{
  "alert": {
    "id": 3,
    "ts": 1789158486.6315343,
    "host": "web01",
    "rule": "auth_success_root",
    "severity": "high",
    "message": "Inicio de sesión como root",
    "mitre_tactic": "Privilege Escalation",
    "mitre_technique": "T1078.003",
    "mitre_technique_name": "Valid Accounts: Local Accounts"
  },
  "raw_evidence": [
    {
      "ts": 1789158486.6315343,
      "raw_text": "<38>Sep 11 10:00:30 web01 sshd[1240]: Accepted password for root from 203.0.113.5 port 51250 ssh2"
    }
  ]
}