# SPDX-License-Identifier: AGPL-3.0-only
#
# What a report about this says, if reporting is turned on at all.
#
# `include` is the redaction, and it is a list of what MAY leave rather
# than a filter of what must not. A field this does not name cannot
# appear in a report, whatever a log line happens to contain — which
# matters here because the parsers capture the account names that were
# tried, and those are none of a public database's business. Somebody
# typed their own username into the wrong host once; that is not a
# thing to publish under your name.
#
# The offender's address is always sent. It is what a report *is*.
report: ssh-brute-force
categories: [brute-force, ssh]
says: "Unauthorised SSH login attempts"

# Nothing else leaves. The sentence, the count and the window are
# enough for anyone reading the report to know what happened — and the
# provider's own guidance asks for exactly that rather than a log dump.
include: []
