{
  "schema_version": 1,
  "tool": {
    "name": "CYBERY di Mariani Yuri SSH Forensic Analyzer",
    "version": "1.0.1"
  },
  "source": {
    "filename": "sshd-syslog.log",
    "sha256": "b6d85e3d58d5cf626d30a8195a23ba50ea466ce4cd186b4a93ce60c016fa2d07",
    "bytes": 9870,
    "encoding": "UTF-8, replacement decoding if malformed",
    "decoding_replacement_characters": 0,
    "bsd_year": 2026,
    "bsd_timezone": "UTC"
  },
  "coverage": {
    "total_lines": 74,
    "unrelated_lines": 2,
    "unparsed_ssh_lines": 37,
    "parsed_event_lines": 35,
    "blank_lines": 0,
    "malformed_json_lines": 0
  },
  "parameters": {
    "threshold": 5,
    "window_seconds": 60,
    "inclusive_window": true
  },
  "statistics": {
    "event_count": 35,
    "counts_by_kind": {
      "authentication_failure": 11,
      "authentication_success": 3,
      "disconnect": 17,
      "invalid_user_notice": 4
    },
    "counts_by_method": {
      "password": 14
    },
    "timestamp_origins": {
      "daemon_native": 35
    },
    "first_timestamp": "2026-10-10T19:15:20Z",
    "last_timestamp": "2026-10-10T19:16:26Z",
    "invalid_account_failures": 4,
    "by_source": {
      "127.0.0.1": {
        "authentication_failure": 11,
        "authentication_success": 3,
        "disconnect": 17,
        "invalid_user_notice": 4
      }
    },
    "by_utc_hour": {
      "2026-10-10T19:00:00Z": {
        "authentication_failure": 11,
        "authentication_success": 3,
        "disconnect": 17,
        "invalid_user_notice": 4
      }
    },
    "by_utc_minute": {
      "2026-10-10T19:15:00Z": {
        "authentication_failure": 1,
        "authentication_success": 2,
        "disconnect": 5
      },
      "2026-10-10T19:16:00Z": {
        "authentication_failure": 10,
        "authentication_success": 1,
        "disconnect": 12,
        "invalid_user_notice": 4
      }
    },
    "by_supplied_scenario": {}
  },
  "alerts": [
    {
      "rule": "concentrated_failures",
      "classification": "review_candidate",
      "event_id": "L00000036",
      "timestamp": "2026-10-10T19:16:26Z",
      "source_address": "127.0.0.1",
      "user": null,
      "failure_count": 5,
      "window_seconds": 60,
      "threshold": 5,
      "first_failure_timestamp": "2026-10-10T19:16:26Z",
      "evidence_event_ids": [
        "L00000020",
        "L00000024",
        "L00000028",
        "L00000032",
        "L00000036"
      ]
    },
    {
      "rule": "concentrated_failures",
      "classification": "review_candidate",
      "event_id": "L00000040",
      "timestamp": "2026-10-10T19:16:26Z",
      "source_address": "127.0.0.1",
      "user": null,
      "failure_count": 6,
      "window_seconds": 60,
      "threshold": 5,
      "first_failure_timestamp": "2026-10-10T19:16:26Z",
      "evidence_event_ids": [
        "L00000020",
        "L00000024",
        "L00000028",
        "L00000032",
        "L00000036",
        "L00000040"
      ]
    },
    {
      "rule": "concentrated_failures",
      "classification": "review_candidate",
      "event_id": "L00000046",
      "timestamp": "2026-10-10T19:16:26Z",
      "source_address": "127.0.0.1",
      "user": null,
      "failure_count": 7,
      "window_seconds": 60,
      "threshold": 5,
      "first_failure_timestamp": "2026-10-10T19:16:26Z",
      "evidence_event_ids": [
        "L00000020",
        "L00000024",
        "L00000028",
        "L00000032",
        "L00000036",
        "L00000040",
        "L00000046"
      ]
    },
    {
      "rule": "concentrated_failures",
      "classification": "review_candidate",
      "event_id": "L00000052",
      "timestamp": "2026-10-10T19:16:26Z",
      "source_address": "127.0.0.1",
      "user": null,
      "failure_count": 8,
      "window_seconds": 60,
      "threshold": 5,
      "first_failure_timestamp": "2026-10-10T19:16:26Z",
      "evidence_event_ids": [
        "L00000020",
        "L00000024",
        "L00000028",
        "L00000032",
        "L00000036",
        "L00000040",
        "L00000046",
        "L00000052"
      ]
    },
    {
      "rule": "concentrated_failures",
      "classification": "review_candidate",
      "event_id": "L00000058",
      "timestamp": "2026-10-10T19:16:26Z",
      "source_address": "127.0.0.1",
      "user": null,
      "failure_count": 9,
      "window_seconds": 60,
      "threshold": 5,
      "first_failure_timestamp": "2026-10-10T19:16:26Z",
      "evidence_event_ids": [
        "L00000020",
        "L00000024",
        "L00000028",
        "L00000032",
        "L00000036",
        "L00000040",
        "L00000046",
        "L00000052",
        "L00000058"
      ]
    },
    {
      "rule": "concentrated_failures",
      "classification": "review_candidate",
      "event_id": "L00000064",
      "timestamp": "2026-10-10T19:16:26Z",
      "source_address": "127.0.0.1",
      "user": null,
      "failure_count": 10,
      "window_seconds": 60,
      "threshold": 5,
      "first_failure_timestamp": "2026-10-10T19:16:26Z",
      "evidence_event_ids": [
        "L00000020",
        "L00000024",
        "L00000028",
        "L00000032",
        "L00000036",
        "L00000040",
        "L00000046",
        "L00000052",
        "L00000058",
        "L00000064"
      ]
    },
    {
      "rule": "success_after_failures",
      "classification": "review_candidate_not_proof_of_compromise",
      "event_id": "L00000068",
      "timestamp": "2026-10-10T19:16:26Z",
      "source_address": "127.0.0.1",
      "user": "labuser",
      "failure_count": 6,
      "window_seconds": 60,
      "threshold": 5,
      "first_failure_timestamp": "2026-10-10T19:16:26Z",
      "evidence_event_ids": [
        "L00000020",
        "L00000024",
        "L00000028",
        "L00000032",
        "L00000036",
        "L00000040",
        "L00000068"
      ]
    }
  ],
  "threshold_sensitivity": [
    {
      "threshold": 3,
      "qualifying_failure_endpoints": 8,
      "sources_with_concentrated_failures": 1,
      "success_after_failure_review_candidates": 1
    },
    {
      "threshold": 5,
      "qualifying_failure_endpoints": 6,
      "sources_with_concentrated_failures": 1,
      "success_after_failure_review_candidates": 1
    },
    {
      "threshold": 8,
      "qualifying_failure_endpoints": 3,
      "sources_with_concentrated_failures": 1,
      "success_after_failure_review_candidates": 0
    }
  ],
  "warnings": [
    "Some records were not parsed. Review unparsed_records before treating event counts as complete.",
    "BSD timestamps have an analyst-supplied year and fixed timezone offset; neither is established by the log bytes alone."
