From decoder.xml true windows-date-format ^\d+.\d+.\d+.\d+ \d+ \d+ ^ (\d+.\d+.\d+.\d+) \d+ \d+ \S+ \d+ \S+ \S+ srcip From titanftp_rules.xml titanftp TitanFTP Message. 11600 invalid password specified TitanFTP Wrong Password. authentication_failed, 11600 account disabled TitanFTP Account Disabled. authentication_failed, 11600 not found TitanFTP Account Disabled. authentication_failed, 11600 incoming user TitanFTP Connection Initiated. connection_attempt, 11604 11603 11602 Multiple failed TitanFTP login attempts. authentication_failed, 11605 Multiple connection attempts from same source. recon, I wrote a script to hardlink to the TitanFTP logs, because TitanFTP uses a time stamp in the name of the file.