Merge pull request #1803 from jknockaert/patch-2

limit brute force rule to dropbear
ossec · Dec 12, 2019 · abb36d4 · abb36d4
2 parents 160c6d4 + cbdb403
commit abb36d4
Showing 1 changed file with 1 addition and 0 deletions.
diff --git a/etc/rules/dropbear_rules.xml b/etc/rules/dropbear_rules.xml
@@ -47,6 +47,7 @@
   <rule id="51004" level="10" frequency="6" timeframe="120" ignore="60">
     <if_matched_group>authentication_failed</if_matched_group>
     <same_source_ip />
+    <decoded_as>dropbear</decoded_as>
     <description>dropbear brute force attempt.</description>
     <group>authentication_failures,</group>
   </rule>