{
  "title": "juniper_ssh_failed_password",
  "description": "Juniper sshd Failed password line",
  "source": "rule \"juniper_ssh_failed_password\"\nwhen\n  contains(to_string($message.message), \"Failed password for\")\nthen\n  set_field(\"vendor\", \"juniper\");\n  set_field(\"event_type\", \"ssh_auth_failed\");\n  let m = regex(\"Failed password for (\\\\S+) from (\\\\S+) port (\\\\d+)\", to_string($message.message), [\"user\",\"src_ip\",\"src_port\"]);\n  set_field(\"auth_user\", m[\"user\"]);\n  set_field(\"src_ip\", m[\"src_ip\"]);\nend"
}