  ],
  "events": [
    {
      "kind": "authentication_success",
      "method": "password",
      "user": "labuser",
      "source_address": "127.0.0.1",
      "source_port": 40318,
      "invalid_user": false,
      "event_id": "L00000004",
      "source_line_number": 4,
      "source_line": "Oct 10 19:15:20 cybery-ssh-lab auth.info sshd-session[1807]: Accepted password for labuser from 127.0.0.1 port 40318 ssh2",
      "raw_message": "Oct 10 19:15:20 cybery-ssh-lab auth.info sshd-session[1807]: Accepted password for labuser from 127.0.0.1 port 40318 ssh2",
      "message": "Accepted password for labuser from 127.0.0.1 port 40318 ssh2",
      "timestamp": "2026-10-10T19:15:20Z",
      "timestamp_origin": "daemon_native",
      "original_timestamp": "Oct 10 19:15:20",
      "collector_received_at": null,
      "pid": 1807,
      "daemon": "sshd-session",
      "host": "cybery-ssh-lab",
      "scenario": null,
      "source_network": null,
      "penalty_state": null,
      "penalty_seconds": null,
      "policy_reason": null,
      "destination_address": null,
      "destination_port": null,
      "connection_index": null
    },
    {
      "kind": "disconnect",
      "method": null,
      "user": null,
      "source_address": "127.0.0.1",
      "source_port": 40318,
      "invalid_user": false,
      "event_id": "L00000007",
      "source_line_number": 7,
      "source_line": "Oct 10 19:15:20 cybery-ssh-lab auth.info sshd-session[1811]: Received disconnect from 127.0.0.1 port 40318:11: disconnected by user",
      "raw_message": "Oct 10 19:15:20 cybery-ssh-lab auth.info sshd-session[1811]: Received disconnect from 127.0.0.1 port 40318:11: disconnected by user",
      "message": "Received disconnect from 127.0.0.1 port 40318:11: disconnected by user",
      "timestamp": "2026-10-10T19:15:20Z",
      "timestamp_origin": "daemon_native",
      "original_timestamp": "Oct 10 19:15:20",
      "collector_received_at": null,
      "pid": 1811,
      "daemon": "sshd-session",
      "host": "cybery-ssh-lab",
      "scenario": null,
      "source_network": null,
      "penalty_state": null,
      "penalty_seconds": null,
      "policy_reason": null,
      "destination_address": null,
      "destination_port": null,
      "connection_index": null
    },
    {
      "kind": "disconnect",
      "method": null,
      "user": "labuser",
      "source_address": "127.0.0.1",
      "source_port": 40318,
      "invalid_user": false,
      "event_id": "L00000008",
      "source_line_number": 8,
      "source_line": "Oct 10 19:15:20 cybery-ssh-lab auth.info sshd-session[1811]: Disconnected from user labuser 127.0.0.1 port 40318",
      "raw_message": "Oct 10 19:15:20 cybery-ssh-lab auth.info sshd-session[1811]: Disconnected from user labuser 127.0.0.1 port 40318",
      "message": "Disconnected from user labuser 127.0.0.1 port 40318",
      "timestamp": "2026-10-10T19:15:20Z",
      "timestamp_origin": "daemon_native",
      "original_timestamp": "Oct 10 19:15:20",
      "collector_received_at": null,
      "pid": 1811,
      "daemon": "sshd-session",
      "host": "cybery-ssh-lab",
      "scenario": null,
      "source_network": null,
      "penalty_state": null,
      "penalty_seconds": null,
      "policy_reason": null,
      "destination_address": null,
      "destination_port": null,
      "connection_index": null
    },
    {
      "kind": "authentication_success",
      "method": "password",
      "user": "labuser",
      "source_address": "127.0.0.1",
      "source_port": 40322,
      "invalid_user": false,
      "event_id": "L00000010",
      "source_line_number": 10,
      "source_line": "Oct 10 19:15:21 cybery-ssh-lab auth.info sshd-session[1816]: Accepted password for labuser from 127.0.0.1 port 40322 ssh2",
      "raw_message": "Oct 10 19:15:21 cybery-ssh-lab auth.info sshd-session[1816]: Accepted password for labuser from 127.0.0.1 port 40322 ssh2",
      "message": "Accepted password for labuser from 127.0.0.1 port 40322 ssh2",
      "timestamp": "2026-10-10T19:15:21Z",
      "timestamp_origin": "daemon_native",
      "original_timestamp": "Oct 10 19:15:21",
      "collector_received_at": null,
      "pid": 1816,
      "daemon": "sshd-session",
      "host": "cybery-ssh-lab",
      "scenario": null,
      "source_network": null,
      "penalty_state": null,
      "penalty_seconds": null,
      "policy_reason": null,
      "destination_address": null,
      "destination_port": null,
      "connection_index": null
    },
    {
      "kind": "disconnect",
      "method": null,
      "user": null,
      "source_address": "127.0.0.1",
      "source_port": 40322,
      "invalid_user": false,
      "event_id": "L00000013",
      "source_line_number": 13,
      "source_line": "Oct 10 19:15:21 cybery-ssh-lab auth.info sshd-session[1820]: Received disconnect from 127.0.0.1 port 40322:11: disconnected by user",
      "raw_message": "Oct 10 19:15:21 cybery-ssh-lab auth.info sshd-session[1820]: Received disconnect from 127.0.0.1 port 40322:11: disconnected by user",
      "message": "Received disconnect from 127.0.0.1 port 40322:11: disconnected by user",
      "timestamp": "2026-10-10T19:15:21Z",
      "timestamp_origin": "daemon_native",
      "original_timestamp": "Oct 10 19:15:21",
      "collector_received_at": null,
      "pid": 1820,
      "daemon": "sshd-session",
      "host": "cybery-ssh-lab",
      "scenario": null,
      "source_network": null,
      "penalty_state": null,
      "penalty_seconds": null,
      "policy_reason": null,
      "destination_address": null,
      "destination_port": null,
      "connection_index": null
    },
    {
      "kind": "disconnect",
      "method": null,
      "user": "labuser",
      "source_address": "127.0.0.1",
      "source_port": 40322,
      "invalid_user": false,
      "event_id": "L00000014",
      "source_line_number": 14,
      "source_line": "Oct 10 19:15:21 cybery-ssh-lab auth.info sshd-session[1820]: Disconnected from user labuser 127.0.0.1 port 40322",
      "raw_message": "Oct 10 19:15:21 cybery-ssh-lab auth.info sshd-session[1820]: Disconnected from user labuser 127.0.0.1 port 40322",
      "message": "Disconnected from user labuser 127.0.0.1 port 40322",
      "timestamp": "2026-10-10T19:15:21Z",
      "timestamp_origin": "daemon_native",
      "original_timestamp": "Oct 10 19:15:21",
      "collector_received_at": null,
      "pid": 1820,
      "daemon": "sshd-session",
      "host": "cybery-ssh-lab",
      "scenario": null,
      "source_network": null,
      "penalty_state": null,
      "penalty_seconds": null,
      "policy_reason": null,
      "destination_address": null,
      "destination_port": null,
      "connection_index": null
    },
    {
      "kind": "authentication_failure",
      "method": "password",
      "user": "labuser",
      "source_address": "127.0.0.1",
      "source_port": 40324,
      "invalid_user": false,
      "event_id": "L00000016",
      "source_line_number": 16,
      "source_line": "Oct 10 19:15:21 cybery-ssh-lab auth.info sshd-session[1825]: Failed password for labuser from 127.0.0.1 port 40324 ssh2",
      "raw_message": "Oct 10 19:15:21 cybery-ssh-lab auth.info sshd-session[1825]: Failed password for labuser from 127.0.0.1 port 40324 ssh2",
      "message": "Failed password for labuser from 127.0.0.1 port 40324 ssh2",
      "timestamp": "2026-10-10T19:15:21Z",
      "timestamp_origin": "daemon_native",
      "original_timestamp": "Oct 10 19:15:21",
      "collector_received_at": null,
      "pid": 1825,
      "daemon": "sshd-session",
      "host": "cybery-ssh-lab",
      "scenario": null,
      "source_network": null,
      "penalty_state": null,
      "penalty_seconds": null,
      "policy_reason": null,
      "destination_address": null,
      "destination_port": null,
      "connection_index": null
    },
    {
      "kind": "disconnect",
      "method": null,
      "user": "labuser",
      "source_address": "127.0.0.1",
      "source_port": 40324,
      "invalid_user": false,
      "event_id": "L00000018",
      "source_line_number": 18,
      "source_line": "Oct 10 19:15:21 cybery-ssh-lab auth.info sshd-session[1825]: Disconnecting authenticating user labuser 127.0.0.1 port 40324: Too many authentication failures [preauth]",
      "raw_message": "Oct 10 19:15:21 cybery-ssh-lab auth.info sshd-session[1825]: Disconnecting authenticating user labuser 127.0.0.1 port 40324: Too many authentication failures [preauth]",
