Wazuh Notification.

2019 Apr 24 10:42:33

Received From: vm-ubuntu4->ossec-monitord

Rule: 502 fired (level 3) -> "Ossec server started."
Portion of the log(s):

ossec: Ossec started.

--END OF NOTIFICATION

{"eventid":"cowrie.login.failed","username":"twalton","timestamp":"2019-04-
17T16:24:33.510587Z","message":"login attempt [twalton/test]
failed","system":"SSHService 'ssh-
userauth'","src_ip":"10.160.60.27","session":"f05271d202b6","password":"test","sens
or":"1ca11427d473"}