A collection to defend sshd against common attacks :

• ssh parser
• ssh bruteforce & enumeration detection
• ssh 'slow' bruteforce & enumeration detection

Example acquisition for this collection :

1filenames:
2  - /var/log/auth.log
3labels:
4  type: syslog

notes :

• If you are using syslog, set type to syslog instead
• Depending on your distribution/OS, paths to log files might change
• Only relevant if you are manually installing collection