<!--
  part of the tutorial "Asterisk and SIP: attack and monitoring via event correlation, by using SIPp and SEC"
  wrote by mikeOverIP
  available here: http://mikeoverip.wordpress.com/2009/01/13/asterisk-and-sip-attack-and-monitoring-via-event-correlation-by-using-sipp-and-sec/
-->

# matches each wrong SIP password registration, from/to the same host and for the same user, with counter
type=single
continue=TakeNext
ptype=RegExp
rem=Registration from '<sip:101@172.16.160.1>' failed for '172.16.160.128' - Wrong password
pattern=Registration from '<sip:(\S+)\@(\S+)>' failed for '(\S+)' - Wrong password
desc=Asterisk SIP - wrong password - $1@$2 for $3
action=eval %x ++$c{"c_$1_$2_$3"} ; write - Asterisk SIP - %t - wrong password, counter: %x - $1@$2 for $3

# matches N failed SIP registration followed by a successfull registration, from the same host and for the same user
type=Pair
ptype=RegExp
rem=Registration from '<sip:101@172.16.160.1>' failed for '172.16.160.128' - Wrong password
pattern=Registration from '<sip:(\S+)\@(\S+)>' failed for '(\S+)' - Wrong password
desc=Asterisk SIP - wrong password - $1@$2 for $3
action=none
ptype2=RegExp
rem=Registered SIP '101' at 172.16.160.128 port 1095 expires 60
pattern2=Registered SIP '$1' at $3 port (\S+) expires (\S+)
desc2=Asterisk SIP - registered after failures - %1 at %3 port $1 expires $2
action2=eval %y $c{"c_%1_%2_%3"} ; write - Asterisk SIP - %t - registered after %y failures - %1 at %3 port $1 expires $2