From 43998632aa0fc1f191b3871d981e4175ee62fa14 Mon Sep 17 00:00:00 2001
From: Boris Manojlovic <boris@steki.net>
Date: Mon, 8 Apr 2019 23:28:14 +0200
Subject: [PATCH] add dovecot as postfix auth backend parsing

---
 data/dovecot.json | 12 ++++++++++++
 1 file changed, 12 insertions(+)
 create mode 100644 data/dovecot.json

diff --git a/data/dovecot.json b/data/dovecot.json
new file mode 100644
index 0000000..25b0633
--- /dev/null
+++ b/data/dovecot.json
@@ -0,0 +1,12 @@
+[
+  {
+    "filter": "SYSLOG_IDENTIFIER=auth",
+    "items": [
+      {
+        "ban": 50,
+        "score": 0.6,
+        "pattern": "MESSAGE=pam_unix[(]dovecot:auth[)]: authentication failure; logname= uid=0 euid=0 tty=dovecot ruser=.*@.* rhost=([0-9a-z:.]+)"
+      }
+    ]
+  }
+]