      "message": "Disconnecting authenticating user labuser 127.0.0.1 port 40324: Too many authentication failures [preauth]",
      "timestamp": "2026-10-10T19:15:21Z",
      "timestamp_origin": "daemon_native",
      "original_timestamp": "Oct 10 19:15:21",
      "collector_received_at": null,
      "pid": 1825,
      "daemon": "sshd-session",
      "host": "cybery-ssh-lab",
      "scenario": null,
      "source_network": null,
      "penalty_state": null,
      "penalty_seconds": null,
      "policy_reason": null,
      "destination_address": null,
      "destination_port": null,
      "connection_index": null
    },
    {
      "kind": "authentication_failure",
      "method": "password",
      "user": "labuser",
      "source_address": "127.0.0.1",
      "source_port": 51014,
      "invalid_user": false,
      "event_id": "L00000020",
      "source_line_number": 20,
      "source_line": "Oct 10 19:16:26 cybery-ssh-lab auth.info sshd-session[1833]: Failed password for labuser from 127.0.0.1 port 51014 ssh2",
      "raw_message": "Oct 10 19:16:26 cybery-ssh-lab auth.info sshd-session[1833]: Failed password for labuser from 127.0.0.1 port 51014 ssh2",
      "message": "Failed password for labuser from 127.0.0.1 port 51014 ssh2",
      "timestamp": "2026-10-10T19:16:26Z",
      "timestamp_origin": "daemon_native",
      "original_timestamp": "Oct 10 19:16:26",
      "collector_received_at": null,
      "pid": 1833,
      "daemon": "sshd-session",
      "host": "cybery-ssh-lab",
      "scenario": null,
      "source_network": null,
      "penalty_state": null,
      "penalty_seconds": null,
      "policy_reason": null,
      "destination_address": null,
      "destination_port": null,
      "connection_index": null
    },
    {
      "kind": "disconnect",
      "method": null,
      "user": "labuser",
      "source_address": "127.0.0.1",
      "source_port": 51014,
      "invalid_user": false,
      "event_id": "L00000022",
      "source_line_number": 22,
      "source_line": "Oct 10 19:16:26 cybery-ssh-lab auth.info sshd-session[1833]: Disconnecting authenticating user labuser 127.0.0.1 port 51014: Too many authentication failures [preauth]",
      "raw_message": "Oct 10 19:16:26 cybery-ssh-lab auth.info sshd-session[1833]: Disconnecting authenticating user labuser 127.0.0.1 port 51014: Too many authentication failures [preauth]",
      "message": "Disconnecting authenticating user labuser 127.0.0.1 port 51014: Too many authentication failures [preauth]",
      "timestamp": "2026-10-10T19:16:26Z",
      "timestamp_origin": "daemon_native",
      "original_timestamp": "Oct 10 19:16:26",
      "collector_received_at": null,
      "pid": 1833,
      "daemon": "sshd-session",
      "host": "cybery-ssh-lab",
      "scenario": null,
      "source_network": null,
      "penalty_state": null,
      "penalty_seconds": null,
      "policy_reason": null,
      "destination_address": null,
      "destination_port": null,
      "connection_index": null
    },
    {
      "kind": "authentication_failure",
      "method": "password",
      "user": "labuser",
      "source_address": "127.0.0.1",
      "source_port": 51028,
      "invalid_user": false,
      "event_id": "L00000024",
      "source_line_number": 24,
      "source_line": "Oct 10 19:16:26 cybery-ssh-lab auth.info sshd-session[1840]: Failed password for labuser from 127.0.0.1 port 51028 ssh2",
      "raw_message": "Oct 10 19:16:26 cybery-ssh-lab auth.info sshd-session[1840]: Failed password for labuser from 127.0.0.1 port 51028 ssh2",
      "message": "Failed password for labuser from 127.0.0.1 port 51028 ssh2",
      "timestamp": "2026-10-10T19:16:26Z",
      "timestamp_origin": "daemon_native",
      "original_timestamp": "Oct 10 19:16:26",
      "collector_received_at": null,
      "pid": 1840,
      "daemon": "sshd-session",
      "host": "cybery-ssh-lab",
      "scenario": null,
      "source_network": null,
      "penalty_state": null,
      "penalty_seconds": null,
      "policy_reason": null,
      "destination_address": null,
      "destination_port": null,
      "connection_index": null
    },
    {
      "kind": "disconnect",
      "method": null,
      "user": "labuser",
      "source_address": "127.0.0.1",
      "source_port": 51028,
      "invalid_user": false,
      "event_id": "L00000026",
      "source_line_number": 26,
      "source_line": "Oct 10 19:16:26 cybery-ssh-lab auth.info sshd-session[1840]: Disconnecting authenticating user labuser 127.0.0.1 port 51028: Too many authentication failures [preauth]",
      "raw_message": "Oct 10 19:16:26 cybery-ssh-lab auth.info sshd-session[1840]: Disconnecting authenticating user labuser 127.0.0.1 port 51028: Too many authentication failures [preauth]",
      "message": "Disconnecting authenticating user labuser 127.0.0.1 port 51028: Too many authentication failures [preauth]",
      "timestamp": "2026-10-10T19:16:26Z",
      "timestamp_origin": "daemon_native",
      "original_timestamp": "Oct 10 19:16:26",
      "collector_received_at": null,
      "pid": 1840,
      "daemon": "sshd-session",
      "host": "cybery-ssh-lab",
      "scenario": null,
      "source_network": null,
      "penalty_state": null,
      "penalty_seconds": null,
      "policy_reason": null,
      "destination_address": null,
      "destination_port": null,
      "connection_index": null
    },
    {
      "kind": "authentication_failure",
      "method": "password",
      "user": "labuser",
      "source_address": "127.0.0.1",
      "source_port": 51044,
      "invalid_user": false,
      "event_id": "L00000028",
      "source_line_number": 28,
      "source_line": "Oct 10 19:16:26 cybery-ssh-lab auth.info sshd-session[1847]: Failed password for labuser from 127.0.0.1 port 51044 ssh2",
      "raw_message": "Oct 10 19:16:26 cybery-ssh-lab auth.info sshd-session[1847]: Failed password for labuser from 127.0.0.1 port 51044 ssh2",
      "message": "Failed password for labuser from 127.0.0.1 port 51044 ssh2",
      "timestamp": "2026-10-10T19:16:26Z",
      "timestamp_origin": "daemon_native",
      "original_timestamp": "Oct 10 19:16:26",
      "collector_received_at": null,
      "pid": 1847,
      "daemon": "sshd-session",
      "host": "cybery-ssh-lab",
      "scenario": null,
      "source_network": null,
      "penalty_state": null,
      "penalty_seconds": null,
      "policy_reason": null,
      "destination_address": null,
      "destination_port": null,
      "connection_index": null
    },
    {
      "kind": "disconnect",
      "method": null,
      "user": "labuser",
      "source_address": "127.0.0.1",
      "source_port": 51044,
      "invalid_user": false,
      "event_id": "L00000030",
      "source_line_number": 30,
      "source_line": "Oct 10 19:16:26 cybery-ssh-lab auth.info sshd-session[1847]: Disconnecting authenticating user labuser 127.0.0.1 port 51044: Too many authentication failures [preauth]",
      "raw_message": "Oct 10 19:16:26 cybery-ssh-lab auth.info sshd-session[1847]: Disconnecting authenticating user labuser 127.0.0.1 port 51044: Too many authentication failures [preauth]",
      "message": "Disconnecting authenticating user labuser 127.0.0.1 port 51044: Too many authentication failures [preauth]",
      "timestamp": "2026-10-10T19:16:26Z",
      "timestamp_origin": "daemon_native",
      "original_timestamp": "Oct 10 19:16:26",
      "collector_received_at": null,
      "pid": 1847,
      "daemon": "sshd-session",
      "host": "cybery-ssh-lab",
      "scenario": null,
      "source_network": null,
      "penalty_state": null,
      "penalty_seconds": null,
      "policy_reason": null,
      "destination_address": null,
      "destination_port": null,
      "connection_index": null
    },
    {
      "kind": "authentication_failure",
      "method": "password",
      "user": "labuser",
      "source_address": "127.0.0.1",
      "source_port": 51054,
      "invalid_user": false,
      "event_id": "L00000032",
      "source_line_number": 32,
      "source_line": "Oct 10 19:16:26 cybery-ssh-lab auth.info sshd-session[1854]: Failed password for labuser from 127.0.0.1 port 51054 ssh2",
      "raw_message": "Oct 10 19:16:26 cybery-ssh-lab auth.info sshd-session[1854]: Failed password for labuser from 127.0.0.1 port 51054 ssh2",
      "message": "Failed password for labuser from 127.0.0.1 port 51054 ssh2",
      "timestamp": "2026-10-10T19:16:26Z",
      "timestamp_origin": "daemon_native",
