{
  "alert": {
    "id": 4,
    "ts": 1789158486.6315343,
    "host": "web01",
    "rule": "root_login_external",
    "severity": "critical",
    "message": "Login como root desde una IP fuera del rango interno",
    "mitre_tactic": "Initial Access",
    "mitre_technique": "T1078",
    "mitre_technique_name": "Valid Accounts"
  },
  "raw_evidence": [
    {
      "ts": 1789158486.6315343,
      "raw_text": "<38>Sep 11 10:00:30 web01 sshd[1240]: Accepted password for root from 203.0.113.5 port 51250 ssh2"
    }
  ]
}