# HyBBX SSH transport login brute-force (security.log).
# Enable when [transport.ssh] is running and logs login_fail
# with transport=ssh to security.log.

[INCLUDES]
before = common.conf

[Definition]
_daemon = hybbx
failregex = ^\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2} login_fail ip=<HOST> user=.* transport=ssh
ignoreregex =