# Fail2Ban filter for Asterisk Security log
# Catches all security events from /var/log/asterisk/security

[INCLUDES]
before = common.conf

[Definition]
_daemon = asterisk

failregex = ^.*SecurityEvent="FailedACL".*RemoteAddress="IPV[46]/(udp|tcp)/<HOST>/\d+".*$
            ^.*SecurityEvent="InvalidAccountID".*RemoteAddress="IPV[46]/(udp|tcp)/<HOST>/\d+".*$
            ^.*SecurityEvent="ChallengeResponseFailed".*RemoteAddress="IPV[46]/(udp|tcp)/<HOST>/\d+".*$
            ^.*SecurityEvent="InvalidPassword".*RemoteAddress="IPV[46]/(udp|tcp)/<HOST>/\d+".*$
            ^.*SecurityEvent="UnexpectedAddress".*RemoteAddress="IPV[46]/(udp|tcp)/<HOST>/\d+".*$
            ^.*SecurityEvent="RequestBadFormat".*RemoteAddress="IPV[46]/(udp|tcp)/<HOST>/\d+".*$

ignoreregex =