# SPDX-License-Identifier: AGPL-3.0-only
# A username that does not exist here:
#   Invalid user sftp_user from 203.0.113.9 port 38368
#
# On a key-only host this is most of what an attack looks like: the
# password never gets as far as being refused.
parser: ssh-invalid-user
log: ssh
prefilter: "Invalid user"
regex: '^(?P<time>\S+(?: +\d+ \d\d:\d\d:\d\d)?) \S+ sshd(?:-session)?\[\d+\]: Invalid user (?P<user>.*) from (?P<ip>\S+) port \d+$'
time_field: time
time_format: rfc3339
