ossec-logtest
2019/04/30 02:28:22 ossec-testrule: INFO: Started (pid: 12905).
ossec-testrule: Type one log per line.

Feb 14 12:19:04 localhost sshd[25474]: Accepted password for rromero from 192.168.1.133 port 49765 ssh2

**Phase 1: Completed pre-decoding.
       full event: 'Feb 14 12:19:04 localhost sshd[25474]: Accepted password for rromero from 192.168.1.133 port 49765 ssh2'
       timestamp: 'Feb 14 12:19:04'
       hostname: 'localhost'
       program_name: 'sshd'
       log: 'Accepted password for rromero from 192.168.1.133 port 49765 ssh2'

**Phase 2: Completed decoding.
       decoder: 'sshd'
       dstuser: 'rromero'
       srcip: '192.168.1.133'

**Phase 3: Completed filtering (rules).
       Rule id: '5715'
       Level: '3'
       Description: 'sshd: authentication success.'
**Alert to be generated.