Ssh

Detect an SSH login after social engineering
Detect an SSH login after social engineering
Detect a compromised SSH account in one year of OpenSSH logs with Squey, spotting suspicious logins by time and location using parallel coordinates.