**Phase 1: Completed pre-decoding.
       full event: 'Nov 24 18:18:28 gandalf pop3d: LOGIN FAILED, ip=[::ffff:1.2.3.4]'
       hostname: 'gandalf'
       program_name: 'pop3d'
       log: 'LOGIN FAILED, ip=[::ffff:1.2.3.4]'

**Phase 2: Completed decoding.
       decoder: 'courier'
       srcip: '::ffff:1.2.3.4'

**Phase 3: Completed filtering (rules).
       Rule id: '3902'
       Level: '5'
       Description: 'Courier (imap/pop3) authentication failed.'
**Alert to be generated.