| [ | |
| { | |
| "template": "Accepted password for <*> from <*> port <*> ssh2", | |
| "message": "Accepted password for fztu from 119.137.62.142 port 49116 ssh2", | |
| "cosine_distance": 0.30778729915618896 | |
| }, | |
| { | |
| "template": "Connection closed by <*> [preauth]", | |
| "message": "Connection closed by 185.190.58.151 [preauth]", | |
| "cosine_distance": 0.17984163761138916 | |
| }, | |
| { | |
| "template": "Connection closed by <*> [preauth]", | |
| "message": "Connection closed by 173.234.31.186 [preauth]", | |
| "cosine_distance": 0.16955244541168213 | |
| }, | |
| { | |
| "template": "Connection closed by <*> [preauth]", | |
| "message": "Connection closed by 1.237.174.253 [preauth]", | |
| "cosine_distance": 0.17307883501052856 | |
| }, | |
| { | |
| "template": "Connection closed by <*> [preauth]", | |
| "message": "Connection closed by 88.147.143.242 [preauth]", | |
| "cosine_distance": 0.15813922882080078 | |
| }, | |
| { | |
| "template": "Connection closed by <*> [preauth]", | |
| "message": "Connection closed by 191.210.223.172 [preauth]", | |
| "cosine_distance": 0.23793518543243408 | |
| }, | |
| { | |
| "template": "Connection closed by <*> [preauth]", | |
| "message": "Connection closed by 212.47.254.145 [preauth]", | |
| "cosine_distance": 0.24183666706085205 | |
| }, | |
| { | |
| "template": "Connection closed by <*> [preauth]", | |
| "message": "Connection closed by 60.2.12.12 [preauth]", | |
| "cosine_distance": 0.16144394874572754 | |
| }, | |
| { | |
| "template": "Connection closed by <*> [preauth]", | |
| "message": "Connection closed by 5.188.10.180 [preauth]", | |
| "cosine_distance": 0.16352856159210205 | |
| }, | |
| { | |
| "template": "Connection closed by <*> [preauth]", | |
| "message": "Connection closed by 181.214.87.4 [preauth]", | |
| "cosine_distance": 0.20684897899627686 | |
| }, | |
| { | |
| "template": "Connection closed by <*> [preauth]", | |
| "message": "Connection closed by 194.190.163.22 [preauth]", | |
| "cosine_distance": 0.1510699987411499 | |
| }, | |
| { | |
| "template": "Connection closed by <*> [preauth]", | |
| "message": "Connection closed by 104.192.3.34 [preauth]", | |
| "cosine_distance": 0.20927298069000244 | |
| }, | |
| { | |
| "template": "Did not receive identification string from <*>", | |
| "message": "Did not receive identification string from 123.235.32.19", | |
| "cosine_distance": 0.2905956506729126 | |
| }, | |
| { | |
| "template": "Did not receive identification string from <*>", | |
| "message": "Did not receive identification string from 188.132.244.89", | |
| "cosine_distance": 0.2696949243545532 | |
| }, | |
| { | |
| "template": "Did not receive identification string from <*>", | |
| "message": "Did not receive identification string from 181.214.87.4", | |
| "cosine_distance": 0.35382091999053955 | |
| }, | |
| { | |
| "template": "Did not receive identification string from <*>", | |
| "message": "Did not receive identification string from 177.79.82.136", | |
| "cosine_distance": 0.3591928482055664 | |
| }, | |
| { | |
| "template": "Did not receive identification string from <*>", | |
| "message": "Did not receive identification string from 103.207.39.16", | |
| "cosine_distance": 0.29377055168151855 | |
| }, | |
| { | |
| "template": "Did not receive identification string from <*>", | |
| "message": "Did not receive identification string from 103.207.39.212", | |
| "cosine_distance": 0.29949861764907837 | |
| }, | |
| { | |
| "template": "Did not receive identification string from <*>", | |
| "message": "Did not receive identification string from 195.154.37.122", | |
| "cosine_distance": 0.35224270820617676 | |
| }, | |
| { | |
| "template": "Did not receive identification string from <*>", | |
| "message": "Did not receive identification string from 103.207.39.165", | |
| "cosine_distance": 0.295398473739624 | |
| }, | |
| { | |
| "template": "Did not receive identification string from <*>", | |
| "message": "Did not receive identification string from 5.188.10.180", | |
| "cosine_distance": 0.32191264629364014 | |
| }, | |
| { | |
| "template": "Did not receive identification string from <*>", | |
| "message": "Did not receive identification string from 185.190.58.151", | |
| "cosine_distance": 0.3337831497192383 | |
| }, | |
| { | |
| "template": "Disconnecting: Too many authentication failures for <*> [preauth]", | |
| "message": "Disconnecting: Too many authentication failures for root [preauth]", | |
| "cosine_distance": 0.12708377838134766 | |
| }, | |
| { | |
| "template": "Disconnecting: Too many authentication failures for <*> [preauth]", | |
| "message": "Disconnecting: Too many authentication failures for admin [preauth]", | |
| "cosine_distance": 0.0855550765991211 | |
| }, | |
| { | |
| "template": "Failed none for invalid user <*> from <*> port <*> ssh2", | |
| "message": "Failed none for invalid user admin from 5.188.10.180 port 52631 ssh2", | |
| "cosine_distance": 0.16812419891357422 | |
| }, | |
| { | |
| "template": "Failed none for invalid user <*> from <*> port <*> ssh2", | |
| "message": "Failed none for invalid user 0 from 185.190.58.151 port 55495 ssh2", | |
| "cosine_distance": 0.13018673658370972 | |
