create SSH connection alert on attempt / connect to any elastic agent

[brebe]

Good morning

how can i make an alert on ssh attempt / connect to any of elastic agents ?
with wazuh every new connection / attmept was displayed as alert !

thank you!!

Version

2.4 Pre-release (Beta, Release Candidate)

Installation Method

Security Onion ISO image

Description

configuration

Installation Type

Standalone

Location

airgap

Hardware Specs

Exceeds minimum requirements

CPU

8

RAM

64

Storage for /

2000Gb

Storage for /nsm

1000

Network Traffic Collection

tap

Network Traffic Speeds

Less than 1Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

Yes, there are salt failures (please provide detail below)

Logs

No, there are no additional clues

Detail

Guidelines

• I have read the discussion guidelines at Read before posting! #1720 and assert that I have followed the guidelines.

[cm-ops]

Have you looked at setting up a detection with Playbook for this? https://docs.securityonion.net/en/2.4/playbook.html