<!--
  part of the tutorial "Asterisk and SIP: attack and monitoring via event correlation, by using SIPp and SEC"
  wrote by mikeOverIP
  available here: http://mikeoverip.wordpress.com/2009/01/13/asterisk-and-sip-attack-and-monitoring-via-event-correlation-by-using-sipp-and-sec/
-->

# matches each wrong SIP username registration, from the same host and to the same host, with counter
type=Single
continue=TakeNext
ptype=RegExp
rem=Registration from '<sip:201@172.16.160.1>' failed for '172.16.160.128' - No matching peer found
pattern=Registration from '<sip:(\S+)\@(\S+)>' failed for '(\S+)' - No matching peer found
desc=Asterisk SIP - no matching peer found - $1@$2 for $3
action=eval %x ++$c{"c_$2_$3"} ; write - Asterisk SIP - %t - No matching peer found, counter: %x - $1@$2 for $3

# matches 2 wrong SIP username registrations in less than 1 minute, from the same host and to the same host
type=SingleWithThreshold
ptype=RegExp
rem=Registration from '<sip:201@172.16.160.1>' failed for '172.16.160.128' - No matching peer found
pattern=Registration from '<sip:\S+\@(\S+)>' failed for '(\S+)' - No matching peer found
desc=Asterisk SIP - 2 wrong peers in less than 1 minute - $1@$2 for $3
action=write - Asterisk SIP - %t - 2 wrong peers in less than 1 minute - $1@$2 for $3
window=59
thresh=2