| }, | |
| { | |
| "template": "Failed none for invalid user <*> from <*> port <*> ssh2", | |
| "message": "Failed none for invalid user 0 from 5.188.10.180 port 49811 ssh2", | |
| "cosine_distance": 0.14186406135559082 | |
| }, | |
| { | |
| "template": "Failed none for invalid user <*> from <*> port <*> ssh2", | |
| "message": "Failed none for invalid user 0 from 181.214.87.4 port 51889 ssh2", | |
| "cosine_distance": 0.13878846168518066 | |
| }, | |
| { | |
| "template": "Failed password for <*> from <*> port <*> ssh2", | |
| "message": "Failed password for root from 183.62.140.253 port 36644 ssh2", | |
| "cosine_distance": 0.2223808765411377 | |
| }, | |
| { | |
| "template": "Failed password for <*> from <*> port <*> ssh2", | |
| "message": "Failed password for root from 183.62.140.253 port 50726 ssh2", | |
| "cosine_distance": 0.24113166332244873 | |
| }, | |
| { | |
| "template": "Failed password for <*> from <*> port <*> ssh2", | |
| "message": "Failed password for root from 183.62.140.253 port 43391 ssh2", | |
| "cosine_distance": 0.2186955213546753 | |
| }, | |
| { | |
| "template": "Failed password for <*> from <*> port <*> ssh2", | |
| "message": "Failed password for mysql from 187.141.143.180 port 52586 ssh2", | |
| "cosine_distance": 0.22869408130645752 | |
| }, | |
| { | |
| "template": "Failed password for <*> from <*> port <*> ssh2", | |
| "message": "Failed password for root from 187.141.143.180 port 40297 ssh2", | |
| "cosine_distance": 0.19088506698608398 | |
| }, | |
| { | |
| "template": "Failed password for <*> from <*> port <*> ssh2", | |
| "message": "Failed password for uucp from 195.154.37.122 port 59266 ssh2", | |
| "cosine_distance": 0.25379443168640137 | |
| }, | |
| { | |
| "template": "Failed password for <*> from <*> port <*> ssh2", | |
| "message": "Failed password for root from 183.62.140.253 port 35101 ssh2", | |
| "cosine_distance": 0.23414522409439087 | |
| }, | |
| { | |
| "template": "Failed password for <*> from <*> port <*> ssh2", | |
| "message": "Failed password for root from 183.62.140.253 port 57998 ssh2", | |
| "cosine_distance": 0.22773224115371704 | |
| }, | |
| { | |
| "template": "Failed password for <*> from <*> port <*> ssh2", | |
| "message": "Failed password for root from 183.62.140.253 port 46953 ssh2", | |
| "cosine_distance": 0.22342407703399658 | |
| }, | |
| { | |
| "template": "Failed password for <*> from <*> port <*> ssh2", | |
| "message": "Failed password for root from 183.62.140.253 port 59470 ssh2", | |
| "cosine_distance": 0.23303884267807007 | |
| }, | |
| { | |
| "template": "Failed password for <*> from <*> port <*> ssh2", | |
| "message": "Failed password for root from 183.62.140.253 port 45902 ssh2", | |
| "cosine_distance": 0.22623980045318604 | |
| }, | |
| { | |
| "template": "Failed password for <*> from <*> port <*> ssh2", | |
| "message": "Failed password for root from 183.62.140.253 port 57485 ssh2", | |
| "cosine_distance": 0.23397314548492432 | |
| }, | |
| { | |
| "template": "Failed password for <*> from <*> port <*> ssh2", | |
| "message": "Failed password for root from 183.62.140.253 port 53630 ssh2", | |
| "cosine_distance": 0.27761149406433105 | |
| }, | |
| { | |
| "template": "Failed password for <*> from <*> port <*> ssh2", | |
| "message": "Failed password for root from 183.62.140.253 port 42636 ssh2", | |
| "cosine_distance": 0.23000454902648926 | |
| }, | |
| { | |
| "template": "Failed password for <*> from <*> port <*> ssh2", | |
| "message": "Failed password for root from 183.62.140.253 port 58556 ssh2", | |
| "cosine_distance": 0.2393285036087036 | |
| }, | |
| { | |
| "template": "Failed password for <*> from <*> port <*> ssh2", | |
| "message": "Failed password for git from 187.141.143.180 port 33532 ssh2", | |
| "cosine_distance": 0.2254117727279663 | |
| }, | |
| { | |
| "template": "Failed password for <*> from <*> port <*> ssh2", | |
| "message": "Failed password for root from 183.62.140.253 port 55138 ssh2", | |
| "cosine_distance": 0.23764538764953613 | |
| }, | |
| { | |
| "template": "Failed password for <*> from <*> port <*> ssh2", | |
| "message": "Failed password for root from 187.141.143.180 port 48241 ssh2", | |
| "cosine_distance": 0.18924975395202637 | |
| }, | |
| { | |
| "template": "Failed password for <*> from <*> port <*> ssh2", | |
| "message": "Failed password for root from 112.95.230.3 port 59849 ssh2", | |
| "cosine_distance": 0.22060513496398926 | |
| }, | |
| { | |
| "template": "Failed password for <*> from <*> port <*> ssh2", | |
| "message": "Failed password for root from 187.141.143.180 port 46878 ssh2", | |
| "cosine_distance": 0.18537700176239014 | |
| }, | |
| { | |
| "template": "Failed password for invalid user <*> from <*> port <*> ssh2", | |
| "message": "Failed password for invalid user default from 5.188.10.180 port 41538 ssh2", | |
| "cosine_distance": 0.15599149465560913 | |
| }, | |
| { | |
| "template": "Failed password for invalid user <*> from <*> port <*> ssh2", | |
| "message": "Failed password for invalid user magnos from 187.141.143.180 port 55517 ssh2", | |
| "cosine_distance": 0.1875537633895874 | |
| }, | |
| { | |
| "template": "Failed password for invalid user <*> from <*> port <*> ssh2", | |
