(pam_unix)$ ^vsftpd ^pam_unix pam rhost=\S+\s+user=\S+ rhost=(\S+)\s+user=(\S+) srcip, user pam session opened ^for user (\S+) user pam rhost ^=(\S+) srcip ^sshd sshd ^Accepted ^ \S+ for (\S+) from (\S+) port user, srcip name, user, location sshd ^User \S+ from ^User (\S+) from (\S+) user, srcip sshd ^User ^(\S+), comming from (\S+), auth user, srcip name, user, location sshd ^Failed \S+ for invalid user|^Failed \S+ for illegal user from (\S+) port \d+ \w+$ srcip sshd ^Failed \S+ ^for (\S+) from (\S+) port \d+ \w+$ user, srcip sshd ^error: PAM: Authentication ^failure for (\S+) from (\S+)$ user, srcip sshd ^reverse mapping checking ^\w+ for (\S+) failed - srcip sshd ^Invalid user|^Illegal user from (\S+)$ srcip sshd from (\S+)$ srcip ^telnetd|^in.telnetd telnetd from (\d+.\d+.\d+.\d+)$ srcip ^smbd smbd User name: ^ (\S+). user smbd from \((\d+.\d+.\d+.\d+)\) srcip ^sudo ^\s+(\S+)\s: user name,user,location First time user executed the sudo command ^su$ ^BAD SU (\S+) to (\S+) on| ^failed: \S+ changing from (\S+) to (\S+)| ^\S \S+ (\S+)\p(\S+)$|^(\S+) to (\S+) on user, dstuser name, user, location ^SU \S+ \S+ ^\S \S+ (\S+)-(\S+)$ user, dstuser name, user, location ^proftpd proftpd : Login successful ^\S+ \(\S+[(\S+)]\)\s*\S \w+ (\S+): Login successful srcip, user name, user, srcip, location proftpd ^\S+ \(\S+[(\S+)]\) srcip ^pure-ftpd pure-ftpd ^\S+ [INFO] \S+ is now logged in ^\(?@(\S+)\) [INFO] (\S+) is now logged in srcip, user name, user, srcip, location pure-ftpd ^\((\S+)@(\S+)\) [ user,srcip ^\w\w\w \w\w\w\s+\d+ \S+ \d+ [pid \d+] Client "(\d+.\d+.\d+.\d+)"$ srcip ^ftpd|^in.ftpd ftpd from (\d+.\d+.\d+.\d+)$ srcip ^arpwatch arpwatch ^new station |^bogon ^(\d+.\d+.\d+.\d+) (\S+) srcip, extra_data name, srcip, extra_data ^imapd user=(\S+) \.+ [(\d+.\d+.\d+.\d+)]$ user,srcip ^vpopmail vpopmail ^vchkpw-pop3: password fail ^ (\S+)@\S+:(\d+.\d+.\d+.\d+)$ user, srcip vpopmail ^vchkpw-pop3: vpopmail user not ^found (\S+)@\S+:(\d+.\d+.\d+.\d+)$ user, srcip ^pop3d-ssl|^courierpop3login|^imaplogin courier ^LOGIN, ^user=(\S+), ip=[(\S+\d)]$ user, srcip courier , ip=[(\S+\d)]$ srcip ^named named ^client ^(\d+.\d+.\d+.\d+)# srcip named from [(\d+.\d+.\d+.\d+)] srcip ^postfix true postfix ^NOQUEUE: reject: RCPT from [(\d+.\d+.\d+.\d+)]: (\d+) srcip,id ^sendmail|^sm-mta|^sm-msp-queue sendmail-reject ^\S+: rejecting commands from ^ \S+ [(\d+.\d+.\d+.\d+)] srcip sendmail-reject relay=[ ^(\d+.\d+.\d+.\d+)] srcip sendmail-reject relay=\S+ [ ^(\d+.\d+.\d+.\d+)] srcip ^smf-sav sender check failed: \S+, ^(\d+.\d+.\d+.\d+), srcip ^MailScanner mailscanner ^Message \S+ from ^(\d+.\d+.\d+.\d+) \S+ to \S+ is (\w+) srcip, action ^kernel iptables firewall ^[\d+.\d+] \S+ IN= ^[\d+.\d+] (\S+) \.+ SRC=(\S+) DST=(\S+) \.