DET-H12: New root SSH key authorized

A key was added to root's authorized_keys between two collector snapshots: a new way to log in as root on a host running confidential guests.

Property	Value
Severity	high
Platform	Hardware fleets
Group	hardware
Log source	Collector · root authorized_keys
Related check	SSH-01: Remote access hardening

Fires when

a new key appeared in root's authorized_keys between collector snapshots

How it runs

The hosted service evaluates this rule on what enrolled collectors report and on key-release decisions. There is nothing to run; see Enroll a collector.

A match appears in the console as a detection with this rule's ID and triggers your alerts; see Runtime detections.