Generalisation of new SSH regex

2024-01-06 12:00:00 +01:00
parent ed809f4f98
commit e1ff702cd1
3 changed files with 4 additions and 3 deletions
--- a/app/example.yml
+++ b/app/example.yml
@ -55,7 +55,7 @@ streams:
          # ip's regex is inserted in the following regex
          - 'authentication failure;.*rhost=<ip>'
          - 'Failed password for .* from <ip>'
-          - 'Connection reset by authenticating user .* <ip>'
+          - 'Connection (reset|closed) by (authenticating|invalid) user .* <ip>'
        # if retry and retryperiod are defined,
        # the actions will only take place if a same pattern is
        # found `retry` times in a `retryperiod` interval