+ PROTO=(\w+) action,srcip,dstip,protocol iptables firewall ^SPT=(\d+) DPT=(\d+) srcport,dstport iptables firewall ^\S+ IN= ^(\S+) \.+ SRC=(\S+) DST=(\S+) \.+ PROTO=(\w+) action,srcip,dstip,protocol iptables firewall ^SPT=(\d+) DPT=(\d+) srcport,dstport firewall ^ipmon (\w) (\d+.\d+.\d+.\d+),(\d+) -> (\d+.\d+.\d+.\d+),(\d+) PR (\w+) action,srcip,srcport,dstip,dstport,protocol firewall ^ipsec_logd R:(\w) \w:\S+ S:(\d+.\d+.\d+.\d+) D:(\d+.\d+.\d+.\d+) P:(\S+) SP:(\d+) DP:(\d+) action,srcip,dstip,protocol,srcport,dstport firewall ^pf$ PF_Decoder ^sav00|^ns5gt ^NetScreen device_id netscreenfw firewall system-notification-00257 \(traffic\): proto=(\w+) \.+action=(\w+) \.+src=(\S+) dst=(\S+) src_port=(\d+) dst_port=(\d+) protocol, action, srcip, dstip, srcport, dstport netscreenfw system-critical-\.+ from system-(\w+)-(\d+): \.+ from\.+(\d+.\d+.\d+.\d+) action, id, srcip netscreenfw ]system-(\w+)-(\d+): action, id ^%PIX-|^\w\w\w \d\d \d\d\d\d \d\d:\d\d:\d\d: %PIX-| ^%ASA-|^\w\w\w \d\d \d\d\d\d \d\d:\d\d:\d\d: %ASA-| ^%FWSM-|^\w\w\w \d\d \d\d\d\d \d\d:\d\d:\d\d: %FWSM- pix firewall ^2-106001 ^(\S+): \w+ (\w+) \S+ (\S+) from (\S+)/(\S+) to (\S+)/(\S+) id, protocol, action, srcip, srcport, dstip, dstport pix firewall ^3-710003|^7-710002|^7-710005 ^(\S+): (\S+) \w+ (\w+)\.+from (\S+)/(\S+) to \w+:(\S+)/(\S+) id, protocol, action, srcip, srcport, dstip, dstport pix firewall ^4-106023 ^(\S+): (\w+) (\w+) src \w+: (\S+)/(\S+) dst \w+:(\S+)/(\S+) id, action, protocol, srcip, srcport, dstip, dstport pix firewall ^4-106019 ^(\S+): IP packet from (\S+) to (\S+), protocol (\w+) (\w+) id, srcip, dstip, protocol, action pix firewall ^2-106006|^2-106007 ^(\S+): (\w+) \S+ (\w+) from (\d+.\d+.\d+.\d+)/(\d+) to (\d+.\d+.\d+.\d+)/(\d+) id, action, protocol, srcip, srcport, dstip, dstport pix firewall ^6-106015 ^(\S+): (\w+) (\w+) \S+ \S+ (\S+) from (\S+)/(\S+) to (\S+)/(\S+) id, action, protocol, srcip, srcport, dstip, dstport pix firewall ^6-305012 ^(\S+): (\w+) \w+ (\w+) translation from \w+:(\S+)/(\d+) to \w+:(\S+)/(\d+) id, action, protocol, srcip, srcport, dstip, dstport pix firewall ^3-106011|^3-106010 ^(\S+): (\w+) \.+ (\w+) src \w+:(\S+)/(\d+) dst \w+:(\S+)/(\d+) id, action, protocol, srcip, srcport, dstip, dstport pix ^2-106012: |^2-106017: | ^2-106020|^1-106021|^1-106022| ^4-4000 ^(\S+): \.+ from (\d+.\d+.\d+.\d+) id, srcip pix ^6-605004|^6-308001|^6-605005 ^(\S+): \.+ (\d+.\d+.\d+.\d+) id, srcip pix ^(\S+): id ^%\w+-\d-\w+: cisco-ios firewall ^%SEC-6-IPACCESSLOGP: ^list \d+ (\w+) (\w+) (\S+)\((\d+)\) -> (\S+)\((\d+)\), action, protocol, srcip, srcport, dstip, dstport cisco-ios ids ^%IPS-4-SIGNATURE: ^Sig:(\d+) \.