,
      "penalty_state": null,
      "penalty_seconds": null,
      "policy_reason": null,
      "destination_address": null,
      "destination_port": null,
      "connection_index": null
    },
    {
      "kind": "source_penalty",
      "method": null,
      "user": null,
      "source_address": null,
      "source_port": null,
      "invalid_user": false,
      "source_network": "127.0.0.1/32",
      "penalty_state": "deferred",
      "penalty_seconds": "5.000",
      "policy_reason": "penalty: failed authentication",
      "event_id": "L00000024",
      "source_line_number": 24,
      "source_line": "Oct 10 19:12:24 cybery-ssh-lab auth.info sshd[1792]: srclimit_penalise: ipv4: new 127.0.0.1/32 deferred penalty of 5.000 seconds for penalty: failed authentication",
      "raw_message": "Oct 10 19:12:24 cybery-ssh-lab auth.info sshd[1792]: srclimit_penalise: ipv4: new 127.0.0.1/32 deferred penalty of 5.000 seconds for penalty: failed authentication",
      "message": "srclimit_penalise: ipv4: new 127.0.0.1/32 deferred penalty of 5.000 seconds for penalty: failed authentication",
      "timestamp": "2026-10-10T19:12:24Z",
      "timestamp_origin": "daemon_native",
      "original_timestamp": "Oct 10 19:12:24",
      "collector_received_at": null,
      "pid": 1792,
      "daemon": "sshd",
      "host": "cybery-ssh-lab",
      "scenario": null,
      "destination_address": null,
      "destination_port": null,
      "connection_index": null
    },
    {
      "kind": "authentication_failure",
      "method": "password",
      "user": "labuser",
      "source_address": "127.0.0.1",
      "source_port": 55786,
      "invalid_user": false,
      "event_id": "L00000026",
      "source_line_number": 26,
      "source_line": "Oct 10 19:12:24 cybery-ssh-lab auth.info sshd-session[1840]: Failed password for labuser from 127.0.0.1 port 55786 ssh2",
      "raw_message": "Oct 10 19:12:24 cybery-ssh-lab auth.info sshd-session[1840]: Failed password for labuser from 127.0.0.1 port 55786 ssh2",
      "message": "Failed password for labuser from 127.0.0.1 port 55786 ssh2",
      "timestamp": "2026-10-10T19:12:24Z",
      "timestamp_origin": "daemon_native",
      "original_timestamp": "Oct 10 19:12:24",
      "collector_received_at": null,
      "pid": 1840,
      "daemon": "sshd-session",
      "host": "cybery-ssh-lab",
      "scenario": null,
      "source_network": null,
      "penalty_state": null,
      "penalty_seconds": null,
      "policy_reason": null,
      "destination_address": null,
      "destination_port": null,
      "connection_index": null
    },
    {
      "kind": "disconnect",
      "method": null,
      "user": "labuser",
      "source_address": "127.0.0.1",
      "source_port": 55786,
      "invalid_user": false,
      "event_id": "L00000028",
      "source_line_number": 28,
      "source_line": "Oct 10 19:12:24 cybery-ssh-lab auth.info sshd-session[1840]: Disconnecting authenticating user labuser 127.0.0.1 port 55786: Too many authentication failures [preauth]",
      "raw_message": "Oct 10 19:12:24 cybery-ssh-lab auth.info sshd-session[1840]: Disconnecting authenticating user labuser 127.0.0.1 port 55786: Too many authentication failures [preauth]",
      "message": "Disconnecting authenticating user labuser 127.0.0.1 port 55786: Too many authentication failures [preauth]",
      "timestamp": "2026-10-10T19:12:24Z",
      "timestamp_origin": "daemon_native",
      "original_timestamp": "Oct 10 19:12:24",
      "collector_received_at": null,
      "pid": 1840,
      "daemon": "sshd-session",
      "host": "cybery-ssh-lab",
      "scenario": null,
      "source_network": null,
      "penalty_state": null,
      "penalty_seconds": null,
      "policy_reason": null,
      "destination_address": null,
      "destination_port": null,
      "connection_index": null
