SSH log overview
See how Corelight’s implementation of the Zeek ssh.log provides protocol specific information about SSH sessions to help you identify outliers. Gain additional context beyond what PCAP in Wireshark can give you with unique identifiers for fast pivoting, HASSH for network fingerprinting, as well as insights into encrypted traffic including file transfers and SSH stepping stones.
