Repeated Failed Logins Template

argv[1]

Template code

Integer

8

Unique code assigned to template

Version

argv[3]

Integer

2 for users listed in the priv_user_list property;

3 for all other users.

argv[4]

UTC Time

Integer

<secs>

UTC time in number of seconds since the epoch when <max_failed_login> number of failed logins were detected for a particular target login account

argv[5]

Attacker

String

<fully qualified host name> <IP Address>

Name or IP address of the host from which the user logged in or out.

argv[6]

Target

<username>

Name of the user who logged in or out.

argv[7]

Summary

String

Failed login attempts

Alert summary

argv[8]

Details

String

More than <max_failed_login> failed logins by user <username> (REMOTE: <fully qualified host name> <IP address>)

Detailed alert description

argv[9]

Event

String

Failed login

The event that triggered the alert.

argv[10]

Flag

Integer

1

Indicates a failed login alert versus a failed su alert

argv[11]

User

String

<username>

Target login name that a user was attempting to log in as

argv[12]

Device

String

<pty device name>

Name of pty device associated with failed login attempt

argv[13]

Hostname

String

<remote hostname>

Name of remote host from which login was attempted

argv[14]

IP Address

String

<A.B.C.D> for IPv4 addresses A:B:C:D:... for IPv6 addresses

	NOTE: Although HIDS is not supported on IPv6–only enabled systems, the failed login templates can recognize and display the following types of addresses in the alerts: IPv4 address IPv4 address-mapped-IPv6 address IPv6 address

IP address of remote host from which login was attempted