Bitbucket User Login Failure Via SSH — Detection Rule

Detects SSH user login access failures. Please note that this rule can be noisy and is recommended to use with correlation based on "author.name" field.

Read the full analysis on IntelFusions