DET-H11: Root login on a TEE host¶
A successful interactive root login on a host running confidential guests, read from the host's sshd auth log by the collector (opt-in; root only, no command content). Interactive root access is outside the hardened-host baseline.
| Property | Value |
|---|---|
| Severity | high |
| Platform | Hardware fleets |
| Group | hardware |
| Log source | Collector · sshd auth (journald) |
| Related check | SSH-01: Remote access hardening |
Fires when¶
sshd auth log shows an accepted root login on a TEE host
How it runs¶
The hosted service evaluates this rule on what enrolled collectors report and on key-release decisions. There is nothing to run; see Enroll a collector.
A match appears in the console as a detection with this rule's ID and triggers your alerts; see Runtime detections.