5 lines
552 B
JSON
5 lines
552 B
JSON
{
|
|
"title": "juniper_ssh_failed_password",
|
|
"description": "Juniper sshd Failed password line",
|
|
"source": "rule \"juniper_ssh_failed_password\"\nwhen\n contains(to_string($message.message), \"Failed password for\")\nthen\n set_field(\"vendor\", \"juniper\");\n set_field(\"event_type\", \"ssh_auth_failed\");\n let m = regex(\"Failed password for (\\\\S+) from (\\\\S+) port (\\\\d+)\", to_string($message.message), [\"user\",\"src_ip\",\"src_port\"]);\n set_field(\"auth_user\", m[\"user\"]);\n set_field(\"src_ip\", m[\"src_ip\"]);\nend"
|
|
}
|