Write a Python regex detection rule for failed SSH password attempts with named user and ip groups, scored…
Write a Python regex detection rule for failed SSH password attempts with named user and ip groups, scored…: a task in pool-desk (Harbor dataset). Our log forwarder takes one Python regular expression per alert and ships its named groups as fields. I need the rule for failed SSH password attempts…
The task
Our log forwarder takes one Python regular expression per alert and ships its named groups as fields. I need the rule for **failed SSH password attempts**, with the attempted account in a group named `user` and the source address in a group named `ip`.
Part of vibrantlabsai/pool-desk.