Zeek SSH JSON

Zeek SSH JSON. Zeek protocol analysis produces structured metadata from observed network traffic.

zeek json network sensor ssh

Source and collection

Corresponding Zeek log stream with JSON output enabled; default TSV is a different serialization.

Document sensor placement, packet loss, enabled analyzers and JSON logging configuration.

Native example and provenance

publisher documentation example. Published example; no independent capture provenance claimed.

Original publisher / pinned upstream fixture — preformatted example 1

One complete record selected; values unchanged.

Download the exact sample · Offline research kit

SHA-256: 6a9521a4a6bf830700b21992e3802ba315af5f5a8bdf85fd5582f0def43fba54

{
  "ts": "2020-09-16T13:39:18.425492Z",
  "uid": "C72qTo2v3FBhwysEIc",
  "id.orig_h": "192.168.4.142",
  "id.orig_p": 54161,
  "id.resp_h": "192.168.4.1",
  "id.resp_p": 22,
  "version": 2,
  "auth_success": true,
  "auth_attempts": 1,
  "client": "SSH-2.0-SecureBlackbox",
  "server": "SSH-2.0-OpenSSH_6.6.1p1 Debian-4~bpo70+1",
  "cipher_alg": "aes128-ctr",
  "mac_alg": "umac-64@openssh.com",
  "compression_alg": "none",
  "kex_alg": "diffie-hellman-group1-sha1",
  "host_key_alg": "ssh-rsa",
  "host_key": "f9:1f:45:88:dd:da:82:c5:7c:9d:75:c3:ac:e6:f4:f6",
  "hasshVersion": "1.0",
  "hassh": "3f0109679e469fced2c82384f0fa3917",
  "hasshServer": "b003da101c8caf37ce9e3ca3cd9d049b",
  "cshka": "ssh-rsa,ssh-dss",
  "hasshAlgorithms": "diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr;umac-64@openssh.com,hmac-sha2-256,hmac-sha2-512,umac-128@openssh.com,hmac-md5,hmac-md5-96,hmac-sha1,hmac-sha1-96,hmac-ripemd160@openssh.com,hmac-ripemd160;none,zlib,zlib@openssh.com",
  "sshka": "ssh-rsa,ssh-dss,ecdsa-sha2-nistp256,ssh-ed25519",
  "hasshServerAlgorithms": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com;hmac-md5-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-ripemd160-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,hmac-md5,hmac-sha1,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96;none,zlib@openssh.com"
}

Structure and field interpretation

Observed structure in this specific sample
Field/pathSerialized type
tsstr
uidstr
id.orig_hstr
id.orig_pint
id.resp_hstr
id.resp_pint
versionint
auth_successbool
auth_attemptsint
clientstr
serverstr
cipher_algstr
mac_algstr
compression_algstr
kex_algstr
host_key_algstr
host_keystr
hasshVersionstr
hasshstr
hasshServerstr
cshkastr
hasshAlgorithmsstr
sshkastr
hasshServerAlgorithmsstr
ts
Epoch timestamp of the logged activity.
uid
Connection identifier, when present; retain sensor context.
fuid
File identifier, when present.
id.orig_h / id.resp_h
Originator and responder addresses, not necessarily client intent.

Investigation uses

Validation boundaries

Encrypted payloads and sensor visibility limit what can be observed. Missing fields are not equivalent to a negative finding.

This sample passed byte-integrity and JSON/XML parsing checks, including the catalogue’s specified event discriminators. This is not a complete vendor-schema validation or a tested detection.

For a simulation, first parse this fixture offline, then create a separately labelled synthetic variant and test it against the intended collector in an isolated lab. Never replay public example identities or destinations into production.

Ecosystem connections

References

Sample provenance is linked above. Field availability and product behavior must be checked against the deployed version.