ssh_auth_events

{“what”:“Unique numeric identifier for each event row.”,“why”:“Without it, rows cannot be uniquely referenced for updates, deletes, or joins.”,“by”:“fleet-annotator-worker”,“at”:“2026-09-22T23:56:23.939524353+00:00”}

{“what”:“UTC timestamp of when the SSH event occurred.”,“why”:“Without it, event ordering and time-based analysis (e.g., brute-force detection) are impossible.”,“by”:“fleet-annotator-worker”,“at”:“2026-09-22T23:56:23.958689700+00:00”}

{“what”:“Outcome category such as ‘success’, ‘failed’, ‘timeout’.”,“why”:“Without it, cannot distinguish successful logins from failed attempts, hiding security breaches.”,“by”:“fleet-annotator-worker”,“at”:“2026-09-22T23:56:23.974531127+00:00”}

{“what”:“IP address of the client that initiated the SSH connection.”,“why”:“Without it, cannot identify attack sources or geolocate suspicious activity.”,“by”:“fleet-annotator-worker”,“at”:“2026-09-22T23:56:23.991322241+00:00”}

{“what”:“Account name attempted or used in the SSH authentication.”,“why”:“Without it, cannot attribute events to specific users or detect username enumeration attacks.”,“by”:“fleet-annotator-worker”,“at”:“2026-09-22T23:56:24.003911525+00:00”}

{“what”:“Authentication mechanism used, e.g., ‘password’, ‘publickey’.”,“why”:“Without it, cannot assess security posture or enforce policies on weak methods.”,“by”:“fleet-annotator-worker”,“at”:“2026-09-22T23:56:24.033724340+00:00”}

{“what”:“SHA256 fingerprint of the SSH public key used, if any.”,“why”:“Without it, cannot track key-based access or revoke compromised keys.”,“by”:“fleet-annotator-worker”,“at”:“2026-09-22T23:56:24.047465874+00:00”}

{“what”:“Free-form additional context such as error messages or client version.”,“why”:“Without it, diagnostic information for troubleshooting or forensic analysis is lost.”,“by”:“fleet-annotator-worker”,“at”:“2026-09-22T23:56:24.123038148+00:00”}