1 **Phase 1: Completed pre-decoding.
2 full event: 'Nov 24 18:18:28 gandalf pop3d: LOGIN FAILED, ip=[::ffff:1.2.3.4]'
5 log: 'LOGIN FAILED, ip=[::ffff:1.2.3.4]'
7 **Phase 2: Completed decoding.
9 srcip: '::ffff:1.2.3.4'
11 **Phase 3: Completed filtering (rules).
14 Description: 'Courier (imap/pop3) authentication failed.'
15 **Alert to be generated.