got initial ssh monitor working
working custom events definition with regex
add example login event