      "original_timestamp": "Oct 10 19:16:26",
      "collector_received_at": null,
      "pid": 1854,
      "daemon": "sshd-session",
      "host": "cybery-ssh-lab",
      "scenario": null,
      "source_network": null,
      "penalty_state": null,
      "penalty_seconds": null,
      "policy_reason": null,
      "destination_address": null,
      "destination_port": null,
      "connection_index": null
    },
    {
      "kind": "disconnect",
      "method": null,
      "user": "labuser",
      "source_address": "127.0.0.1",
      "source_port": 51054,
      "invalid_user": false,
      "event_id": "L00000034",
      "source_line_number": 34,
      "source_line": "Oct 10 19:16:26 cybery-ssh-lab auth.info sshd-session[1854]: Disconnecting authenticating user labuser 127.0.0.1 port 51054: Too many authentication failures [preauth]",
      "raw_message": "Oct 10 19:16:26 cybery-ssh-lab auth.info sshd-session[1854]: Disconnecting authenticating user labuser 127.0.0.1 port 51054: Too many authentication failures [preauth]",
      "message": "Disconnecting authenticating user labuser 127.0.0.1 port 51054: Too many authentication failures [preauth]",
      "timestamp": "2026-10-10T19:16:26Z",
      "timestamp_origin": "daemon_native",
      "original_timestamp": "Oct 10 19:16:26",
      "collector_received_at": null,
      "pid": 1854,
      "daemon": "sshd-session",
      "host": "cybery-ssh-lab",
      "scenario": null,
      "source_network": null,
      "penalty_state": null,
      "penalty_seconds": null,
      "policy_reason": null,
      "destination_address": null,
      "destination_port": null,
      "connection_index": null
    },
    {
      "kind": "authentication_failure",
      "method": "password",
      "user": "labuser",
      "source_address": "127.0.0.1",
      "source_port": 51056,
      "invalid_user": false,
      "event_id": "L00000036",
      "source_line_number": 36,
      "source_line": "Oct 10 19:16:26 cybery-ssh-lab auth.info sshd-session[1861]: Failed password for labuser from 127.0.0.1 port 51056 ssh2",
      "raw_message": "Oct 10 19:16:26 cybery-ssh-lab auth.info sshd-session[1861]: Failed password for labuser from 127.0.0.1 port 51056 ssh2",
      "message": "Failed password for labuser from 127.0.0.1 port 51056 ssh2",
      "timestamp": "2026-10-10T19:16:26Z",
      "timestamp_origin": "daemon_native",
      "original_timestamp": "Oct 10 19:16:26",
      "collector_received_at": null,
      "pid": 1861,
      "daemon": "sshd-session",
      "host": "cybery-ssh-lab",
      "scenario": null,
      "source_network": null,
      "penalty_state": null,
      "penalty_seconds": null,
      "policy_reason": null,
      "destination_address": null,
      "destination_port": null,
      "connection_index": null
    },
    {
      "kind": "disconnect",
      "method": null,
      "user": "labuser",
      "source_address": "127.0.0.1",
      "source_port": 51056,
      "invalid_user": false,
      "event_id": "L00000038",
      "source_line_number": 38,
      "source_line": "Oct 10 19:16:26 cybery-ssh-lab auth.info sshd-session[1861]: Disconnecting authenticating user labuser 127.0.0.1 port 51056: Too many authentication failures [preauth]",
      "raw_message": "Oct 10 19:16:26 cybery-ssh-lab auth.info sshd-session[1861]: Disconnecting authenticating user labuser 127.0.0.1 port 51056: Too many authentication failures [preauth]",
      "message": "Disconnecting authenticating user labuser 127.0.0.1 port 51056: Too many authentication failures [preauth]",
      "timestamp": "2026-10-10T19:16:26Z",
      "timestamp_origin": "daemon_native",
      "original_timestamp": "Oct 10 19:16:26",
      "collector_received_at": null,
      "pid": 1861,
      "daemon": "sshd-session",
      "host": "cybery-ssh-lab",
      "scenario": null,
      "source_network": null,
      "penalty_state": null,
      "penalty_seconds": null,
      "policy_reason": null,
      "destination_address": null,
      "destination_port": null,
      "connection_index": null
    },
    {
      "kind": "authentication_failure",
      "method": "password",
      "user": "labuser",
      "source_address": "127.0.0.1",
      "source_port": 51072,
      "invalid_user": false,
      "event_id": "L00000040",
      "source_line_number": 40,
      "source_line": "Oct 10 19:16:26 cybery-ssh-lab auth.info sshd-session[1868]: Failed password for labuser from 127.0.0.1 port 51072 ssh2",
      "raw_message": "Oct 10 19:16:26 cybery-ssh-lab auth.info sshd-session[1868]: Failed password for labuser from 127.0.0.1 port 51072 ssh2",
      "message": "Failed password for labuser from 127.0.0.1 port 51072 ssh2",
      "timestamp": "2026-10-10T19:16:26Z",
      "timestamp_origin": "daemon_native",
      "original_timestamp": "Oct 10 19:16:26",
      "collector_received_at": null,
      "pid": 1868,
      "daemon": "sshd-session",
      "host": "cybery-ssh-lab",
      "scenario": null,
      "source_network": null,
      "penalty_state": null,
      "penalty_seconds": null,
      "policy_reason": null,
      "destination_address": null,
      "destination_port": null,
      "connection_index": null
    },
    {
      "kind": "disconnect",
      "method": null,
      "user": "labuser",
      "source_address": "127.0.0.1",
      "source_port": 51072,
      "invalid_user": false,
      "event_id": "L00000042",
      "source_line_number": 42,
      "source_line": "Oct 10 19:16:26 cybery-ssh-lab auth.info sshd-session[1868]: Disconnecting authenticating user labuser 127.0.0.1 port 51072: Too many authentication failures [preauth]",
      "raw_message": "Oct 10 19:16:26 cybery-ssh-lab auth.info sshd-session[1868]: Disconnecting authenticating user labuser 127.0.0.1 port 51072: Too many authentication failures [preauth]",
      "message": "Disconnecting authenticating user labuser 127.0.0.1 port 51072: Too many authentication failures [preauth]",
      "timestamp": "2026-10-10T19:16:26Z",
      "timestamp_origin": "daemon_native",
      "original_timestamp": "Oct 10 19:16:26",
      "collector_received_at": null,
      "pid": 1868,
      "daemon": "sshd-session",
      "host": "cybery-ssh-lab",
      "scenario": null,
      "source_network": null,
      "penalty_state": null,
      "penalty_seconds": null,
      "policy_reason": null,
      "destination_address": null,
      "destination_port": null,
      "connection_index": null
    },
    {
      "kind": "invalid_user_notice",
      "method": null,
      "user": "invaliduser",
      "source_address": "127.0.0.1",
      "source_port": 51076,
      "invalid_user": true,
      "event_id": "L00000044",
      "source_line_number": 44,
      "source_line": "Oct 10 19:16:26 cybery-ssh-lab auth.info sshd-session[1875]: Invalid user invaliduser from 127.0.0.1 port 51076",
      "raw_message": "Oct 10 19:16:26 cybery-ssh-lab auth.info sshd-session[1875]: Invalid user invaliduser from 127.0.0.1 port 51076",
      "message": "Invalid user invaliduser from 127.0.0.1 port 51076",
      "timestamp": "2026-10-10T19:16:26Z",
      "timestamp_origin": "daemon_native",
      "original_timestamp": "Oct 10 19:16:26",
      "collector_received_at": null,
      "pid": 1875,
      "daemon": "sshd-session",
      "host": "cybery-ssh-lab",
      "scenario": null,
      "source_network": null,
      "penalty_state": null,
      "penalty_seconds": null,
      "policy_reason": null,
      "destination_address": null,
      "destination_port": null,
      "connection_index": null
    },
    {
      "kind": "authentication_failure",
      "method": "password",
      "user": "invaliduser",
      "source_address": "127.0.0.1",
      "source_port": 51076,
      "invalid_user": true,
      "event_id": "L00000046",
      "source_line_number": 46,
      "source_line": "Oct 10 19:16:26 cybery-ssh-lab auth.info sshd-session[1875]: Failed password for invalid user invaliduser from 127.0.0.1 port 51076 ssh2",
      "raw_message": "Oct 10 19:16:26 cybery-ssh-lab auth.info sshd-session[1875]: Failed password for invalid user invaliduser from 127.0.0.1 port 51076 ssh2",
      "message": "Failed password for invalid user invaliduser from 127.0.0.1 port 51076 ssh2",
      "timestamp": "2026-10-10T19:16:26Z",
      "timestamp_origin": "daemon_native",
      "original_timestamp": "Oct 10 19:16:26",
      "collector_received_at": null,
      "pid": 1875,
      "daemon": "sshd-session",
      "host": "cybery-ssh-lab",
