SSH Activity (4007) Class Enhancements & some other comments

[jonnadul]

Would it be possible to expand this class to also capture the following event types from the SSHD server?

• Authentication Type (password, public key, etc)
• TTY session command logging

There are some changes to SSHD config that should be captured, changing LDAP endpoints, etc.

[jonnadul]

I was also curious about whether boot settings are also captured, like secure boot enablement, secure boot keys, etc.

[Aniak5]

This is definitely possible. Do you happen to have an example log that we could look at please?