From f0ae4ba35a0ab319edd15ccbbe214bf0c1b6aec5 Mon Sep 17 00:00:00 2001
From: "Brian J. Murrell" <brian@interlinx.bc.ca>
Date: Fri, 7 Aug 2026 09:30:19 -0400
Subject: [PATCH] Add regex pattern for missing AORs in asterisk.conf

Add another regex to capture cracking attempts of an Asterisk server.
---
 config/filter.d/asterisk.conf | 1 +
 1 file changed, 1 insertion(+)

diff --git a/config/filter.d/asterisk.conf b/config/filter.d/asterisk.conf
index 631ccbbc..3acb4ae3 100644
--- a/config/filter.d/asterisk.conf
+++ b/config/filter.d/asterisk.conf
@@ -28,6 +28,7 @@ failregex = ^Registration from '[^']*' failed for '<HOST>(:\d+)?' - (?:Wrong pas
             ^SecurityEvent="(?:FailedACL|InvalidAccountID|ChallengeResponseFailed|InvalidPassword)"(?:(?:,(?!RemoteAddress=)\w+="[^"]*")*|.*?),RemoteAddress="IPV[46]/[^/"]+/<HOST>/\d+"(?:,(?!RemoteAddress=)\w+="[^"]*")*$
             ^"Rejecting unknown SIP connection from <HOST>(?::\d+)?"$
             ^Request (?:'[^']*' )?from '(?:[^']*|.*?)' failed for '<HOST>(?::\d+)?'\s\(callid: [^\)]*\) - (?:No matching endpoint found|Not match Endpoint(?: Contact)? ACL|(?:Failed|Error) to authenticate)\b[^']*$
+            ^Endpoint '.+' \(<HOST>:\d+\) has no configured AORs$
 
 # FreePBX (todo: make optional in v.0.10):
 #            ^(%(__prefix_line)s|\[\]\s*WARNING%(__pid_re)s:?(?:\[C-[\da-f]*\])? )[^:]+: Friendly Scanner from <HOST>$