| "message": "Failed password for invalid user admin from 103.99.0.122 port 53531 ssh2", | |
| "cosine_distance": 0.18264585733413696 | |
| }, | |
| { | |
| "template": "Failed password for invalid user <*> from <*> port <*> ssh2", | |
| "message": "Failed password for invalid user test from 183.62.140.253 port 47409 ssh2", | |
| "cosine_distance": 0.14519888162612915 | |
| }, | |
| { | |
| "template": "Failed password for invalid user <*> from <*> port <*> ssh2", | |
| "message": "Failed password for invalid user utsims from 112.95.230.3 port 41506 ssh2", | |
| "cosine_distance": 0.19375908374786377 | |
| }, | |
| { | |
| "template": "Failed password for invalid user <*> from <*> port <*> ssh2", | |
| "message": "Failed password for invalid user admin from 103.207.39.212 port 58447 ssh2", | |
| "cosine_distance": 0.17257046699523926 | |
| }, | |
| { | |
| "template": "Failed password for invalid user <*> from <*> port <*> ssh2", | |
| "message": "Failed password for invalid user admin from 5.188.10.180 port 60682 ssh2", | |
| "cosine_distance": 0.15320318937301636 | |
| }, | |
| { | |
| "template": "Failed password for invalid user <*> from <*> port <*> ssh2", | |
| "message": "Failed password for invalid user ubuntu from 187.141.143.180 port 35697 ssh2", | |
| "cosine_distance": 0.12281590700149536 | |
| }, | |
| { | |
| "template": "Failed password for invalid user <*> from <*> port <*> ssh2", | |
| "message": "Failed password for invalid user nagios from 187.141.143.180 port 55761 ssh2", | |
| "cosine_distance": 0.20127826929092407 | |
| }, | |
| { | |
| "template": "Failed password for invalid user <*> from <*> port <*> ssh2", | |
| "message": "Failed password for invalid user cisco from 103.99.0.122 port 58309 ssh2", | |
| "cosine_distance": 0.2101438045501709 | |
| }, | |
| { | |
| "template": "Failed password for invalid user <*> from <*> port <*> ssh2", | |
| "message": "Failed password for invalid user inspur from 183.136.162.51 port 55204 ssh2", | |
| "cosine_distance": 0.13510167598724365 | |
| }, | |
| { | |
| "template": "Failed password for invalid user <*> from <*> port <*> ssh2", | |
| "message": "Failed password for invalid user 1234 from 103.99.0.122 port 62429 ssh2", | |
| "cosine_distance": 0.14911937713623047 | |
| }, | |
| { | |
| "template": "Failed password for invalid user <*> from <*> port <*> ssh2", | |
| "message": "Failed password for invalid user admin from 103.99.0.122 port 56901 ssh2", | |
| "cosine_distance": 0.15012866258621216 | |
| }, | |
| { | |
| "template": "Failed password for invalid user <*> from <*> port <*> ssh2", | |
| "message": "Failed password for invalid user test1 from 187.141.143.180 port 46519 ssh2", | |
| "cosine_distance": 0.1372992992401123 | |
| }, | |
| { | |
| "template": "Failed password for invalid user <*> from <*> port <*> ssh2", | |
| "message": "Failed password for invalid user cyrus from 187.141.143.180 port 33574 ssh2", | |
| "cosine_distance": 0.22243160009384155 | |
| }, | |
| { | |
| "template": "Failed password for invalid user <*> from <*> port <*> ssh2", | |
| "message": "Failed password for invalid user test from 103.99.0.122 port 51592 ssh2", | |
| "cosine_distance": 0.15832483768463135 | |
| }, | |
| { | |
| "template": "Failed password for invalid user <*> from <*> port <*> ssh2", | |
| "message": "Failed password for invalid user 1234 from 5.188.10.180 port 45541 ssh2", | |
| "cosine_distance": 0.16518259048461914 | |
| }, | |
| { | |
| "template": "Failed password for invalid user <*> from <*> port <*> ssh2", | |
| "message": "Failed password for invalid user oracle from 187.141.143.180 port 52276 ssh2", | |
| "cosine_distance": 0.1701723337173462 | |
| }, | |
| { | |
| "template": "Failed password for invalid user <*> from <*> port <*> ssh2", | |
| "message": "Failed password for invalid user ubnt from 103.99.0.122 port 64908 ssh2", | |
| "cosine_distance": 0.19717437028884888 | |
| }, | |
| { | |
| "template": "Failed password for invalid user <*> from <*> port <*> ssh2", | |
| "message": "Failed password for invalid user www from 187.141.143.180 port 56816 ssh2", | |
| "cosine_distance": 0.16611582040786743 | |
| }, | |
| { | |
| "template": "Invalid user <*> from <*>", | |
| "message": "Invalid user test from 52.80.34.196", | |
| "cosine_distance": 0.4723304510116577 | |
| }, | |
| { | |
| "template": "Invalid user <*> from <*>", | |
| "message": "Invalid user 0101 from 5.188.10.180", | |
| "cosine_distance": 0.37971556186676025 | |
| }, | |
| { | |
| "template": "Invalid user <*> from <*>", | |
| "message": "Invalid user inspur from 183.136.162.51", | |
| "cosine_distance": 0.33798789978027344 | |
| }, | |
| { | |
| "template": "Invalid user <*> from <*>", | |
| "message": "Invalid user jay from 187.141.143.180", | |
| "cosine_distance": 0.3608604669570923 | |
| }, | |
| { | |
| "template": "Invalid user <*> from <*>", | |
| "message": "Invalid user api from 185.190.58.151", | |
| "cosine_distance": 0.5245478451251984 | |
| }, | |
| { | |
| "template": "Invalid user <*> from <*>", | |
| "message": "Invalid user webmaster from 173.234.31.186", | |
| "cosine_distance": 0.4469679594039917 | |
| }, | |
| { | |
