mikrotik-mikr MikroTik $(hostname): $(mikrotik.message) 100200 ^in$ ^(?:api|rest-api)$ MikroTik $(hostname): $(dstuser) signed in via $(mikrotik.via) from $(srcip) authentication_success, 100200 login failure for user MikroTik $(hostname): failed sign-in for $(dstuser) via $(mikrotik.via) from $(srcip) T1110 authentication_failed, 100202 MikroTik $(hostname): repeated failed sign-ins from $(srcip), possible password guessing T1110 authentication_failures, 100200 \S MikroTik $(hostname): $(mikrotik.object) $(mikrotik.change) by $(dstuser) via $(mikrotik.via) config_changed, 100200 ^down$ MikroTik $(hostname): $(mikrotik.interface) link down 100200 ^up$ MikroTik $(hostname): $(mikrotik.interface) link up 100200 possible SYN flooding MikroTik $(hostname): possible SYN flood attack, 100200 (?:^|,)critical(?:,|$) login failure for user MikroTik $(hostname) critical: $(mikrotik.message) 100200 ^ssld, MikroTik $(hostname): failed TLS handshake: $(mikrotik.message) 100200 ^(?!ssld,)(?!.*(?:^|,)critical(?:,|$)).*(?:^|,)error(?:,|$) MikroTik $(hostname) error: $(mikrotik.message) 100200 (?:^|,)warning(?:,|$) possible SYN flooding MikroTik $(hostname) warning: $(mikrotik.message)