-
-
Save faxm0dem/b2c87efb098b4aba1969 to your computer and use it in GitHub Desktop.
patterndb example
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
<patterndb version='4' pub_date='2010-10-17'> | |
<ruleset name='ssh' id='123456678'> | |
<pattern>ssh</pattern> | |
<rules> | |
<rule provider='me' id='182437592347598' class='system'> | |
<patterns> | |
<pattern>Accepted @ESTRING:SSH.AUTH_METHOD: @for @ESTRING:SSH_USERNAME: @from @ESTRING:SSH_CLIENT_ADDRESS: @port @NUMBER:SSH_PORT_NUMBER:@ ssh2</pattern> | |
</patterns> | |
<examples> | |
<example> | |
<test_message program="sshd">Accepted password for sampleuser from 10.50.0.247 port 42156 ssh2</test_message> | |
<test_values> | |
<test_value name="SSH.AUTH_METHOD">password</test_value> | |
<test_value name="SSH_USERNAME">sampleuser</test_value> | |
<test_value name="SSH_CLIENT_ADDRESS">10.50.0.247</test_value> | |
<test_value name="SSH_PORT_NUMBER">42156</test_value> | |
</test_values> | |
</example> | |
</examples> | |
</rule> | |
</rules> | |
</ruleset> | |
</patterndb> |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment