MozDef/alerts/ssh_access.json

{
    "watchlist": [
        {"hostname": "nagios1.small.corp.com", "ipaddress": "11.22.33.44"},
        {"hostname": "nagios2.super.corp.com", "ipaddress": "11.22.33.45"}
    ]
}