{
  "timestamp": "2026-09-12T14:03:18.412+0000",
  "rule": {
    "level": 10,
    "description": "sshd: brute force trying to get access to the system. Authentication failed.",
    "id": "5763",
    "mitre": {
      "id": [
        "T1110.001"
      ],
      "tactic": [
        "Credential Access"
      ],
      "technique": [
        "Password Guessing"
      ]
    },
    "frequency": 8,
    "groups": [
      "syslog",
      "sshd",
      "authentication_failures"
    ]
  },
  "agent": {
    "id": "003",
    "name": "lab-ubuntu-01",
    "ip": "10.0.20.15"
  },
  "manager": {
    "name": "wazuh-manager"
  },
  "decoder": {
    "name": "sshd"
  },
  "data": {
    "srcip": "185.220.101.34",
    "srcport": "51422",
    "srcuser": "root"
  },
  "full_log": "Sep 12 14:03:18 lab-ubuntu-01 sshd[21044]: Failed password for root from 185.220.101.34 port 51422 ssh2",
  "previous_output": "Sep 12 14:03:17 lab-ubuntu-01 sshd[21044]: Failed password for root from 185.220.101.34 port 51422 ssh2\nSep 12 14:03:19 lab-ubuntu-01 sshd[21051]: Accepted password for root from 185.220.101.34 port 51430 ssh2",
  "location": "/var/log/auth.log"
}