debian/ossec-hids/var/ossec/rules/opensmtpd_rules.xml

   1 <!--
   2 Aug 14 10:15:25 junction.example.com smtpd[28882]: smtp-in: Failed command on session 1f55bdcdf16e28a3: "MAIL FROM:<root@junction.example.com>  " => 421 4.3.0: Temporar
   3 y Error
   4 -->
   5
   6 <group name="syslog,smtpd,">
   7
   8   <rule id="53500" level="0">
   9     <decoded_as>smtpd</decoded_as>
  10     <description>OpenSMTPd grouping.</description>
  11   </rule>
  12
  13   <rule id="53501" level="3">
  14     <decoded_as>smtpd</decoded_as>
  15     <if_sid>53500</if_sid>
  16     <status>Failed</status>
  17     <description>Message failed.</description>
  18   </rule>
  19
  20   <rule id="53502" level="0">
  21     <decoded_as>smtpd</decoded_as>
  22     <if_sid>53500</if_sid>
  23     <match> New session</match>
  24     <description>New session created.</description>
  25   </rule>
  26
  27   <rule id="53503" level="0">
  28     <decoded_as>smtpd</decoded_as>
  29     <if_sid>53500</if_sid>
  30     <match> Closing session</match>
  31     <description>Session closed.</description>
  32   </rule>
  33
  34   <rule id="53504" level="0">
  35     <decoded_as>smtpd</decoded_as>
  36     <if_sid>53500</if_sid>
  37     <status>Accepted</status>
  38     <description>Message accepted.</description>
  39   </rule>
  40
  41   <rule id="53505" level="0">
  42     <decoded_as>smtpd</decoded_as>
  43     <if_sid>53500</if_sid>
  44     <match>delivery: Ok</match>
  45     <description>Email delivered.</description>
  46   </rule>
  47
  48   <rule id="53506" level="2">
  49     <if_sid>53501</if_sid>
  50     <match>Command not supported$</match>
  51     <description>SMTP command not supported.</description>
  52   </rule>
  53
  54   <rule id="53507" level="2">
  55     <decoded_as>smtpd</decoded_as>
  56     <if_sid>53500</if_sid>
  57     <match>IO error: No SSL error$</match>
  58     <description>OpenSMTPd: no SSL</description>
  59   </rule>
  60
  61   <rule id="53508" level="5">
  62     <decoded_as>smtpd</decoded_as>
  63     <if_sid>53500</if_sid>
  64     <match>Server certificate verification failed</match>
  65     <description>Server TLS certificate verification failed.</description>
  66   </rule>
  67
  68 </group>