      "scenario": null,
      "source_network": null,
      "penalty_state": null,
      "penalty_seconds": null,
      "policy_reason": null,
      "destination_address": null,
      "destination_port": null,
      "connection_index": null
    },
    {
      "kind": "disconnect",
      "method": null,
      "user": "invaliduser",
      "source_address": "127.0.0.1",
      "source_port": 51076,
      "invalid_user": true,
      "event_id": "L00000048",
      "source_line_number": 48,
      "source_line": "Oct 10 19:16:26 cybery-ssh-lab auth.info sshd-session[1875]: Disconnecting invalid user invaliduser 127.0.0.1 port 51076: Too many authentication failures [preauth]",
      "raw_message": "Oct 10 19:16:26 cybery-ssh-lab auth.info sshd-session[1875]: Disconnecting invalid user invaliduser 127.0.0.1 port 51076: Too many authentication failures [preauth]",
      "message": "Disconnecting invalid user invaliduser 127.0.0.1 port 51076: Too many authentication failures [preauth]",
      "timestamp": "2026-10-10T19:16:26Z",
      "timestamp_origin": "daemon_native",
      "original_timestamp": "Oct 10 19:16:26",
      "collector_received_at": null,
      "pid": 1875,
      "daemon": "sshd-session",
      "host": "cybery-ssh-lab",
      "scenario": null,
      "source_network": null,
      "penalty_state": null,
      "penalty_seconds": null,
      "policy_reason": null,
      "destination_address": null,
      "destination_port": null,
      "connection_index": null
    },
    {
      "kind": "invalid_user_notice",
      "method": null,
      "user": "invaliduser",
      "source_address": "127.0.0.1",
      "source_port": 51088,
      "invalid_user": true,
      "event_id": "L00000050",
      "source_line_number": 50,
      "source_line": "Oct 10 19:16:26 cybery-ssh-lab auth.info sshd-session[1882]: Invalid user invaliduser from 127.0.0.1 port 51088",
      "raw_message": "Oct 10 19:16:26 cybery-ssh-lab auth.info sshd-session[1882]: Invalid user invaliduser from 127.0.0.1 port 51088",
      "message": "Invalid user invaliduser from 127.0.0.1 port 51088",
      "timestamp": "2026-10-10T19:16:26Z",
      "timestamp_origin": "daemon_native",
      "original_timestamp": "Oct 10 19:16:26",
      "collector_received_at": null,
      "pid": 1882,
      "daemon": "sshd-session",
      "host": "cybery-ssh-lab",
      "scenario": null,
      "source_network": null,
      "penalty_state": null,
      "penalty_seconds": null,
      "policy_reason": null,
      "destination_address": null,
      "destination_port": null,
      "connection_index": null
    },
    {
      "kind": "authentication_failure",
      "method": "password",
      "user": "invaliduser",
      "source_address": "127.0.0.1",
      "source_port": 51088,
      "invalid_user": true,
      "event_id": "L00000052",
      "source_line_number": 52,
      "source_line": "Oct 10 19:16:26 cybery-ssh-lab auth.info sshd-session[1882]: Failed password for invalid user invaliduser from 127.0.0.1 port 51088 ssh2",
      "raw_message": "Oct 10 19:16:26 cybery-ssh-lab auth.info sshd-session[1882]: Failed password for invalid user invaliduser from 127.0.0.1 port 51088 ssh2",
      "message": "Failed password for invalid user invaliduser from 127.0.0.1 port 51088 ssh2",
      "timestamp": "2026-10-10T19:16:26Z",
      "timestamp_origin": "daemon_native",
      "original_timestamp": "Oct 10 19:16:26",
      "collector_received_at": null,
      "pid": 1882,
      "daemon": "sshd-session",
      "host": "cybery-ssh-lab",
      "scenario": null,
      "source_network": null,
      "penalty_state": null,
      "penalty_seconds": null,
      "policy_reason": null,
      "destination_address": null,
      "destination_port": null,
      "connection_index": null
    },
    {
      "kind": "disconnect",
      "method": null,
      "user": "invaliduser",
      "source_address": "127.0.0.1",
      "source_port": 51088,
      "invalid_user": true,
      "event_id": "L00000054",
      "source_line_number": 54,
      "source_line": "Oct 10 19:16:26 cybery-ssh-lab auth.info sshd-session[1882]: Disconnecting invalid user invaliduser 127.0.0.1 port 51088: Too many authentication failures [preauth]",
      "raw_message": "Oct 10 19:16:26 cybery-ssh-lab auth.info sshd-session[1882]: Disconnecting invalid user invaliduser 127.0.0.1 port 51088: Too many authentication failures [preauth]",
      "message": "Disconnecting invalid user invaliduser 127.0.0.1 port 51088: Too many authentication failures [preauth]",
      "timestamp": "2026-10-10T19:16:26Z",
      "timestamp_origin": "daemon_native",
      "original_timestamp": "Oct 10 19:16:26",
      "collector_received_at": null,
      "pid": 1882,
      "daemon": "sshd-session",
      "host": "cybery-ssh-lab",
      "scenario": null,
      "source_network": null,
      "penalty_state": null,
      "penalty_seconds": null,
      "policy_reason": null,
      "destination_address": null,
      "destination_port": null,
      "connection_index": null
    },
    {
      "kind": "invalid_user_notice",
      "method": null,
      "user": "invaliduser",
      "source_address": "127.0.0.1",
      "source_port": 51098,
      "invalid_user": true,
      "event_id": "L00000056",
      "source_line_number": 56,
      "source_line": "Oct 10 19:16:26 cybery-ssh-lab auth.info sshd-session[1889]: Invalid user invaliduser from 127.0.0.1 port 51098",
      "raw_message": "Oct 10 19:16:26 cybery-ssh-lab auth.info sshd-session[1889]: Invalid user invaliduser from 127.0.0.1 port 51098",
      "message": "Invalid user invaliduser from 127.0.0.1 port 51098",
      "timestamp": "2026-10-10T19:16:26Z",
      "timestamp_origin": "daemon_native",
      "original_timestamp": "Oct 10 19:16:26",
      "collector_received_at": null,
      "pid": 1889,
      "daemon": "sshd-session",
      "host": "cybery-ssh-lab",
      "scenario": null,
      "source_network": null,
      "penalty_state": null,
      "penalty_seconds": null,
      "policy_reason": null,
      "destination_address": null,
      "destination_port": null,
      "connection_index": null
    },
    {
      "kind": "authentication_failure",
      "method": "password",
      "user": "invaliduser",
      "source_address": "127.0.0.1",
      "source_port": 51098,
      "invalid_user": true,
      "event_id": "L00000058",
      "source_line_number": 58,
      "source_line": "Oct 10 19:16:26 cybery-ssh-lab auth.info sshd-session[1889]: Failed password for invalid user invaliduser from 127.0.0.1 port 51098 ssh2",
      "raw_message": "Oct 10 19:16:26 cybery-ssh-lab auth.info sshd-session[1889]: Failed password for invalid user invaliduser from 127.0.0.1 port 51098 ssh2",
      "message": "Failed password for invalid user invaliduser from 127.0.0.1 port 51098 ssh2",
      "timestamp": "2026-10-10T19:16:26Z",
      "timestamp_origin": "daemon_native",
      "original_timestamp": "Oct 10 19:16:26",
      "collector_received_at": null,
      "pid": 1889,
      "daemon": "sshd-session",
      "host": "cybery-ssh-lab",
      "scenario": null,
      "source_network": null,
      "penalty_state": null,
      "penalty_seconds": null,
      "policy_reason": null,
      "destination_address": null,
      "destination_port": null,
      "connection_index": null
    },
    {
      "kind": "disconnect",
      "method": null,
      "user": "invaliduser",
      "source_address": "127.0.0.1",
      "source_port": 51098,
      "invalid_user": true,
      "event_id": "L00000060",
      "source_line_number": 60,
      "source_line": "Oct 10 19:16:26 cybery-ssh-lab auth.info sshd-session[1889]: Disconnecting invalid user invaliduser 127.0.0.1 port 51098: Too many authentication failures [preauth]",
      "raw_message": "Oct 10 19:16:26 cybery-ssh-lab auth.info sshd-session[1889]: Disconnecting invalid user invaliduser 127.0.0.1 port 51098: Too many authentication failures [preauth]",
      "message": "Disconnecting invalid user invaliduser 127.0.0.1 port 51098: Too many authentication failures [preauth]",
      "timestamp": "2026-10-10T19:16:26Z",
      "timestamp_origin": "daemon_native",
      "original_timestamp": "Oct 10 19:16:26",
      "collector_received_at": null,
      "pid": 1889,
      "daemon": "sshd-session",
      "host": "cybery-ssh-lab",
      "scenario": null,
      "source_network": null,
      "penalty_state": null,
      "penalty_seconds": null,
      "policy_reason": null,
      "destination_address": null,
