[failed command]
log 1 fail = Apr 13 08:49:20 ix doas: failed command for ddp2: ls

rule = 51554
alert = 5
decoder = doas

[command run as root]
log 1 fail = Mar 22 07:21:58 ix doas: ddp ran command /bin/ksh as root from /data/ddp/projects/git/sysconf/ossec/rules

rule = 51556
alert = 2
decoder = doas

[failed auth]
log 1 fail = Feb 29 14:58:39 ix doas: failed auth for ddp

rule = 51557
alert = 5
decoder = doas

[doas command run]
log 1 fail = Aug 13 15:16:40 ix doas: ddp ran command as ddpnfs: ls

rule = 51555
alert = 1
decoder = doas