<!--
  part of the tutorial "Asterisk and SIP: attack and monitoring via event correlation, by using SIPp and SEC"
  wrote by mikeOverIP
  available here: http://mikeoverip.wordpress.com/2009/01/13/asterisk-and-sip-attack-and-monitoring-via-event-correlation-by-using-sipp-and-sec/
-->

# matches each wrong SIP password registration, from/to the same host and for the same user, with counter
type=single
continue=TakeNext
ptype=RegExp
rem=Registration from '<sip:101@172.16.160.1>' failed for '172.16.160.128' - Wrong password
pattern=Registration from '<sip:(\S+)\@(\S+)>' failed for '(\S+)' - Wrong password
desc=Asterisk SIP - wrong password - $1@$2 for $3
action=eval %x ++$c{"c_$1_$2_$3"} ; write - Asterisk SIP - %t - wrong password, counter: %x - $1@$2 for $3

# matches 2 wrong SIP password registrations in less than 1 minute, from/to the same host and for the same user
type=SingleWithThreshold
ptype=RegExp
rem=Registration from '<sip:101@172.16.160.1>' failed for '172.16.160.128' - Wrong password
pattern=Registration from '<sip:(\S+)\@(\S+)>' failed for '(\S+)' - Wrong password
desc=Asterisk SIP - 2 wrong passwords in less than 1 minute - $1@$2 for $3
action=write - Asterisk SIP - %t - 2 wrong passwords in less than 1 minute - $1@$2 for $3
window=59
thresh=2