Watcher alert, ssh auth

Elastic Security SIEM
1

hey there, i'm new using elastic and i just wanna asking about alerting. i make an alert through email. but i don't know how the user id showed up at body email and the count the user try. btw this for ssh auth.

thanks

2

Can you show us the Watcher that you are trying to use?

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.