    },
    {
      "kind": "authentication_failure",
      "method": "password",
      "user": "labuser",
      "source_address": "127.0.0.1",
      "source_port": 55794,
      "invalid_user": false,
      "event_id": "L00000030",
      "source_line_number": 30,
      "source_line": "Oct 10 19:12:24 cybery-ssh-lab auth.info sshd-session[1847]: Failed password for labuser from 127.0.0.1 port 55794 ssh2",
      "raw_message": "Oct 10 19:12:24 cybery-ssh-lab auth.info sshd-session[1847]: Failed password for labuser from 127.0.0.1 port 55794 ssh2",
      "message": "Failed password for labuser from 127.0.0.1 port 55794 ssh2",
      "timestamp": "2026-10-10T19:12:24Z",
      "timestamp_origin": "daemon_native",
      "original_timestamp": "Oct 10 19:12:24",
      "collector_received_at": null,
      "pid": 1847,
      "daemon": "sshd-session",
      "host": "cybery-ssh-lab",
      "scenario": null,
      "source_network": null,
      "penalty_state": null,
      "penalty_seconds": null,
      "policy_reason": null,
      "destination_address": null,
      "destination_port": null,
      "connection_index": null
    },
    {
      "kind": "disconnect",
      "method": null,
      "user": "labuser",
      "source_address": "127.0.0.1",
      "source_port": 55794,
      "invalid_user": false,
      "event_id": "L00000032",
      "source_line_number": 32,
      "source_line": "Oct 10 19:12:24 cybery-ssh-lab auth.info sshd-session[1847]: Disconnecting authenticating user labuser 127.0.0.1 port 55794: Too many authentication failures [preauth]",
      "raw_message": "Oct 10 19:12:24 cybery-ssh-lab auth.info sshd-session[1847]: Disconnecting authenticating user labuser 127.0.0.1 port 55794: Too many authentication failures [preauth]",
      "message": "Disconnecting authenticating user labuser 127.0.0.1 port 55794: Too many authentication failures [preauth]",
      "timestamp": "2026-10-10T19:12:24Z",
      "timestamp_origin": "daemon_native",
      "original_timestamp": "Oct 10 19:12:24",
      "collector_received_at": null,
      "pid": 1847,
      "daemon": "sshd-session",
      "host": "cybery-ssh-lab",
      "scenario": null,
      "source_network": null,
      "penalty_state": null,
      "penalty_seconds": null,
      "policy_reason": null,
      "destination_address": null,
      "destination_port": null,
      "connection_index": null
    },
    {
      "kind": "authentication_failure",
      "method": "password",
      "user": "labuser",
      "source_address": "127.0.0.1",
      "source_port": 55810,
      "invalid_user": false,
      "event_id": "L00000034",
      "source_line_number": 34,
      "source_line": "Oct 10 19:12:25 cybery-ssh-lab auth.info sshd-session[1854]: Failed password for labuser from 127.0.0.1 port 55810 ssh2",
      "raw_message": "Oct 10 19:12:25 cybery-ssh-lab auth.info sshd-session[1854]: Failed password for labuser from 127.0.0.1 port 55810 ssh2",
      "message": "Failed password for labuser from 127.0.0.1 port 55810 ssh2",
      "timestamp": "2026-10-10T19:12:25Z",
      "timestamp_origin": "daemon_native",
      "original_timestamp": "Oct 10 19:12:25",
      "collector_received_at": null,
      "pid": 1854,
      "daemon": "sshd-session",
      "host": "cybery-ssh-lab",
      "scenario": null,
      "source_network": null,
      "penalty_state": null,
      "penalty_seconds": null,
      "policy_reason": null,
      "destination_address": null,
      "destination_port": null,
      "connection_index": null
    },
    {
      "kind": "disconnect",
      "method": null,
      "user": "labuser",
      "source_address": "127.0.0.1",
      "source_port": 55810,
      "invalid_user": false,
      "event_id": "L00000036",
      "source_line_number": 36,
