A collection to parse Zimbra's logs and detect brut force on the following services

• web authentication form
• SMTP
• IMAP

Example acquisition for this collection :

1filenames:
2  - /opt/zimbra/log/mailbox.log
3labels:
4  type: zimbra

notes :

• If you are using syslog, set type to syslog instead
• Depending on your distribution/OS, paths to log files might change
• Only relevant if you are manually installing collection