The SSH Login Was Successful. That Was the Problem.

Most intrusion alerts start with failures.