      "source_line": "Oct 10 19:12:25 cybery-ssh-lab auth.info sshd-session[1854]: Disconnecting authenticating user labuser 127.0.0.1 port 55810: Too many authentication failures [preauth]",
      "raw_message": "Oct 10 19:12:25 cybery-ssh-lab auth.info sshd-session[1854]: Disconnecting authenticating user labuser 127.0.0.1 port 55810: Too many authentication failures [preauth]",
      "message": "Disconnecting authenticating user labuser 127.0.0.1 port 55810: Too many authentication failures [preauth]",
      "timestamp": "2026-10-10T19:12:25Z",
      "timestamp_origin": "daemon_native",
      "original_timestamp": "Oct 10 19:12:25",
      "collector_received_at": null,
      "pid": 1854,
      "daemon": "sshd-session",
      "host": "cybery-ssh-lab",
      "scenario": null,
      "source_network": null,
      "penalty_state": null,
      "penalty_seconds": null,
      "policy_reason": null,
      "destination_address": null,
      "destination_port": null,
      "connection_index": null
    },
    {
      "kind": "source_penalty",
      "method": null,
      "user": null,
      "source_address": null,
      "source_port": null,
      "invalid_user": false,
      "source_network": "127.0.0.1/32",
      "penalty_state": "activated",
      "penalty_seconds": "19.813",
      "policy_reason": "penalty: failed authentication",
      "event_id": "L00000037",
      "source_line_number": 37,
      "source_line": "Oct 10 19:12:25 cybery-ssh-lab auth.info sshd[1792]: srclimit_penalise: 127.0.0.1/32: activating ipv4 penalty of 19.813 seconds for penalty: failed authentication",
      "raw_message": "Oct 10 19:12:25 cybery-ssh-lab auth.info sshd[1792]: srclimit_penalise: 127.0.0.1/32: activating ipv4 penalty of 19.813 seconds for penalty: failed authentication",
      "message": "srclimit_penalise: 127.0.0.1/32: activating ipv4 penalty of 19.813 seconds for penalty: failed authentication",
      "timestamp": "2026-10-10T19:12:25Z",
      "timestamp_origin": "daemon_native",
      "original_timestamp": "Oct 10 19:12:25",
      "collector_received_at": null,
      "pid": 1792,
      "daemon": "sshd",
      "host": "cybery-ssh-lab",
      "scenario": null,
      "destination_address": null,
      "destination_port": null,
      "connection_index": null
    },
    {
      "kind": "connection_refused",
      "method": null,
      "user": null,
      "source_address": "127.0.0.1",
      "source_port": 52290,
      "invalid_user": false,
      "destination_address": "127.0.0.1",
      "destination_port": 2222,
      "connection_index": 0,
      "policy_reason": "penalty: failed authentication",
      "event_id": "L00000038",
      "source_line_number": 38,
      "source_line": "Oct 10 19:12:25 cybery-ssh-lab auth.info sshd[1792]: drop connection #0 from [127.0.0.1]:52290 on [127.0.0.1]:2222 penalty: failed authentication",
      "raw_message": "Oct 10 19:12:25 cybery-ssh-lab auth.info sshd[1792]: drop connection #0 from [127.0.0.1]:52290 on [127.0.0.1]:2222 penalty: failed authentication",
      "message": "drop connection #0 from [127.0.0.1]:52290 on [127.0.0.1]:2222 penalty: failed authentication",
      "timestamp": "2026-10-10T19:12:25Z",
      "timestamp_origin": "daemon_native",
      "original_timestamp": "Oct 10 19:12:25",
      "collector_received_at": null,
      "pid": 1792,
      "daemon": "sshd",
      "host": "cybery-ssh-lab",
      "scenario": null,
      "source_network": null,
      "penalty_state": null,
      "penalty_seconds": null
    },
    {
      "kind": "connection_refused",
      "method": null,
      "user": null,
      "source_address": "127.0.0.1",
      "source_port": 52304,
      "invalid_user": false,
      "destination_address": "127.0.0.1",
      "destination_port": 2222,
      "connection_index": 0,
      "policy_reason": "penalty: failed authentication",
      "event_id": "L00000039",
      "source_line_number": 39,