+[(\S+):(\d+) -> (\S+):(\d+)] id, srcip, srcport, dstip, dstport name, id, srcip, dstip First time Cisco IOS IDS/IPS module rule fired. cisco-ios ^(%\w+-\d-\w+): id ^\d+ \d\d/\d\d/\d\d\d\d \S+ SEV=\d ^(\S+) RPT=\d+ (\d+.\d+.\d+.\d+) id, srcip ^snort ids ^[**] [\d+:\d+:\d+] snort ids ^[**] |^[\d+:\d+:\d+] ^[**] [(\d+:\d+:\d+)] \.+ (\d+.\d+.\d+.\d+)\p*\d* -> (\d+.\d+.\d+.\d+)|^[(\d+:\d+:\d+)] \.+ (\d+.\d+.\d+.\d+)\p*\d* -> (\d+.\d+.\d+.\d+) id,srcip,dstip name,id,srcip,dstip ids ^\d\d\d\d-\d\d-\d\d \d\d:\d\d:\d\d\| ^\S+\|(\S+)\| (\d+.\d+.\d+.\d+)\|(\d+.\d+.\d+.\d+)\| id, srcip, dstip name, id, srcip, dstip ^[\w+] [imp] |^[\w+] [horde] horde_imp ^Login success ^for (\S+) [(\d+.\d+.\d+.\d+)] user, srcip horde_imp ^FAILED LOGIN ^ (\d+.\d+.\d+.\d+) to \S+ as (\S+) srcip, user ^httpd ^[warn] |^[notice] |^[error] apache-errorlog ^[client ^ (\d+.\d+.\d+.\d+)] srcip web-log ^\d+.\d+.\d+.\d+ ^(\d+.\d+.\d+.\d+) \S+ \S+ [\S+ \S\d+] "\w+ (\S+) HTTP\S+ (\d+) srcip, url, id ^\d\d\d\d-\d\d-\d\d \d\d:\d\d:\d\d windows-date-format ^\d+.\d+.\d+.\d+ \d+ \d+ (\d+.\d+.\d+.\d+.) \d+ \d+ (\S+) srcip, user titanftp true ^(invalid) action windows-date-format firewall true ^OPEN|^CLOSE|^DROP ^(\w+) (\w+) (\S+) (\S+) (\d+) (\d+) action, protocol, srcip, dstip, srcport, dstport windows-date-format web-log true ^\d+.\d+.\d+.\d+ \S+ W3SVC ^(\d+.\d+.\d+.\d+) \S+ \S+ \S+ \S+ \d+ \S+ (\S+ \S+) (\d+) srcip,url,id windows-date-format web-log true ^W3SVC\d+ \S+ \S+ \S+ ^(\S+ \S+) \d+ \S+ (\d+.\d+.\d+.\d+) \S+ \S+ \S+ \S+ \S+ (\d+) url, srcip, id windows-date-format true ^\d+.\d+.\d+.\d+ \S+ MSFTPSVC ^(\d+.\d+.\d+.\d+) (\S+) \S+ \S+ \S+ \d+ [\d+](\S+) \S+ \S+ (\d+) srcip,user,action,id +hupylaw.hupy.local 500 0 32 23 0 SMTP - - - - --> windows-date-format true ^\d+.\d+.\d+.\d+ \S+ SMTPSVC ^(\d+.\d+.\d+.\d+) \S+ \S+ \S+ \S+ \d+ (\S+) \S+ \S+ (\d+) srcip, action, id ^\d\d\d\d-\d\d-\d\d \d\d:\d\d:\d\d: racoon true ^ERROR: couldn't find the pskey ^for (\d+.\d+.\d+.\d+) srcip racoon ^(\w+): action squid ^\d+ \d+.\d+.\d+.\d+ ^\d+ (\d+.\d+.\d+.\d+) (\w+)/(\d+) \d+ \w+ (\S+) srcip,action,id,url windows ^WinEvtLog: ^\w+: (\w+)\((\d+)\): (\.+): (\.+): \.+: (\S+): status, id, extra_data, user, system_name name, location, user, system_name windows ^security[\w+] \d+ ^(\w+)[(\w+)] (\d+) extra_data, status, id windows ^MSWinEventLog\t\d\t\.+\t\d+\t\w\w\w \w\w\w \d\d \d\d ^:\d\d:\d\d \d\d\d\d\t(\d+)\t(\.+) \t(\.+)\t\.+\t(\.+)\t(\.+)\t id, extra_data, user, status, system_name name, id, location, user, system_name ^\w\w\w\w\w\w\w\w\w\w\w\w, ^(\d+),\d+,\d+,(\S+),(\.+), id, system_name, extra_data name, location, id, system_name, extra_data ^\d\d\d\d\d\d\d\d,\d\d\d+, SymantecWS_Decoder ^ossec: ossec ossec ossec ^Agent started: ^ '(\S+)' extra_data name, location, extra_data ^[\d\d/\w\w\w/\d\d\d\d:\d\d:\d\d:\d\d \S+] host=(\S+), srcip