Update decoder for new syntax of the 1.4 log of Roundcube.

wazuh · Dec 18, 2019 · 66eb355 · 66eb355
1 parent 62d04aa
commit 66eb355
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/decoders/0255-roundcube_decoders.xml b/decoders/0255-roundcube_decoders.xml
@@ -51,6 +51,6 @@
 <decoder name="roundcube-denied-new">
   <parent>roundcube</parent>
   <prematch>> \w+ Error: Login failed |> Failed login </prematch>
-  <regex offset="after_prematch">^for (\S+) from (\S+)\. |^for (\S+) from (\S+) in session </regex>
+  <regex offset="after_prematch">^for (\S+) from (\S+)\. |^for (\S+) from (\S+) in session |^for (\S+) against \S+ from (\S+)\. |^for (\S+) against \S+ from (\S+) in session </regex>
   <order>user, srcip</order>
 </decoder>