Glossary: Logs and Data Sources for Investigations

SSH (Secure Shell)

Also written: SSH

The encrypted way administrators sign in to a Linux server remotely, using a password or a key. The attacker signed in to the shop server as sam over SSH on port 22.

Where the book teaches it

Chapter 1: Application, Authentication, Communication and Audit Logs
Chapter 2: Endpoint, Network and Metadata Logs
Chapter 3: Scans, Reports, Flow Records and Footage
Chapter 4: Security Tools, Dashboards, Packet Captures and Integrity

Related terms

sshd Authentication log