We've reorganized our documentation navigation structure to align directly with your operational workflows. See the release notes and the walkthrough video for more information.

Change log for OPENSSH

Date	Changes
2024-01-23	Enhancement: - Modified a Grok pattern to parse the entire value in `target.user.userid`.
2023-10-05	Enhancement: - Modified the existing mapping: `target.file.sha256` mapped to `network.tls.client.certificate.sha256`.
2023-08-25	Enhancement: - Added a Grok pattern to parse unparsed logs and mapped the fields accordingly.
2023-05-05	Enhancement: - Modified the existing mapping, `principal.hostname` mapped to `target.hostanme`.
2022-10-25	Enhancement: Added and modified GROK pattern for `message` and `description` fields. Mapped `pwd` to `target.file.full_path`. Mapped `Sha256` to `target.file.sha256`. Mapped `command` to `target.process.command_line`. Mapped `tty` to `security_result.about.resource.attribute.labels`. Mapped `metadata.event_type` as `STATUS_UPDATE` wherever possible.
2022-05-18	User login action logs such as `auth success - with public key, auth success - with password, auth fail with password` are handled. Mapped `USER_LOGIN` to `metadata.event_type`. Mapped `User name` to `target.user.userid`. Mapped `Source ip` to `principal.ip`. Mapped `Source port` to `principal.port`. Mapped `MECHANISM_UNSPECIFIED` to `extensions.auth.mechanism`.