zeek/doc/frameworks/notice_ssh_guesser.zeek
Patrick Kelley 8fd444092b initial
2025-05-07 15:35:15 -04:00

11 lines
236 B
Plaintext

@load protocols/ssh/detect-bruteforcing
redef SSH::password_guesses_limit=10;
hook Notice::policy(n: Notice::Info)
{
if ( n$note == SSH::Password_Guessing && /192\.168\.56\.103/ in n$sub )
add n$actions[Notice::ACTION_EMAIL];
}