--- /dev/null
+**Phase 1: Completed pre-decoding.
+ full event: 'May 17 01:01:19 server ftpd[746]: ANONYMOUS FTP LOGIN FROM emaca.here.com'
+ hostname: 'server'
+ program_name: 'ftpd'
+ log: 'ANONYMOUS FTP LOGIN FROM emaca.here.com'
+
+**Phase 2: Completed decoding.
+ decoder: 'ftpd'
+ srcip: 'emaca.here.com'
+
+**Phase 3: Completed filtering (rules).
+ Rule id: '11106'
+ Level: '3'
+ Description: 'Remote host connected to FTP server.'
+**Alert to be generated.
+
+