IAC01 - Suspicious SSH Admin

This alert will trigger when an inbound SSH session from an external IP address is detected, which can be abused for Initial Access by a threat actor.