zeek/doc/frameworks/netcontrol-3-ssh-guesser.zeek
Patrick Kelley 8fd444092b initial
2025-05-07 15:35:15 -04:00

17 lines
326 B
Plaintext

@load protocols/ssh/detect-bruteforcing
redef SSH::password_guesses_limit=10;
event NetControl::init()
{
local debug_plugin = NetControl::create_debug(T);
NetControl::activate(debug_plugin, 0);
}
hook Notice::policy(n: Notice::Info)
{
if ( n$note == SSH::Password_Guessing )
add n$actions[Notice::ACTION_DROP];
}