DET-H14: Root SSH visibility lost¶
A collector that was reporting root's SSH state stopped: its root_ssh reader went unreadable, or the opt-in was turned off. DET-H11..H13 go blind while the signal is dark, so an operator knows the signal was lost rather than assuming the host is clean.
| Property | Value |
|---|---|
| Severity | medium |
| Platform | Hardware fleets |
| Group | hardware |
| Log source | Collector · root_ssh |
| Related check | SSH-01: Remote access hardening |
Fires when¶
the collector stopped reporting root SSH state (visibility lost)
How it runs¶
The hosted service evaluates this rule on what enrolled collectors report and on key-release decisions. There is nothing to run; see Enroll a collector.
A match appears in the console as a detection with this rule's ID and triggers your alerts; see Runtime detections.