| "template": "Invalid user <*> from <*>", | |
| "message": "Invalid user abc from 187.141.143.180", | |
| "cosine_distance": 0.3415142297744751 | |
| }, | |
| { | |
| "template": "Invalid user <*> from <*>", | |
| "message": "Invalid user admin from 103.207.39.212", | |
| "cosine_distance": 0.4731658697128296 | |
| }, | |
| { | |
| "template": "Invalid user <*> from <*>", | |
| "message": "Invalid user test9 from 52.80.34.196", | |
| "cosine_distance": 0.4372299313545227 | |
| }, | |
| { | |
| "template": "Invalid user <*> from <*>", | |
| "message": "Invalid user ftpuser from 103.99.0.122", | |
| "cosine_distance": 0.49375367164611816 | |
| }, | |
| { | |
| "template": "Invalid user <*> from <*>", | |
| "message": "Invalid user anonymous from 103.99.0.122", | |
| "cosine_distance": 0.522540956735611 | |
| }, | |
| { | |
| "template": "Invalid user <*> from <*>", | |
| "message": "Invalid user postgres from 187.141.143.180", | |
| "cosine_distance": 0.4480851888656616 | |
| }, | |
| { | |
| "template": "Invalid user <*> from <*>", | |
| "message": "Invalid user FILTER from 104.192.3.34", | |
| "cosine_distance": 0.5969218611717224 | |
| }, | |
| { | |
| "template": "Invalid user <*> from <*>", | |
| "message": "Invalid user admin from 103.207.39.16", | |
| "cosine_distance": 0.4635409116744995 | |
| }, | |
| { | |
| "template": "Invalid user <*> from <*>", | |
| "message": "Invalid user monitor from 103.99.0.122", | |
| "cosine_distance": 0.608041524887085 | |
| }, | |
| { | |
| "template": "Invalid user <*> from <*>", | |
| "message": "Invalid user test from 187.141.143.180", | |
| "cosine_distance": 0.41784197092056274 | |
| }, | |
| { | |
| "template": "Invalid user <*> from <*>", | |
| "message": "Invalid user cheng from 202.100.179.208", | |
| "cosine_distance": 0.4013853073120117 | |
| }, | |
| { | |
| "template": "Invalid user <*> from <*>", | |
| "message": "Invalid user www from 187.141.143.180", | |
| "cosine_distance": 0.43242591619491577 | |
| }, | |
| { | |
| "template": "Invalid user <*> from <*>", | |
| "message": "Invalid user magnos from 187.141.143.180", | |
| "cosine_distance": 0.4101595878601074 | |
| }, | |
| { | |
| "template": "Invalid user <*> from <*>", | |
| "message": "Invalid user support from 103.207.39.16", | |
| "cosine_distance": 0.48802751302719116 | |
| }, | |
| { | |
| "template": "PAM <*> more authentication failure; logname= uid=<*> euid=<*> tty=ssh ruser= rhost=<*>", | |
| "message": "PAM 1 more authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=5.188.10.180", | |
| "cosine_distance": 0.04306727647781372 | |
| }, | |
| { | |
| "template": "PAM <*> more authentication failure; logname= uid=<*> euid=<*> tty=ssh ruser= rhost=<*>", | |
| "message": "PAM 1 more authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.190.58.151", | |
| "cosine_distance": 0.04266202449798584 | |
| }, | |
| { | |
| "template": "PAM <*> more authentication failures; logname= uid=<*> euid=<*> tty=ssh ruser= rhost=<*>", | |
| "message": "PAM 5 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=119.4.203.64", | |
| "cosine_distance": 0.050873756408691406 | |
| }, | |
| { | |
| "template": "PAM <*> more authentication failures; logname= uid=<*> euid=<*> tty=ssh ruser= rhost=<*>", | |
| "message": "PAM 4 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=5.188.10.180", | |
| "cosine_distance": 0.05975902080535889 | |
| }, | |
| { | |
| "template": "PAM <*> more authentication failures; logname= uid=<*> euid=<*> tty=ssh ruser= rhost=<*>", | |
| "message": "PAM 2 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.190.58.151", | |
| "cosine_distance": 0.054563283920288086 | |
| }, | |
| { | |
| "template": "PAM <*> more authentication failures; logname= uid=<*> euid=<*> tty=ssh ruser= rhost=<*>", | |
| "message": "PAM 4 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.190.58.151", | |
| "cosine_distance": 0.05780130624771118 | |
| }, | |
| { | |
| "template": "PAM <*> more authentication failures; logname= uid=<*> euid=<*> tty=ssh ruser= rhost=<*> user=<*>", | |
| "message": "PAM 5 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=5.36.59.76.dynamic-dsl-ip.omantel.net.om user=root", | |
| "cosine_distance": 0.20000135898590088 | |
| }, | |
| { | |
| "template": "PAM <*> more authentication failures; logname= uid=<*> euid=<*> tty=ssh ruser= rhost=<*> user=<*>", | |
| "message": "PAM 5 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.5.5.195 user=root", | |
| "cosine_distance": 0.06935369968414307 | |
| }, | |
| { | |
| "template": "PAM service(sshd) ignoring max retries; <*> > <*>", | |
| "message": "PAM service(sshd) ignoring max retries; 6 > 3", | |
| "cosine_distance": 0.07282662391662598 | |
| }, | |
| { | |
| "template": "PAM service(sshd) ignoring max retries; <*> > <*>", | |
| "message": "PAM service(sshd) ignoring max retries; 5 > 3", | |
| "cosine_distance": 0.07585632801055908 | |
| }, | |
| { | |
| "template": "Received disconnect from <*>: <*>: Bye Bye [preauth]", | |
| "message": "Received disconnect from 104.192.3.34: 11: Bye Bye [preauth]", | |
| "cosine_distance": 0.1767091155052185 | |
| }, | |
| { | |
| "template": "Received disconnect from <*>: <*>: Bye Bye [preauth]", | |
