# The following are some sample triggers for various applications.
#
# Ssh:  this trigger will trigger in two different scenarios.  The first is
#       for a non-existent user, and the second for a failed password.  This
#       does have the side effect of counting two events for one failed
#       attempt to connect with an invalid user & password.
Triggers:       "sshd\\[\\d+\\]: failed (?:password|none)"

# OpenWebmail:  these triggers will capture both failed passwords and
#               invalid users.
Triggers:       "error - bad login ", "userinfo error - "

# Cyrus IMAP/POP: this trigger catches authentication failures.
Triggers:       "authentication failure"

# Sendmail: this trigger catches hosts violating the connection rate limit.
Triggers:       "connection rate limit exceeded"

