UAT-8616 Unauthorized SSH Login to Cisco SD-WAN vManage via vmanage-admin

Ibrahim Saud@tektrix

•updated Jun 25, 2026•0•0•4

This rule detects successful SSH login events utilizing public key authentication for the 'vmanage-admin' user. It aggregates login events by source IP, username, and host to identify patterns of access for this specific administrative account.