| "message": "Received disconnect from 175.102.13.6: 11: Bye Bye [preauth]", | |
| "cosine_distance": 0.13763612508773804 | |
| }, | |
| { | |
| "template": "Received disconnect from <*>: <*>: Bye Bye [preauth]", | |
| "message": "Received disconnect from 123.235.32.19: 11: Bye Bye [preauth]", | |
| "cosine_distance": 0.13147509098052979 | |
| }, | |
| { | |
| "template": "Received disconnect from <*>: <*>: Bye Bye [preauth]", | |
| "message": "Received disconnect from 52.80.34.196: 11: Bye Bye [preauth]", | |
| "cosine_distance": 0.13705122470855713 | |
| }, | |
| { | |
| "template": "Received disconnect from <*>: <*>: Bye Bye [preauth]", | |
| "message": "Received disconnect from 183.136.162.51: 11: Bye Bye [preauth]", | |
| "cosine_distance": 0.13076138496398926 | |
| }, | |
| { | |
| "template": "Received disconnect from <*>: <*>: Bye Bye [preauth]", | |
| "message": "Received disconnect from 187.141.143.180: 11: Bye Bye [preauth]", | |
| "cosine_distance": 0.12768042087554932 | |
| }, | |
| { | |
| "template": "Received disconnect from <*>: <*>: Bye Bye [preauth]", | |
| "message": "Received disconnect from 183.62.140.253: 11: Bye Bye [preauth]", | |
| "cosine_distance": 0.11433446407318115 | |
| }, | |
| { | |
| "template": "Received disconnect from <*>: <*>: Bye Bye [preauth]", | |
| "message": "Received disconnect from 112.95.230.3: 11: Bye Bye [preauth]", | |
| "cosine_distance": 0.1440955400466919 | |
| }, | |
| { | |
| "template": "Received disconnect from <*>: <*>: Bye Bye [preauth]", | |
| "message": "Received disconnect from 202.100.179.208: 11: Bye Bye [preauth]", | |
| "cosine_distance": 0.14097070693969727 | |
| }, | |
| { | |
| "template": "Received disconnect from <*>: <*>: Bye Bye [preauth]", | |
| "message": "Received disconnect from 60.2.12.12: 11: Bye Bye [preauth]", | |
| "cosine_distance": 0.14710605144500732 | |
| }, | |
| { | |
| "template": "Received disconnect from <*>: <*>: Closed due to user request. [preauth]", | |
| "message": "Received disconnect from 103.207.39.165: 11: Closed due to user request. [preauth]", | |
| "cosine_distance": 0.10381656885147095 | |
| }, | |
| { | |
| "template": "Received disconnect from <*>: <*>: Closed due to user request. [preauth]", | |
| "message": "Received disconnect from 103.207.39.212: 11: Closed due to user request. [preauth]", | |
| "cosine_distance": 0.10851144790649414 | |
| }, | |
| { | |
| "template": "Received disconnect from <*>: <*>: Closed due to user request. [preauth]", | |
| "message": "Received disconnect from 103.207.39.16: 11: Closed due to user request. [preauth]", | |
| "cosine_distance": 0.10292637348175049 | |
| }, | |
| { | |
| "template": "Received disconnect from <*>: <*>: disconnected by user", | |
| "message": "Received disconnect from 119.137.62.142: 11: disconnected by user", | |
| "cosine_distance": 0.18690013885498047 | |
| }, | |
| { | |
| "template": "error: Received disconnect from <*>: <*>: No more user authentication methods available. [preauth]", | |
| "message": "error: Received disconnect from 103.99.0.122: 14: No more user authentication methods available. [preauth]", | |
| "cosine_distance": 0.10147470235824585 | |
| }, | |
| { | |
| "template": "error: Received disconnect from <*>: <*>: com.jcraft.jsch.JSchException: Auth fail [preauth]", | |
| "message": "error: Received disconnect from 195.154.37.122: 3: com.jcraft.jsch.JSchException: Auth fail [preauth]", | |
| "cosine_distance": 0.048297762870788574 | |
| }, | |
| { | |
| "template": "fatal: Write failed: Connection reset by peer [preauth]", | |
| "message": "fatal: Write failed: Connection reset by peer [preauth]", | |
| "cosine_distance": 5.960464477539063e-08 | |
| }, | |
| { | |
| "template": "input_userauth_request: invalid user <*> [preauth]", | |
| "message": "input_userauth_request: invalid user 123 [preauth]", | |
| "cosine_distance": 0.059580981731414795 | |
| }, | |
| { | |
| "template": "input_userauth_request: invalid user <*> [preauth]", | |
| "message": "input_userauth_request: invalid user oralce [preauth]", | |
| "cosine_distance": 0.13871347904205322 | |
| }, | |
| { | |
| "template": "input_userauth_request: invalid user <*> [preauth]", | |
| "message": "input_userauth_request: invalid user postgres [preauth]", | |
| "cosine_distance": 0.19850003719329834 | |
| }, | |
| { | |
| "template": "input_userauth_request: invalid user <*> [preauth]", | |
| "message": "input_userauth_request: invalid user test9 [preauth]", | |
| "cosine_distance": 0.08696085214614868 | |
| }, | |
| { | |
| "template": "input_userauth_request: invalid user <*> [preauth]", | |
| "message": "input_userauth_request: invalid user ftpuser [preauth]", | |
| "cosine_distance": 0.18072068691253662 | |
| }, | |
| { | |
| "template": "input_userauth_request: invalid user <*> [preauth]", | |
| "message": "input_userauth_request: invalid user redhat [preauth]", | |
| "cosine_distance": 0.1210336685180664 | |
| }, | |
| { | |
| "template": "input_userauth_request: invalid user <*> [preauth]", | |
| "message": "input_userauth_request: invalid user nagios [preauth]", | |
| "cosine_distance": 0.198894202709198 | |
| }, | |
| { | |
| "template": "input_userauth_request: invalid user <*> [preauth]", | |
