ossec/ossec-hids — pull request #450 by ChristianBeer (2014-11-23 10:57:04+00:00)
Title: fix to sshd rules

I don't know where the [preauth] comes from but I don't see it in my log messages and at least for the corrupted MAC messages I had to remove it so rule 1002 does not kick in.