      "source_line": "Oct 10 19:12:25 cybery-ssh-lab auth.info sshd[1792]: drop connection #0 from [127.0.0.1]:52304 on [127.0.0.1]:2222 penalty: failed authentication",
      "raw_message": "Oct 10 19:12:25 cybery-ssh-lab auth.info sshd[1792]: drop connection #0 from [127.0.0.1]:52304 on [127.0.0.1]:2222 penalty: failed authentication",
      "message": "drop connection #0 from [127.0.0.1]:52304 on [127.0.0.1]:2222 penalty: failed authentication",
      "timestamp": "2026-10-10T19:12:25Z",
      "timestamp_origin": "daemon_native",
      "original_timestamp": "Oct 10 19:12:25",
      "collector_received_at": null,
      "pid": 1792,
      "daemon": "sshd",
      "host": "cybery-ssh-lab",
      "scenario": null,
      "source_network": null,
      "penalty_state": null,
      "penalty_seconds": null
    },
    {
      "kind": "connection_refused",
      "method": null,
      "user": null,
      "source_address": "127.0.0.1",
      "source_port": 52308,
      "invalid_user": false,
      "destination_address": "127.0.0.1",
      "destination_port": 2222,
      "connection_index": 0,
      "policy_reason": "penalty: failed authentication",
      "event_id": "L00000040",
      "source_line_number": 40,
      "source_line": "Oct 10 19:12:25 cybery-ssh-lab auth.info sshd[1792]: drop connection #0 from [127.0.0.1]:52308 on [127.0.0.1]:2222 penalty: failed authentication",
      "raw_message": "Oct 10 19:12:25 cybery-ssh-lab auth.info sshd[1792]: drop connection #0 from [127.0.0.1]:52308 on [127.0.0.1]:2222 penalty: failed authentication",
      "message": "drop connection #0 from [127.0.0.1]:52308 on [127.0.0.1]:2222 penalty: failed authentication",
      "timestamp": "2026-10-10T19:12:25Z",
      "timestamp_origin": "daemon_native",
      "original_timestamp": "Oct 10 19:12:25",
      "collector_received_at": null,
      "pid": 1792,
      "daemon": "sshd",
      "host": "cybery-ssh-lab",
      "scenario": null,
      "source_network": null,
      "penalty_state": null,
      "penalty_seconds": null
    },
    {
      "kind": "connection_refused",
      "method": null,
      "user": null,
      "source_address": "127.0.0.1",
      "source_port": 52320,
      "invalid_user": false,
      "destination_address": "127.0.0.1",
      "destination_port": 2222,
      "connection_index": 0,
      "policy_reason": "penalty: failed authentication",
      "event_id": "L00000041",
      "source_line_number": 41,
      "source_line": "Oct 10 19:12:25 cybery-ssh-lab auth.info sshd[1792]: drop connection #0 from [127.0.0.1]:52320 on [127.0.0.1]:2222 penalty: failed authentication",
      "raw_message": "Oct 10 19:12:25 cybery-ssh-lab auth.info sshd[1792]: drop connection #0 from [127.0.0.1]:52320 on [127.0.0.1]:2222 penalty: failed authentication",
      "message": "drop connection #0 from [127.0.0.1]:52320 on [127.0.0.1]:2222 penalty: failed authentication",
      "timestamp": "2026-10-10T19:12:25Z",
      "timestamp_origin": "daemon_native",
      "original_timestamp": "Oct 10 19:12:25",
      "collector_received_at": null,
      "pid": 1792,
      "daemon": "sshd",
      "host": "cybery-ssh-lab",
      "scenario": null,
      "source_network": null,
      "penalty_state": null,
      "penalty_seconds": null
    },
    {
      "kind": "connection_refused",
      "method": null,
      "user": null,
      "source_address": "127.0.0.1",
      "source_port": 52322,
      "invalid_user": false,
      "destination_address": "127.0.0.1",
      "destination_port": 2222,
      "connection_index": 0,
      "policy_reason": "penalty: failed authentication",
      "event_id": "L00000042",
      "source_line_number": 42,
      "source_line": "Oct 10 19:12:25 cybery-ssh-lab auth.info sshd[1792]: drop connection #0 from [127.0.0.1]:52322 on [127.0.0.1]:2222 penalty: failed authentication",
