Improve SSHSessionizerSketchPlugin

google / timesketch

Collaborative forensic timeline analysis

Apache License 2.0

2.58k stars 589 forks source link

Improve SSHSessionizerSketchPlugin #2874

Open roshanmaskey opened 1 year ago

roshanmaskey commented 1 year ago

SSHSessionizerSketchPlugin currently adds session_id based on the SSH connection information. Improve the SSHSessionizerSketchPlugin to tag the following:

SSH successful logon/logoff events
User activities in that successful SSH session