| "message": "input_userauth_request: invalid user nagios1 [preauth]", | |
| "cosine_distance": 0.22087717056274414 | |
| }, | |
| { | |
| "template": "input_userauth_request: invalid user <*> [preauth]", | |
| "message": "input_userauth_request: invalid user sandeep [preauth]", | |
| "cosine_distance": 0.1344515085220337 | |
| }, | |
| { | |
| "template": "input_userauth_request: invalid user <*> [preauth]", | |
| "message": "input_userauth_request: invalid user postgres1 [preauth]", | |
| "cosine_distance": 0.22146815061569214 | |
| }, | |
| { | |
| "template": "input_userauth_request: invalid user <*> [preauth]", | |
| "message": "input_userauth_request: invalid user 1234 [preauth]", | |
| "cosine_distance": 0.06535828113555908 | |
| }, | |
| { | |
| "template": "input_userauth_request: invalid user <*> [preauth]", | |
| "message": "input_userauth_request: invalid user guest [preauth]", | |
| "cosine_distance": 0.10027122497558594 | |
| }, | |
| { | |
| "template": "input_userauth_request: invalid user <*> [preauth]", | |
| "message": "input_userauth_request: invalid user abc [preauth]", | |
| "cosine_distance": 0.07126188278198242 | |
| }, | |
| { | |
| "template": "input_userauth_request: invalid user <*> [preauth]", | |
| "message": "input_userauth_request: invalid user utsims [preauth]", | |
| "cosine_distance": 0.10628014802932739 | |
| }, | |
| { | |
| "template": "input_userauth_request: invalid user <*> [preauth]", | |
| "message": "input_userauth_request: invalid user matlab [preauth]", | |
| "cosine_distance": 0.27230608463287354 | |
| }, | |
| { | |
| "template": "input_userauth_request: invalid user <*> [preauth]", | |
| "message": "input_userauth_request: invalid user pi [preauth]", | |
| "cosine_distance": 0.06898236274719238 | |
| }, | |
| { | |
| "template": "input_userauth_request: invalid user <*> [preauth]", | |
| "message": "input_userauth_request: invalid user anonymous [preauth]", | |
| "cosine_distance": 0.08792901039123535 | |
| }, | |
| { | |
| "template": "input_userauth_request: invalid user <*> [preauth]", | |
| "message": "input_userauth_request: invalid user deploy [preauth]", | |
| "cosine_distance": 0.16761422157287598 | |
| }, | |
| { | |
| "template": "input_userauth_request: invalid user <*> [preauth]", | |
| "message": "input_userauth_request: invalid user admin [preauth]", | |
| "cosine_distance": 0.09407681226730347 | |
| }, | |
| { | |
| "template": "input_userauth_request: invalid user <*> [preauth]", | |
| "message": "input_userauth_request: invalid user cheng [preauth]", | |
| "cosine_distance": 0.15545397996902466 | |
| }, | |
| { | |
| "template": "message repeated <*> times: [ Failed password for <*> from <*> port <*>]", | |
| "message": "message repeated 5 times: [ Failed password for root from 106.5.5.195 port 50719 ssh2]", | |
| "cosine_distance": 0.3114604949951172 | |
| }, | |
| { | |
| "template": "message repeated <*> times: [ Failed password for <*> from <*> port <*>]", | |
| "message": "message repeated 5 times: [ Failed password for root from 5.36.59.76 port 42393 ssh2]", | |
| "cosine_distance": 0.316009521484375 | |
| }, | |
| { | |
| "template": "pam_unix(sshd:auth): authentication failure; logname= uid=<*> euid=<*> tty=ssh ruser= rhost=<*>", | |
| "message": "pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.102.13.6", | |
| "cosine_distance": 0.015689194202423096 | |
| }, | |
| { | |
| "template": "pam_unix(sshd:auth): authentication failure; logname= uid=<*> euid=<*> tty=ssh ruser= rhost=<*>", | |
| "message": "pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.99.0.122", | |
| "cosine_distance": 0.015576362609863281 | |
| }, | |
| { | |
| "template": "pam_unix(sshd:auth): authentication failure; logname= uid=<*> euid=<*> tty=ssh ruser= rhost=<*>", | |
| "message": "pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=119.4.203.64", | |
| "cosine_distance": 0.01775991916656494 | |
| }, | |
| { | |
| "template": "pam_unix(sshd:auth): authentication failure; logname= uid=<*> euid=<*> tty=ssh ruser= rhost=<*>", | |
| "message": "pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=88.147.143.242", | |
| "cosine_distance": 0.015294432640075684 | |
| }, | |
| { | |
| "template": "pam_unix(sshd:auth): authentication failure; logname= uid=<*> euid=<*> tty=ssh ruser= rhost=<*>", | |
| "message": "pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.207.39.212", | |
| "cosine_distance": 0.015426397323608398 | |
| }, | |
| { | |
| "template": "pam_unix(sshd:auth): authentication failure; logname= uid=<*> euid=<*> tty=ssh ruser= rhost=<*>", | |
| "message": "pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=ec2-52-80-34-196.cn-north-1.compute.amazonaws.com.cn", | |
| "cosine_distance": 0.16918301582336426 | |
| }, | |
| { | |
| "template": "pam_unix(sshd:auth): authentication failure; logname= uid=<*> euid=<*> tty=ssh ruser= rhost=<*>", | |
| "message": "pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=112.95.230.3", | |
| "cosine_distance": 0.014888644218444824 | |
| }, | |
| { | |
| "template": "pam_unix(sshd:auth): authentication failure; logname= uid=<*> euid=<*> tty=ssh ruser= rhost=<*>", | |
