sshd: Debug message.

Description

match="debug1: attempt"

Fires when

Wazuh evaluates a chain top-down. Every rule above this one must match on the same event before this rule is tested at all.

1. 5700 SSHD messages grouped. anchor level 0
   decoded_as=sshd
2. 5729 sshd: Debug message. suppression level 0 this rule
   match="debug1: attempt"

Rule dependencies

Depends on

• composes · Wazuh if_sid 5700
  • SSHD messages grouped.