[ossec-list] a unique rule - password AFTER keys

[Kat]

Ok this one has me stumped and I am not sure it can be done.

I have a dozen or so accounts using ssh keys. Pretty normal. I want to
set an alert only if one of these accounts suddenly starts asking for
a password? Any ideas?

thanks
~k