| "message": "pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.190.58.151", | |
| "cosine_distance": 0.014977335929870605 | |
| }, | |
| { | |
| "template": "pam_unix(sshd:auth): authentication failure; logname= uid=<*> euid=<*> tty=ssh ruser= rhost=<*>", | |
| "message": "pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=5.188.10.180", | |
| "cosine_distance": 0.020104408264160156 | |
| }, | |
| { | |
| "template": "pam_unix(sshd:auth): authentication failure; logname= uid=<*> euid=<*> tty=ssh ruser= rhost=<*>", | |
| "message": "pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.207.39.165", | |
| "cosine_distance": 0.014043092727661133 | |
| }, | |
| { | |
| "template": "pam_unix(sshd:auth): authentication failure; logname= uid=<*> euid=<*> tty=ssh ruser= rhost=<*>", | |
| "message": "pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.100.179.208", | |
| "cosine_distance": 0.023452579975128174 | |
| }, | |
| { | |
| "template": "pam_unix(sshd:auth): authentication failure; logname= uid=<*> euid=<*> tty=ssh ruser= rhost=<*>", | |
| "message": "pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=187.141.143.180", | |
| "cosine_distance": 0.017327725887298584 | |
| }, | |
| { | |
| "template": "pam_unix(sshd:auth): authentication failure; logname= uid=<*> euid=<*> tty=ssh ruser= rhost=<*>", | |
| "message": "pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=195.154.37.122", | |
| "cosine_distance": 0.015332400798797607 | |
| }, | |
| { | |
| "template": "pam_unix(sshd:auth): authentication failure; logname= uid=<*> euid=<*> tty=ssh ruser= rhost=<*>", | |
| "message": "pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.136.162.51", | |
| "cosine_distance": 0.015147864818572998 | |
| }, | |
| { | |
| "template": "pam_unix(sshd:auth): authentication failure; logname= uid=<*> euid=<*> tty=ssh ruser= rhost=<*>", | |
| "message": "pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=173.234.31.186", | |
| "cosine_distance": 0.01401132345199585 | |
| }, | |
| { | |
| "template": "pam_unix(sshd:auth): authentication failure; logname= uid=<*> euid=<*> tty=ssh ruser= rhost=<*>", | |
| "message": "pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.62.140.253", | |
| "cosine_distance": 0.016518831253051758 | |
| }, | |
| { | |
| "template": "pam_unix(sshd:auth): authentication failure; logname= uid=<*> euid=<*> tty=ssh ruser= rhost=<*>", | |
| "message": "pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.192.3.34", | |
| "cosine_distance": 0.02594935894012451 | |
| }, | |
| { | |
| "template": "pam_unix(sshd:auth): authentication failure; logname= uid=<*> euid=<*> tty=ssh ruser= rhost=<*>", | |
| "message": "pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.207.39.16", | |
| "cosine_distance": 0.014950752258300781 | |
| }, | |
| { | |
| "template": "pam_unix(sshd:auth): authentication failure; logname= uid=<*> euid=<*> tty=ssh ruser= rhost=<*> user=<*>", | |
| "message": "pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.207.39.212 user=uucp", | |
| "cosine_distance": 0.037923216819763184 | |
| }, | |
| { | |
| "template": "pam_unix(sshd:auth): authentication failure; logname= uid=<*> euid=<*> tty=ssh ruser= rhost=<*> user=<*>", | |
| "message": "pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=187.141.143.180 user=ftp", | |
| "cosine_distance": 0.08169066905975342 | |
| }, | |
| { | |
| "template": "pam_unix(sshd:auth): authentication failure; logname= uid=<*> euid=<*> tty=ssh ruser= rhost=<*> user=<*>", | |
| "message": "pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=123.235.32.19 user=root", | |
| "cosine_distance": 0.029101073741912842 | |
| }, | |
| { | |
| "template": "pam_unix(sshd:auth): authentication failure; logname= uid=<*> euid=<*> tty=ssh ruser= rhost=<*> user=<*>", | |
| "message": "pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=112.95.230.3 user=root", | |
| "cosine_distance": 0.02612292766571045 | |
| }, | |
| { | |
| "template": "pam_unix(sshd:auth): authentication failure; logname= uid=<*> euid=<*> tty=ssh ruser= rhost=<*> user=<*>", | |
| "message": "pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=187.141.143.180 user=git", | |
| "cosine_distance": 0.09812259674072266 | |
| }, | |
| { | |
| "template": "pam_unix(sshd:auth): authentication failure; logname= uid=<*> euid=<*> tty=ssh ruser= rhost=<*> user=<*>", | |
| "message": "pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.62.140.253 user=root", | |
| "cosine_distance": 0.02487283945083618 | |
| }, | |
| { | |
| "template": "pam_unix(sshd:auth): authentication failure; logname= uid=<*> euid=<*> tty=ssh ruser= rhost=<*> user=<*>", | |
| "message": "pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.99.0.122 user=ftp", | |
| "cosine_distance": 0.08652997016906738 | |
| }, | |
| { | |
| "template": "pam_unix(sshd:auth): authentication failure; logname= uid=<*> euid=<*> tty=ssh ruser= rhost=<*> user=<*>", | |
| "message": "pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.99.0.122 user=uucp", | |
| "cosine_distance": 0.04213303327560425 | |
| }, | |
| { | |
| "template": "pam_unix(sshd:auth): authentication failure; logname= uid=<*> euid=<*> tty=ssh ruser= rhost=<*> user=<*>", | |
