X-Git-Url: http://ftp.carnet.hr/carnet-debian/scm?p=ossec-hids.git;a=blobdiff_plain;f=etc%2Frules%2Fdovecot_rules.xml;fp=etc%2Frules%2Fdovecot_rules.xml;h=cd49bf6838091826c147dd14adffd989d8e6af81;hp=61fa2f32e414ee63a9914834d6fafb3af4ff3719;hb=3f728675941dc69d4e544d3a880a56240a6e394a;hpb=927951d1c1ad45ba9e7325f07d996154a91c911b

diff --git a/etc/rules/dovecot_rules.xml b/etc/rules/dovecot_rules.xml
index 61fa2f3..cd49bf6 100644
--- a/etc/rules/dovecot_rules.xml
+++ b/etc/rules/dovecot_rules.xml
@@ -41,7 +41,7 @@
 
 <rule id="9705" level="5">
   <if_sid>9700</if_sid>
-  <match>user not found|User not known|unknown user</match>
+  <match>user not found|User not known|unknown user|auth failed</match>
   <description>Dovecot Invalid User Login Attempt.</description>
   <group>invalid_login,authentication_failed,</group>
 </rule>
@@ -74,4 +74,18 @@
   <description>Dovecot brute force attack (multiple auth failures).</description>
   <group>authentication_failures,</group>
 </rule>
+
+<rule id="9770" level="0">
+  <decoded_as>dovecot-info</decoded_as>
+  <description>dovecot-info grouping.</description>
+</rule>
+
+<rule id="9771" level="5">
+  <if_sid>9770</if_sid>
+  <match>user not found|User not known|unknown user|auth failed</match>
+  <description>Dovecot Invalid User Login Attempt.</description>
+  <group>invalid_login,authentication_failed,</group>
+</rule>
+ 
+
 </group>