zeek/doc/frameworks/netcontrol-2-ssh-guesser.zeek
Patrick Kelley 8fd444092b initial
2025-05-07 15:35:15 -04:00

17 lines
330 B
Plaintext

@load protocols/ssh/detect-bruteforcing
redef SSH::password_guesses_limit=10;
event NetControl::init()
{
local debug_plugin = NetControl::create_debug(T);
NetControl::activate(debug_plugin, 0);
}
hook Notice::policy(n: Notice::Info)
{
if ( n$note == SSH::Password_Guessing )
NetControl::drop_address(n$src, 60min);
}