diff --git a/data/ssh_keyscan.json b/data/ssh_keyscan.json
new file mode 100644
index 0000000..ea66cb6
--- /dev/null
+++ b/data/ssh_keyscan.json
@@ -0,0 +1,20 @@
+{
+  "description": "The file content is actually parsed so only a part of each line is returned as a part of an error message.\n",
+  "functions": {
+    "file-read": [
+      {
+        "code": "ssh-keyscan -f [file]\n"
+      }
+    ],
+    "suid": [
+      {
+        "code": "./ssh-keyscan -f [file]\n"
+      }
+    ],
+    "sudo": [
+      {
+        "code": "sudo ssh-keyscan -f [file]\n"
+      }
+    ]
+  }
+}