      "raw_message": "Oct 10 19:12:25 cybery-ssh-lab auth.info sshd[1792]: drop connection #0 from [127.0.0.1]:52322 on [127.0.0.1]:2222 penalty: failed authentication",
      "message": "drop connection #0 from [127.0.0.1]:52322 on [127.0.0.1]:2222 penalty: failed authentication",
      "timestamp": "2026-10-10T19:12:25Z",
      "timestamp_origin": "daemon_native",
      "original_timestamp": "Oct 10 19:12:25",
      "collector_received_at": null,
      "pid": 1792,
      "daemon": "sshd",
      "host": "cybery-ssh-lab",
      "scenario": null,
      "source_network": null,
      "penalty_state": null,
      "penalty_seconds": null
    },
    {
      "kind": "connection_refused",
      "method": null,
      "user": null,
      "source_address": "127.0.0.1",
      "source_port": 52336,
      "invalid_user": false,
      "destination_address": "127.0.0.1",
      "destination_port": 2222,
      "connection_index": 0,
      "policy_reason": "penalty: failed authentication",
      "event_id": "L00000043",
      "source_line_number": 43,
      "source_line": "Oct 10 19:12:25 cybery-ssh-lab auth.info sshd[1792]: drop connection #0 from [127.0.0.1]:52336 on [127.0.0.1]:2222 penalty: failed authentication",
      "raw_message": "Oct 10 19:12:25 cybery-ssh-lab auth.info sshd[1792]: drop connection #0 from [127.0.0.1]:52336 on [127.0.0.1]:2222 penalty: failed authentication",
      "message": "drop connection #0 from [127.0.0.1]:52336 on [127.0.0.1]:2222 penalty: failed authentication",
      "timestamp": "2026-10-10T19:12:25Z",
      "timestamp_origin": "daemon_native",
      "original_timestamp": "Oct 10 19:12:25",
      "collector_received_at": null,
      "pid": 1792,
      "daemon": "sshd",
      "host": "cybery-ssh-lab",
      "scenario": null,
      "source_network": null,
      "penalty_state": null,
      "penalty_seconds": null
    },
    {
      "kind": "connection_refused",
      "method": null,
      "user": null,
      "source_address": "127.0.0.1",
      "source_port": 52340,
      "invalid_user": false,
      "destination_address": "127.0.0.1",
      "destination_port": 2222,
      "connection_index": 0,
      "policy_reason": "penalty: failed authentication",
      "event_id": "L00000044",
      "source_line_number": 44,
      "source_line": "Oct 10 19:12:25 cybery-ssh-lab auth.info sshd[1792]: drop connection #0 from [127.0.0.1]:52340 on [127.0.0.1]:2222 penalty: failed authentication",
      "raw_message": "Oct 10 19:12:25 cybery-ssh-lab auth.info sshd[1792]: drop connection #0 from [127.0.0.1]:52340 on [127.0.0.1]:2222 penalty: failed authentication",
      "message": "drop connection #0 from [127.0.0.1]:52340 on [127.0.0.1]:2222 penalty: failed authentication",
      "timestamp": "2026-10-10T19:12:25Z",
      "timestamp_origin": "daemon_native",
      "original_timestamp": "Oct 10 19:12:25",
      "collector_received_at": null,
      "pid": 1792,
      "daemon": "sshd",
      "host": "cybery-ssh-lab",
      "scenario": null,
      "source_network": null,
      "penalty_state": null,
      "penalty_seconds": null
    }
  ],
  "unparsed_records": [
    {
      "source_line_number": 2,
      "source_line": "Oct 10 19:11:19 cybery-ssh-lab auth.info sshd[1792]: Server listening on 127.0.0.1 port 2222.",
      "raw_message": "Oct 10 19:11:19 cybery-ssh-lab auth.info sshd[1792]: Server listening on 127.0.0.1 port 2222.",
      "reason": "Unrecognized SSH message or invalid endpoint."
    },
    {
      "source_line_number": 3,
      "source_line": "Oct 10 19:11:19 cybery-ssh-lab auth.info sshd-session[1807]: Connection from 127.0.0.1 port 41084 on 127.0.0.1 port 2222 rdomain \"\"",
      "raw_message": "Oct 10 19:11:19 cybery-ssh-lab auth.info sshd-session[1807]: Connection from 127.0.0.1 port 41084 on 127.0.0.1 port 2222 rdomain \"\"",
      "reason": "Unrecognized SSH message or invalid endpoint."
