Here is an example of a really simple but cool query that can be setup in vRealize Log Insight to track accepted and failed SSH logins to Edge devices.
Query:
Match ALL:
appname contains “sshd”
text contains “failed password” (This can be changed to “accepted password” to track accepted logins)
hostname contains “hostname”
Pingback: Newsletter: July 8, 2017 | Notes from MWhite