| "message": "pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.207.39.16 user=uucp", | |
| "cosine_distance": 0.040737032890319824 | |
| }, | |
| { | |
| "template": "pam_unix(sshd:auth): authentication failure; logname= uid=<*> euid=<*> tty=ssh ruser= rhost=<*> user=<*>", | |
| "message": "pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=60.2.12.12 user=root", | |
| "cosine_distance": 0.039644479751586914 | |
| }, | |
| { | |
| "template": "pam_unix(sshd:auth): authentication failure; logname= uid=<*> euid=<*> tty=ssh ruser= rhost=<*> user=<*>", | |
| "message": "pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=187.141.143.180 user=root", | |
| "cosine_distance": 0.026035308837890625 | |
| }, | |
| { | |
| "template": "pam_unix(sshd:auth): authentication failure; logname= uid=<*> euid=<*> tty=ssh ruser= rhost=<*> user=<*>", | |
| "message": "pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=187.141.143.180 user=mysql", | |
| "cosine_distance": 0.1062161922454834 | |
| }, | |
| { | |
| "template": "pam_unix(sshd:auth): authentication failure; logname= uid=<*> euid=<*> tty=ssh ruser= rhost=<*> user=<*>", | |
| "message": "pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=5.36.59.76.dynamic-dsl-ip.omantel.net.om user=root", | |
| "cosine_distance": 0.17795062065124512 | |
| }, | |
| { | |
| "template": "pam_unix(sshd:auth): authentication failure; logname= uid=<*> euid=<*> tty=ssh ruser= rhost=<*> user=<*>", | |
| "message": "pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=5.188.10.180 user=ftp", | |
| "cosine_distance": 0.07154762744903564 | |
| }, | |
| { | |
| "template": "pam_unix(sshd:auth): authentication failure; logname= uid=<*> euid=<*> tty=ssh ruser= rhost=<*> user=<*>", | |
| "message": "pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.99.0.122 user=sshd", | |
| "cosine_distance": 0.01916491985321045 | |
| }, | |
| { | |
| "template": "pam_unix(sshd:auth): authentication failure; logname= uid=<*> euid=<*> tty=ssh ruser= rhost=<*> user=<*>", | |
| "message": "pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.62.140.253 user=git", | |
| "cosine_distance": 0.08292520046234131 | |
| }, | |
| { | |
| "template": "pam_unix(sshd:auth): authentication failure; logname= uid=<*> euid=<*> tty=ssh ruser= rhost=<*> user=<*>", | |
| "message": "pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.99.0.122 user=root", | |
| "cosine_distance": 0.025272607803344727 | |
| }, | |
| { | |
| "template": "pam_unix(sshd:auth): authentication failure; logname= uid=<*> euid=<*> tty=ssh ruser= rhost=<*> user=<*>", | |
| "message": "pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=195.154.37.122 user=uucp", | |
| "cosine_distance": 0.04119652509689331 | |
| }, | |
| { | |
| "template": "pam_unix(sshd:auth): authentication failure; logname= uid=<*> euid=<*> tty=ssh ruser= rhost=<*> user=<*>", | |
| "message": "pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.192.3.34 user=root", | |
| "cosine_distance": 0.03222048282623291 | |
| }, | |
| { | |
| "template": "pam_unix(sshd:auth): authentication failure; logname= uid=<*> euid=<*> tty=ssh ruser= rhost=<*> user=<*>", | |
| "message": "pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.5.5.195 user=root", | |
| "cosine_distance": 0.023884057998657227 | |
| }, | |
| { | |
| "template": "pam_unix(sshd:auth): check pass; user unknown", | |
| "message": "pam_unix(sshd:auth): check pass; user unknown", | |
| "cosine_distance": 0.0 | |
| }, | |
| { | |
| "template": "pam_unix(sshd:session): session closed for user <*>", | |
| "message": "pam_unix(sshd:session): session closed for user fztu", | |
| "cosine_distance": 0.13193261623382568 | |
| }, | |
| { | |
| "template": "pam_unix(sshd:session): session opened for user <*> by (uid=<*>)", | |
| "message": "pam_unix(sshd:session): session opened for user fztu by (uid=0)", | |
| "cosine_distance": 0.12037825584411621 | |
| }, | |
| { | |
| "template": "reverse mapping checking getaddrinfo for <*> [<*>] failed - POSSIBLE BREAK-IN ATTEMPT!", | |
| "message": "reverse mapping checking getaddrinfo for 195-154-37-122.rev.poneytelecom.eu [195.154.37.122] failed - POSSIBLE BREAK-IN ATTEMPT!", | |
| "cosine_distance": 0.19009792804718018 | |
| }, | |
| { | |
| "template": "reverse mapping checking getaddrinfo for <*> [<*>] failed - POSSIBLE BREAK-IN ATTEMPT!", | |
| "message": "reverse mapping checking getaddrinfo for ns.marryaldkfaczcz.com [173.234.31.186] failed - POSSIBLE BREAK-IN ATTEMPT!", | |
| "cosine_distance": 0.22568243741989136 | |
| }, | |
| { | |
| "template": "reverse mapping checking getaddrinfo for <*> [<*>] failed - POSSIBLE BREAK-IN ATTEMPT!", | |
| "message": "reverse mapping checking getaddrinfo for customer-187-141-143-180-sta.uninet-ide.com.mx [187.141.143.180] failed - POSSIBLE BREAK-IN ATTEMPT!", | |
| "cosine_distance": 0.26402634382247925 | |
| }, | |
| { | |
| "template": "reverse mapping checking getaddrinfo for <*> [<*>] failed - POSSIBLE BREAK-IN ATTEMPT!", | |
| "message": "reverse mapping checking getaddrinfo for 191-210-223-172.user.vivozap.com.br [191.210.223.172] failed - POSSIBLE BREAK-IN ATTEMPT!", | |
| "cosine_distance": 0.2510530948638916 | |
| } | |
| ] |