      "destination_port": null,
      "connection_index": null
    },
    {
      "kind": "invalid_user_notice",
      "method": null,
      "user": "invaliduser",
      "source_address": "127.0.0.1",
      "source_port": 51112,
      "invalid_user": true,
      "event_id": "L00000062",
      "source_line_number": 62,
      "source_line": "Oct 10 19:16:26 cybery-ssh-lab auth.info sshd-session[1896]: Invalid user invaliduser from 127.0.0.1 port 51112",
      "raw_message": "Oct 10 19:16:26 cybery-ssh-lab auth.info sshd-session[1896]: Invalid user invaliduser from 127.0.0.1 port 51112",
      "message": "Invalid user invaliduser from 127.0.0.1 port 51112",
      "timestamp": "2026-10-10T19:16:26Z",
      "timestamp_origin": "daemon_native",
      "original_timestamp": "Oct 10 19:16:26",
      "collector_received_at": null,
      "pid": 1896,
      "daemon": "sshd-session",
      "host": "cybery-ssh-lab",
      "scenario": null,
      "source_network": null,
      "penalty_state": null,
      "penalty_seconds": null,
      "policy_reason": null,
      "destination_address": null,
      "destination_port": null,
      "connection_index": null
    },
    {
      "kind": "authentication_failure",
      "method": "password",
      "user": "invaliduser",
      "source_address": "127.0.0.1",
      "source_port": 51112,
      "invalid_user": true,
      "event_id": "L00000064",
      "source_line_number": 64,
      "source_line": "Oct 10 19:16:26 cybery-ssh-lab auth.info sshd-session[1896]: Failed password for invalid user invaliduser from 127.0.0.1 port 51112 ssh2",
      "raw_message": "Oct 10 19:16:26 cybery-ssh-lab auth.info sshd-session[1896]: Failed password for invalid user invaliduser from 127.0.0.1 port 51112 ssh2",
      "message": "Failed password for invalid user invaliduser from 127.0.0.1 port 51112 ssh2",
      "timestamp": "2026-10-10T19:16:26Z",
      "timestamp_origin": "daemon_native",
      "original_timestamp": "Oct 10 19:16:26",
      "collector_received_at": null,
      "pid": 1896,
      "daemon": "sshd-session",
      "host": "cybery-ssh-lab",
      "scenario": null,
      "source_network": null,
      "penalty_state": null,
      "penalty_seconds": null,
      "policy_reason": null,
      "destination_address": null,
      "destination_port": null,
      "connection_index": null
    },
    {
      "kind": "disconnect",
      "method": null,
      "user": "invaliduser",
      "source_address": "127.0.0.1",
      "source_port": 51112,
      "invalid_user": true,
      "event_id": "L00000066",
      "source_line_number": 66,
      "source_line": "Oct 10 19:16:26 cybery-ssh-lab auth.info sshd-session[1896]: Disconnecting invalid user invaliduser 127.0.0.1 port 51112: Too many authentication failures [preauth]",
      "raw_message": "Oct 10 19:16:26 cybery-ssh-lab auth.info sshd-session[1896]: Disconnecting invalid user invaliduser 127.0.0.1 port 51112: Too many authentication failures [preauth]",
      "message": "Disconnecting invalid user invaliduser 127.0.0.1 port 51112: Too many authentication failures [preauth]",
      "timestamp": "2026-10-10T19:16:26Z",
      "timestamp_origin": "daemon_native",
      "original_timestamp": "Oct 10 19:16:26",
      "collector_received_at": null,
      "pid": 1896,
      "daemon": "sshd-session",
      "host": "cybery-ssh-lab",
      "scenario": null,
      "source_network": null,
      "penalty_state": null,
      "penalty_seconds": null,
      "policy_reason": null,
      "destination_address": null,
      "destination_port": null,
      "connection_index": null
    },
    {
      "kind": "authentication_success",
      "method": "password",
      "user": "labuser",
      "source_address": "127.0.0.1",
      "source_port": 51114,
      "invalid_user": false,
      "event_id": "L00000068",
      "source_line_number": 68,
      "source_line": "Oct 10 19:16:26 cybery-ssh-lab auth.info sshd-session[1903]: Accepted password for labuser from 127.0.0.1 port 51114 ssh2",
      "raw_message": "Oct 10 19:16:26 cybery-ssh-lab auth.info sshd-session[1903]: Accepted password for labuser from 127.0.0.1 port 51114 ssh2",
      "message": "Accepted password for labuser from 127.0.0.1 port 51114 ssh2",
      "timestamp": "2026-10-10T19:16:26Z",
      "timestamp_origin": "daemon_native",
      "original_timestamp": "Oct 10 19:16:26",
      "collector_received_at": null,
      "pid": 1903,
      "daemon": "sshd-session",
      "host": "cybery-ssh-lab",
      "scenario": null,
      "source_network": null,
      "penalty_state": null,
      "penalty_seconds": null,
      "policy_reason": null,
      "destination_address": null,
      "destination_port": null,
      "connection_index": null
    },
    {
      "kind": "disconnect",
      "method": null,
      "user": null,
      "source_address": "127.0.0.1",
      "source_port": 51114,
      "invalid_user": false,
      "event_id": "L00000071",
      "source_line_number": 71,
      "source_line": "Oct 10 19:16:26 cybery-ssh-lab auth.info sshd-session[1907]: Received disconnect from 127.0.0.1 port 51114:11: disconnected by user",
      "raw_message": "Oct 10 19:16:26 cybery-ssh-lab auth.info sshd-session[1907]: Received disconnect from 127.0.0.1 port 51114:11: disconnected by user",
      "message": "Received disconnect from 127.0.0.1 port 51114:11: disconnected by user",
      "timestamp": "2026-10-10T19:16:26Z",
      "timestamp_origin": "daemon_native",
      "original_timestamp": "Oct 10 19:16:26",
      "collector_received_at": null,
      "pid": 1907,
      "daemon": "sshd-session",
      "host": "cybery-ssh-lab",
      "scenario": null,
      "source_network": null,
      "penalty_state": null,
      "penalty_seconds": null,
      "policy_reason": null,
      "destination_address": null,
      "destination_port": null,
      "connection_index": null
    },
    {
      "kind": "disconnect",
      "method": null,
      "user": "labuser",
      "source_address": "127.0.0.1",
      "source_port": 51114,
      "invalid_user": false,
      "event_id": "L00000072",
      "source_line_number": 72,
      "source_line": "Oct 10 19:16:26 cybery-ssh-lab auth.info sshd-session[1907]: Disconnected from user labuser 127.0.0.1 port 51114",
      "raw_message": "Oct 10 19:16:26 cybery-ssh-lab auth.info sshd-session[1907]: Disconnected from user labuser 127.0.0.1 port 51114",
      "message": "Disconnected from user labuser 127.0.0.1 port 51114",
      "timestamp": "2026-10-10T19:16:26Z",
      "timestamp_origin": "daemon_native",
      "original_timestamp": "Oct 10 19:16:26",
      "collector_received_at": null,
      "pid": 1907,
      "daemon": "sshd-session",
      "host": "cybery-ssh-lab",
      "scenario": null,
      "source_network": null,
      "penalty_state": null,
      "penalty_seconds": null,
      "policy_reason": null,
      "destination_address": null,
      "destination_port": null,
      "connection_index": null
    }
  ],
  "unparsed_records": [
    {
      "source_line_number": 2,
      "source_line": "Oct 10 19:15:20 cybery-ssh-lab auth.info sshd[1792]: Server listening on 127.0.0.1 port 2222.",
      "raw_message": "Oct 10 19:15:20 cybery-ssh-lab auth.info sshd[1792]: Server listening on 127.0.0.1 port 2222.",
      "reason": "Unrecognized SSH message or invalid endpoint."
    },
    {
      "source_line_number": 3,
      "source_line": "Oct 10 19:15:20 cybery-ssh-lab auth.info sshd-session[1807]: Connection from 127.0.0.1 port 40318 on 127.0.0.1 port 2222 rdomain \"\"",
      "raw_message": "Oct 10 19:15:20 cybery-ssh-lab auth.info sshd-session[1807]: Connection from 127.0.0.1 port 40318 on 127.0.0.1 port 2222 rdomain \"\"",
      "reason": "Unrecognized SSH message or invalid endpoint."
    },
    {
      "source_line_number": 5,
      "source_line": "Oct 10 19:15:20 cybery-ssh-lab auth.info sshd-session[1807]: User child is on pid 1811",
      "raw_message": "Oct 10 19:15:20 cybery-ssh-lab auth.info sshd-session[1807]: User child is on pid 1811",
      "reason": "Unrecognized SSH message or invalid endpoint."
    },
    {
      "source_line_number": 6,
      "source_line": "Oct 10 19:15:20 cybery-ssh-lab auth.info sshd-session[1811]: Starting session: command for labuser from 127.0.0.1 port 40318 id 0",
      "raw_message": "Oct 10 19:15:20 cybery-ssh-lab auth.info sshd-session[1811]: Starting session: command for labuser from 127.0.0.1 port 40318 id 0",
      "reason": "Unrecognized SSH message or invalid endpoint."
