-<!-- @(#) $Id$
+<!-- @(#) $Id: ./etc/rules/apache_rules.xml, 2011/09/08 dcid Exp $
+
- Official Apache rules for OSSEC.
-
- Copyright (C) 2009 Trend Micro Inc.
<rule id="30109" level="9">
<if_sid>30101</if_sid>
- <regex>user \S+ not found</regex>
+ <regex>user \S+ not found|user \S+ in realm \.* not found</regex>
<description>Attempt to login using a non-existent user.</description>
<group>invalid_login,</group>
</rule>