    },
    {
      "source_line_number": 5,
      "source_line": "Oct 10 19:11:19 cybery-ssh-lab auth.info sshd-session[1807]: User child is on pid 1811",
      "raw_message": "Oct 10 19:11:19 cybery-ssh-lab auth.info sshd-session[1807]: User child is on pid 1811",
      "reason": "Unrecognized SSH message or invalid endpoint."
    },
    {
      "source_line_number": 6,
      "source_line": "Oct 10 19:11:19 cybery-ssh-lab auth.info sshd-session[1811]: Starting session: command for labuser from 127.0.0.1 port 41084 id 0",
      "raw_message": "Oct 10 19:11:19 cybery-ssh-lab auth.info sshd-session[1811]: Starting session: command for labuser from 127.0.0.1 port 41084 id 0",
      "reason": "Unrecognized SSH message or invalid endpoint."
    },
    {
      "source_line_number": 9,
      "source_line": "Oct 10 19:11:19 cybery-ssh-lab auth.info sshd-session[1816]: Connection from 127.0.0.1 port 41096 on 127.0.0.1 port 2222 rdomain \"\"",
      "raw_message": "Oct 10 19:11:19 cybery-ssh-lab auth.info sshd-session[1816]: Connection from 127.0.0.1 port 41096 on 127.0.0.1 port 2222 rdomain \"\"",
      "reason": "Unrecognized SSH message or invalid endpoint."
    },
    {
      "source_line_number": 11,
      "source_line": "Oct 10 19:11:19 cybery-ssh-lab auth.info sshd-session[1816]: User child is on pid 1820",
      "raw_message": "Oct 10 19:11:19 cybery-ssh-lab auth.info sshd-session[1816]: User child is on pid 1820",
      "reason": "Unrecognized SSH message or invalid endpoint."
    },
    {
      "source_line_number": 12,
      "source_line": "Oct 10 19:11:19 cybery-ssh-lab auth.info sshd-session[1820]: Starting session: command for labuser from 127.0.0.1 port 41096 id 0",
      "raw_message": "Oct 10 19:11:19 cybery-ssh-lab auth.info sshd-session[1820]: Starting session: command for labuser from 127.0.0.1 port 41096 id 0",
      "reason": "Unrecognized SSH message or invalid endpoint."
    },
    {
      "source_line_number": 15,
      "source_line": "Oct 10 19:11:19 cybery-ssh-lab auth.info sshd-session[1825]: Connection from 127.0.0.1 port 41104 on 127.0.0.1 port 2222 rdomain \"\"",
      "raw_message": "Oct 10 19:11:19 cybery-ssh-lab auth.info sshd-session[1825]: Connection from 127.0.0.1 port 41104 on 127.0.0.1 port 2222 rdomain \"\"",
      "reason": "Unrecognized SSH message or invalid endpoint."
    },
    {
      "source_line_number": 17,
      "source_line": "Oct 10 19:11:19 cybery-ssh-lab auth.err sshd-session[1825]: error: maximum authentication attempts exceeded for labuser from 127.0.0.1 port 41104 ssh2 [preauth]",
      "raw_message": "Oct 10 19:11:19 cybery-ssh-lab auth.err sshd-session[1825]: error: maximum authentication attempts exceeded for labuser from 127.0.0.1 port 41104 ssh2 [preauth]",
      "reason": "Unrecognized SSH message or invalid endpoint."
    },
    {
      "source_line_number": 20,
      "source_line": "Oct 10 19:12:24 cybery-ssh-lab auth.info sshd-session[1833]: Connection from 127.0.0.1 port 55774 on 127.0.0.1 port 2222 rdomain \"\"",
      "raw_message": "Oct 10 19:12:24 cybery-ssh-lab auth.info sshd-session[1833]: Connection from 127.0.0.1 port 55774 on 127.0.0.1 port 2222 rdomain \"\"",
      "reason": "Unrecognized SSH message or invalid endpoint."
    },
    {
      "source_line_number": 22,
      "source_line": "Oct 10 19:12:24 cybery-ssh-lab auth.err sshd-session[1833]: error: maximum authentication attempts exceeded for labuser from 127.0.0.1 port 55774 ssh2 [preauth]",
      "raw_message": "Oct 10 19:12:24 cybery-ssh-lab auth.err sshd-session[1833]: error: maximum authentication attempts exceeded for labuser from 127.0.0.1 port 55774 ssh2 [preauth]",
      "reason": "Unrecognized SSH message or invalid endpoint."
