**Phase 1: Completed pre-decoding.
       full event: 'May 17 01:01:19 server ftpd[746]: ANONYMOUS FTP LOGIN FROM emaca.here.com'
       hostname: 'server'
       program_name: 'ftpd'
       log: 'ANONYMOUS FTP LOGIN FROM emaca.here.com'

**Phase 2: Completed decoding.
       decoder: 'ftpd'

**Phase 3: Completed filtering (rules).
       Rule id: '11106'
       Level: '3'
       Description: 'Remote host connected to FTP server.'
**Alert to be generated.