    },
    {
      "source_line_number": 9,
      "source_line": "Oct 10 19:15:21 cybery-ssh-lab auth.info sshd-session[1816]: Connection from 127.0.0.1 port 40322 on 127.0.0.1 port 2222 rdomain \"\"",
      "raw_message": "Oct 10 19:15:21 cybery-ssh-lab auth.info sshd-session[1816]: Connection from 127.0.0.1 port 40322 on 127.0.0.1 port 2222 rdomain \"\"",
      "reason": "Unrecognized SSH message or invalid endpoint."
    },
    {
      "source_line_number": 11,
      "source_line": "Oct 10 19:15:21 cybery-ssh-lab auth.info sshd-session[1816]: User child is on pid 1820",
      "raw_message": "Oct 10 19:15:21 cybery-ssh-lab auth.info sshd-session[1816]: User child is on pid 1820",
      "reason": "Unrecognized SSH message or invalid endpoint."
    },
    {
      "source_line_number": 12,
      "source_line": "Oct 10 19:15:21 cybery-ssh-lab auth.info sshd-session[1820]: Starting session: command for labuser from 127.0.0.1 port 40322 id 0",
      "raw_message": "Oct 10 19:15:21 cybery-ssh-lab auth.info sshd-session[1820]: Starting session: command for labuser from 127.0.0.1 port 40322 id 0",
      "reason": "Unrecognized SSH message or invalid endpoint."
    },
    {
      "source_line_number": 15,
      "source_line": "Oct 10 19:15:21 cybery-ssh-lab auth.info sshd-session[1825]: Connection from 127.0.0.1 port 40324 on 127.0.0.1 port 2222 rdomain \"\"",
      "raw_message": "Oct 10 19:15:21 cybery-ssh-lab auth.info sshd-session[1825]: Connection from 127.0.0.1 port 40324 on 127.0.0.1 port 2222 rdomain \"\"",
      "reason": "Unrecognized SSH message or invalid endpoint."
    },
    {
      "source_line_number": 17,
      "source_line": "Oct 10 19:15:21 cybery-ssh-lab auth.err sshd-session[1825]: error: maximum authentication attempts exceeded for labuser from 127.0.0.1 port 40324 ssh2 [preauth]",
      "raw_message": "Oct 10 19:15:21 cybery-ssh-lab auth.err sshd-session[1825]: error: maximum authentication attempts exceeded for labuser from 127.0.0.1 port 40324 ssh2 [preauth]",
      "reason": "Unrecognized SSH message or invalid endpoint."
    },
    {
      "source_line_number": 19,
      "source_line": "Oct 10 19:16:26 cybery-ssh-lab auth.info sshd-session[1833]: Connection from 127.0.0.1 port 51014 on 127.0.0.1 port 2222 rdomain \"\"",
      "raw_message": "Oct 10 19:16:26 cybery-ssh-lab auth.info sshd-session[1833]: Connection from 127.0.0.1 port 51014 on 127.0.0.1 port 2222 rdomain \"\"",
      "reason": "Unrecognized SSH message or invalid endpoint."
    },
    {
      "source_line_number": 21,
      "source_line": "Oct 10 19:16:26 cybery-ssh-lab auth.err sshd-session[1833]: error: maximum authentication attempts exceeded for labuser from 127.0.0.1 port 51014 ssh2 [preauth]",
      "raw_message": "Oct 10 19:16:26 cybery-ssh-lab auth.err sshd-session[1833]: error: maximum authentication attempts exceeded for labuser from 127.0.0.1 port 51014 ssh2 [preauth]",
      "reason": "Unrecognized SSH message or invalid endpoint."
    },
    {
      "source_line_number": 23,
      "source_line": "Oct 10 19:16:26 cybery-ssh-lab auth.info sshd-session[1840]: Connection from 127.0.0.1 port 51028 on 127.0.0.1 port 2222 rdomain \"\"",
      "raw_message": "Oct 10 19:16:26 cybery-ssh-lab auth.info sshd-session[1840]: Connection from 127.0.0.1 port 51028 on 127.0.0.1 port 2222 rdomain \"\"",
      "reason": "Unrecognized SSH message or invalid endpoint."
    },
    {
      "source_line_number": 25,
      "source_line": "Oct 10 19:16:26 cybery-ssh-lab auth.err sshd-session[1840]: error: maximum authentication attempts exceeded for labuser from 127.0.0.1 port 51028 ssh2 [preauth]",
      "raw_message": "Oct 10 19:16:26 cybery-ssh-lab auth.err sshd-session[1840]: error: maximum authentication attempts exceeded for labuser from 127.0.0.1 port 51028 ssh2 [preauth]",
      "reason": "Unrecognized SSH message or invalid endpoint."
    },
    {
      "source_line_number": 27,
      "source_line": "Oct 10 19:16:26 cybery-ssh-lab auth.info sshd-session[1847]: Connection from 127.0.0.1 port 51044 on 127.0.0.1 port 2222 rdomain \"\"",
      "raw_message": "Oct 10 19:16:26 cybery-ssh-lab auth.info sshd-session[1847]: Connection from 127.0.0.1 port 51044 on 127.0.0.1 port 2222 rdomain \"\"",
      "reason": "Unrecognized SSH message or invalid endpoint."
    },
    {
      "source_line_number": 29,
      "source_line": "Oct 10 19:16:26 cybery-ssh-lab auth.err sshd-session[1847]: error: maximum authentication attempts exceeded for labuser from 127.0.0.1 port 51044 ssh2 [preauth]",
      "raw_message": "Oct 10 19:16:26 cybery-ssh-lab auth.err sshd-session[1847]: error: maximum authentication attempts exceeded for labuser from 127.0.0.1 port 51044 ssh2 [preauth]",
      "reason": "Unrecognized SSH message or invalid endpoint."
    },
    {
      "source_line_number": 31,
      "source_line": "Oct 10 19:16:26 cybery-ssh-lab auth.info sshd-session[1854]: Connection from 127.0.0.1 port 51054 on 127.0.0.1 port 2222 rdomain \"\"",
      "raw_message": "Oct 10 19:16:26 cybery-ssh-lab auth.info sshd-session[1854]: Connection from 127.0.0.1 port 51054 on 127.0.0.1 port 2222 rdomain \"\"",
      "reason": "Unrecognized SSH message or invalid endpoint."
    },
    {
      "source_line_number": 33,
      "source_line": "Oct 10 19:16:26 cybery-ssh-lab auth.err sshd-session[1854]: error: maximum authentication attempts exceeded for labuser from 127.0.0.1 port 51054 ssh2 [preauth]",
      "raw_message": "Oct 10 19:16:26 cybery-ssh-lab auth.err sshd-session[1854]: error: maximum authentication attempts exceeded for labuser from 127.0.0.1 port 51054 ssh2 [preauth]",
      "reason": "Unrecognized SSH message or invalid endpoint."
    },
    {
      "source_line_number": 35,
      "source_line": "Oct 10 19:16:26 cybery-ssh-lab auth.info sshd-session[1861]: Connection from 127.0.0.1 port 51056 on 127.0.0.1 port 2222 rdomain \"\"",
      "raw_message": "Oct 10 19:16:26 cybery-ssh-lab auth.info sshd-session[1861]: Connection from 127.0.0.1 port 51056 on 127.0.0.1 port 2222 rdomain \"\"",
      "reason": "Unrecognized SSH message or invalid endpoint."
    },
    {
      "source_line_number": 37,
      "source_line": "Oct 10 19:16:26 cybery-ssh-lab auth.err sshd-session[1861]: error: maximum authentication attempts exceeded for labuser from 127.0.0.1 port 51056 ssh2 [preauth]",
      "raw_message": "Oct 10 19:16:26 cybery-ssh-lab auth.err sshd-session[1861]: error: maximum authentication attempts exceeded for labuser from 127.0.0.1 port 51056 ssh2 [preauth]",
      "reason": "Unrecognized SSH message or invalid endpoint."
    },
    {
      "source_line_number": 39,
      "source_line": "Oct 10 19:16:26 cybery-ssh-lab auth.info sshd-session[1868]: Connection from 127.0.0.1 port 51072 on 127.0.0.1 port 2222 rdomain \"\"",
      "raw_message": "Oct 10 19:16:26 cybery-ssh-lab auth.info sshd-session[1868]: Connection from 127.0.0.1 port 51072 on 127.0.0.1 port 2222 rdomain \"\"",
      "reason": "Unrecognized SSH message or invalid endpoint."
