mirror of
https://github.com/zeek/zeek.git
synced 2025-10-02 22:58:20 +00:00
dcbd0819a6
- Some scripts used wrong SSH module/namespace scoping on events. - Fix outdated notice documentation related to SSH password guessing. - Add a unit test for SSH pasword guessing notice.
10 lines
236 B
Text
10 lines
236 B
Text
|
|
@load protocols/ssh/detect-bruteforcing
|
|
|
|
redef SSH::password_guesses_limit=10;
|
|
|
|
hook Notice::policy(n: Notice::Info)
|
|
{
|
|
if ( n$note == SSH::Password_Guessing && /192\.168\.56\.103/ in n$sub )
|
|
add n$actions[Notice::ACTION_EMAIL];
|
|
}
|