An SSH module is executed as part of a host computing machine, where code for an secure shell (SSH) agent is integrated with code of the SSH module. Incoming and outgoing host computing machine transactions are collected using the SSH agent which transmits the collected host computing machine transactions to an SSH context agent external to the SSH module. The collected host machine transactions are transmitted to a monitoring server for anomalous transaction detection. The monitoring server returns instructions to perform an action based on an anomalous transaction detection.