    },
    {
      "source_line_number": 25,
      "source_line": "Oct 10 19:12:24 cybery-ssh-lab auth.info sshd-session[1840]: Connection from 127.0.0.1 port 55786 on 127.0.0.1 port 2222 rdomain \"\"",
      "raw_message": "Oct 10 19:12:24 cybery-ssh-lab auth.info sshd-session[1840]: Connection from 127.0.0.1 port 55786 on 127.0.0.1 port 2222 rdomain \"\"",
      "reason": "Unrecognized SSH message or invalid endpoint."
    },
    {
      "source_line_number": 27,
      "source_line": "Oct 10 19:12:24 cybery-ssh-lab auth.err sshd-session[1840]: error: maximum authentication attempts exceeded for labuser from 127.0.0.1 port 55786 ssh2 [preauth]",
      "raw_message": "Oct 10 19:12:24 cybery-ssh-lab auth.err sshd-session[1840]: error: maximum authentication attempts exceeded for labuser from 127.0.0.1 port 55786 ssh2 [preauth]",
      "reason": "Unrecognized SSH message or invalid endpoint."
    },
    {
      "source_line_number": 29,
      "source_line": "Oct 10 19:12:24 cybery-ssh-lab auth.info sshd-session[1847]: Connection from 127.0.0.1 port 55794 on 127.0.0.1 port 2222 rdomain \"\"",
      "raw_message": "Oct 10 19:12:24 cybery-ssh-lab auth.info sshd-session[1847]: Connection from 127.0.0.1 port 55794 on 127.0.0.1 port 2222 rdomain \"\"",
      "reason": "Unrecognized SSH message or invalid endpoint."
    },
    {
      "source_line_number": 31,
      "source_line": "Oct 10 19:12:24 cybery-ssh-lab auth.err sshd-session[1847]: error: maximum authentication attempts exceeded for labuser from 127.0.0.1 port 55794 ssh2 [preauth]",
      "raw_message": "Oct 10 19:12:24 cybery-ssh-lab auth.err sshd-session[1847]: error: maximum authentication attempts exceeded for labuser from 127.0.0.1 port 55794 ssh2 [preauth]",
      "reason": "Unrecognized SSH message or invalid endpoint."
    },
    {
      "source_line_number": 33,
      "source_line": "Oct 10 19:12:24 cybery-ssh-lab auth.info sshd-session[1854]: Connection from 127.0.0.1 port 55810 on 127.0.0.1 port 2222 rdomain \"\"",
      "raw_message": "Oct 10 19:12:24 cybery-ssh-lab auth.info sshd-session[1854]: Connection from 127.0.0.1 port 55810 on 127.0.0.1 port 2222 rdomain \"\"",
      "reason": "Unrecognized SSH message or invalid endpoint."
    },
    {
      "source_line_number": 35,
      "source_line": "Oct 10 19:12:25 cybery-ssh-lab auth.err sshd-session[1854]: error: maximum authentication attempts exceeded for labuser from 127.0.0.1 port 55810 ssh2 [preauth]",
      "raw_message": "Oct 10 19:12:25 cybery-ssh-lab auth.err sshd-session[1854]: error: maximum authentication attempts exceeded for labuser from 127.0.0.1 port 55810 ssh2 [preauth]",
      "reason": "Unrecognized SSH message or invalid endpoint."
    },
    {
      "source_line_number": 45,
      "source_line": "Oct 10 19:14:10 cybery-ssh-lab auth.info sshd[1792]: Received signal 15; terminating.",
      "raw_message": "Oct 10 19:14:10 cybery-ssh-lab auth.info sshd[1792]: Received signal 15; terminating.",
      "reason": "Unrecognized SSH message or invalid endpoint."
    }
  ],
  "interpretation": {
    "authentication_counting": "Each Failed/Accepted daemon record is counted once; Invalid user and PAM notices are contextual records, not additional failed attempts.",
    "alerts": "Qualifying rolling-window endpoints can overlap. They are review candidates, not distinct incidents or proof of compromise.",
    "integrity": "SHA-256 verifies the bytes against this report; it does not independently establish authenticity, completeness, origin, or clock accuracy."
  }
}