IAC01 - Suspicious SSH Admin
This alert will trigger when an inbound SSH session from an external IP address is detected, which can be abused for Initial Access by a threat actor.
This alert will trigger when an inbound SSH session from an external IP address is detected, which can be abused for Initial Access by a threat actor.