    },
    {
      "source_line_number": 41,
      "source_line": "Oct 10 19:16:26 cybery-ssh-lab auth.err sshd-session[1868]: error: maximum authentication attempts exceeded for labuser from 127.0.0.1 port 51072 ssh2 [preauth]",
      "raw_message": "Oct 10 19:16:26 cybery-ssh-lab auth.err sshd-session[1868]: error: maximum authentication attempts exceeded for labuser from 127.0.0.1 port 51072 ssh2 [preauth]",
      "reason": "Unrecognized SSH message or invalid endpoint."
    },
    {
      "source_line_number": 43,
      "source_line": "Oct 10 19:16:26 cybery-ssh-lab auth.info sshd-session[1875]: Connection from 127.0.0.1 port 51076 on 127.0.0.1 port 2222 rdomain \"\"",
      "raw_message": "Oct 10 19:16:26 cybery-ssh-lab auth.info sshd-session[1875]: Connection from 127.0.0.1 port 51076 on 127.0.0.1 port 2222 rdomain \"\"",
      "reason": "Unrecognized SSH message or invalid endpoint."
    },
    {
      "source_line_number": 45,
      "source_line": "Oct 10 19:16:26 cybery-ssh-lab auth.err sshd-session[1875]: error: Could not get shadow information for NOUSER",
      "raw_message": "Oct 10 19:16:26 cybery-ssh-lab auth.err sshd-session[1875]: error: Could not get shadow information for NOUSER",
      "reason": "Unrecognized SSH message or invalid endpoint."
    },
    {
      "source_line_number": 47,
      "source_line": "Oct 10 19:16:26 cybery-ssh-lab auth.err sshd-session[1875]: error: maximum authentication attempts exceeded for invalid user invaliduser from 127.0.0.1 port 51076 ssh2 [preauth]",
      "raw_message": "Oct 10 19:16:26 cybery-ssh-lab auth.err sshd-session[1875]: error: maximum authentication attempts exceeded for invalid user invaliduser from 127.0.0.1 port 51076 ssh2 [preauth]",
      "reason": "Unrecognized SSH message or invalid endpoint."
    },
    {
      "source_line_number": 49,
      "source_line": "Oct 10 19:16:26 cybery-ssh-lab auth.info sshd-session[1882]: Connection from 127.0.0.1 port 51088 on 127.0.0.1 port 2222 rdomain \"\"",
      "raw_message": "Oct 10 19:16:26 cybery-ssh-lab auth.info sshd-session[1882]: Connection from 127.0.0.1 port 51088 on 127.0.0.1 port 2222 rdomain \"\"",
      "reason": "Unrecognized SSH message or invalid endpoint."
    },
    {
      "source_line_number": 51,
      "source_line": "Oct 10 19:16:26 cybery-ssh-lab auth.err sshd-session[1882]: error: Could not get shadow information for NOUSER",
      "raw_message": "Oct 10 19:16:26 cybery-ssh-lab auth.err sshd-session[1882]: error: Could not get shadow information for NOUSER",
      "reason": "Unrecognized SSH message or invalid endpoint."
    },
    {
      "source_line_number": 53,
      "source_line": "Oct 10 19:16:26 cybery-ssh-lab auth.err sshd-session[1882]: error: maximum authentication attempts exceeded for invalid user invaliduser from 127.0.0.1 port 51088 ssh2 [preauth]",
      "raw_message": "Oct 10 19:16:26 cybery-ssh-lab auth.err sshd-session[1882]: error: maximum authentication attempts exceeded for invalid user invaliduser from 127.0.0.1 port 51088 ssh2 [preauth]",
      "reason": "Unrecognized SSH message or invalid endpoint."
    },
    {
      "source_line_number": 55,
      "source_line": "Oct 10 19:16:26 cybery-ssh-lab auth.info sshd-session[1889]: Connection from 127.0.0.1 port 51098 on 127.0.0.1 port 2222 rdomain \"\"",
      "raw_message": "Oct 10 19:16:26 cybery-ssh-lab auth.info sshd-session[1889]: Connection from 127.0.0.1 port 51098 on 127.0.0.1 port 2222 rdomain \"\"",
      "reason": "Unrecognized SSH message or invalid endpoint."
    },
    {
      "source_line_number": 57,
      "source_line": "Oct 10 19:16:26 cybery-ssh-lab auth.err sshd-session[1889]: error: Could not get shadow information for NOUSER",
      "raw_message": "Oct 10 19:16:26 cybery-ssh-lab auth.err sshd-session[1889]: error: Could not get shadow information for NOUSER",
      "reason": "Unrecognized SSH message or invalid endpoint."
    },
    {
      "source_line_number": 59,
      "source_line": "Oct 10 19:16:26 cybery-ssh-lab auth.err sshd-session[1889]: error: maximum authentication attempts exceeded for invalid user invaliduser from 127.0.0.1 port 51098 ssh2 [preauth]",
      "raw_message": "Oct 10 19:16:26 cybery-ssh-lab auth.err sshd-session[1889]: error: maximum authentication attempts exceeded for invalid user invaliduser from 127.0.0.1 port 51098 ssh2 [preauth]",
      "reason": "Unrecognized SSH message or invalid endpoint."
    },
    {
      "source_line_number": 61,
      "source_line": "Oct 10 19:16:26 cybery-ssh-lab auth.info sshd-session[1896]: Connection from 127.0.0.1 port 51112 on 127.0.0.1 port 2222 rdomain \"\"",
      "raw_message": "Oct 10 19:16:26 cybery-ssh-lab auth.info sshd-session[1896]: Connection from 127.0.0.1 port 51112 on 127.0.0.1 port 2222 rdomain \"\"",
      "reason": "Unrecognized SSH message or invalid endpoint."
    },
    {
      "source_line_number": 63,
      "source_line": "Oct 10 19:16:26 cybery-ssh-lab auth.err sshd-session[1896]: error: Could not get shadow information for NOUSER",
      "raw_message": "Oct 10 19:16:26 cybery-ssh-lab auth.err sshd-session[1896]: error: Could not get shadow information for NOUSER",
      "reason": "Unrecognized SSH message or invalid endpoint."
    },
    {
      "source_line_number": 65,
      "source_line": "Oct 10 19:16:26 cybery-ssh-lab auth.err sshd-session[1896]: error: maximum authentication attempts exceeded for invalid user invaliduser from 127.0.0.1 port 51112 ssh2 [preauth]",
      "raw_message": "Oct 10 19:16:26 cybery-ssh-lab auth.err sshd-session[1896]: error: maximum authentication attempts exceeded for invalid user invaliduser from 127.0.0.1 port 51112 ssh2 [preauth]",
      "reason": "Unrecognized SSH message or invalid endpoint."
    },
    {
      "source_line_number": 67,
      "source_line": "Oct 10 19:16:26 cybery-ssh-lab auth.info sshd-session[1903]: Connection from 127.0.0.1 port 51114 on 127.0.0.1 port 2222 rdomain \"\"",
      "raw_message": "Oct 10 19:16:26 cybery-ssh-lab auth.info sshd-session[1903]: Connection from 127.0.0.1 port 51114 on 127.0.0.1 port 2222 rdomain \"\"",
      "reason": "Unrecognized SSH message or invalid endpoint."
    },
    {
      "source_line_number": 69,
      "source_line": "Oct 10 19:16:26 cybery-ssh-lab auth.info sshd-session[1903]: User child is on pid 1907",
      "raw_message": "Oct 10 19:16:26 cybery-ssh-lab auth.info sshd-session[1903]: User child is on pid 1907",
      "reason": "Unrecognized SSH message or invalid endpoint."
    },
    {
      "source_line_number": 70,
      "source_line": "Oct 10 19:16:26 cybery-ssh-lab auth.info sshd-session[1907]: Starting session: command for labuser from 127.0.0.1 port 51114 id 0",
      "raw_message": "Oct 10 19:16:26 cybery-ssh-lab auth.info sshd-session[1907]: Starting session: command for labuser from 127.0.0.1 port 51114 id 0",
      "reason": "Unrecognized SSH message or invalid endpoint."
    },
    {
      "source_line_number": 73,
      "source_line": "Oct 10 19:16:27 cybery-ssh-lab auth.info sshd[1792]: Received signal 15; terminating.",
      "raw_message": "Oct 10 19:16:27 cybery-ssh-lab auth.info sshd[1792]: Received signal 15; terminating.",
      "reason": "Unrecognized SSH message or invalid endpoint."
    }
  ],
  "interpretation": {
    "authentication_counting": "Each Failed/Accepted daemon record is counted once; Invalid user and PAM notices are contextual records, not additional failed attempts.",
    "alerts": "Qualifying rolling-window endpoints can overlap. They are review candidates, not distinct incidents or proof of compromise.",
    "integrity": "SHA-256 verifies the bytes against this report; it does not independently establish authenticity, completeness, origin, or clock accuracy."
  }
}