diff --git a/configs/local_decoder.xml b/configs/local_decoder.xml
new file mode 100644
index 0000000..9b60626
--- /dev/null
+++ b/configs/local_decoder.xml
@@ -0,0 +1,194 @@
+
+
+
+
+
+
+
+
+
+ filterlog
+
+
+
+
+ pfsense-wrapped
+ filterlog\S* \S*,\S*,\S*,(\S*),\S*,\S*,(\S*),
+ id,action
+
+
+
+
+ pfsense-wrapped
+ \S*,\S*,\S*,\S*,\S*,\S*,\S*,\S*,\S*,(\S*),\S*,(\S*),(\S*),
+ protocol,srcip,dstip
+
+
+
+
+ pfsense-wrapped
+ (\d*),(\d*),\S*
+ srcport,dstport
+
+
+
+
+ pfsense-wrapped
+ datalength=(\S*)|(\d*)
+ length
+
+
+
+
+
+ postfix\(\d+\): \w+ \d+ \d+:\d+:\d+ \w+ \.+\(\d+\):
+
+
+
+ mailcow-journald-unwrap
+ \.+
+ extra_data
+
+
+
+
+
+ gitea
+
+
+
+
+ gitea
+ Failed authentication attempt
+ Failed authentication attempt for (\S+) from (\d+.\d+.\d+.\d+)
+ user, srcip
+
+
+
+
+
+ dovecot
+ rip=(\S+),
+ srcip
+
+
+
+
+
+ postfix
+ postfix/\S+smtpd\S*: warning: \S+: SASL
+ unknown\[((\d+\.\d+\.\d+)\.\d+)\]: SASL \S+ authentication failed.*sasl_username=(\S+)
+ srcip, src_subnet, dstuser
+
diff --git a/configs/local_rules.xml b/configs/local_rules.xml
new file mode 100644
index 0000000..bfee7e7
--- /dev/null
+++ b/configs/local_rules.xml
@@ -0,0 +1,421 @@
+
+
+
+
+
+
+
+
+
+
+
+
+ 5716
+ 1.1.1.1
+ sshd: authentication failed from IP 1.1.1.1.
+ authentication_failed,pci_dss_10.2.4,pci_dss_10.2.5,
+
+
+
+
+
+
+
+
+
+
+ pfsense-wrapped
+ pfSense wrapped syslog parent rule.
+
+
+
+
+ 87699
+ block
+ pfSense firewall drop event (wrapped).
+ pfsense,firewall_block,pci_dss_1.4,gpg13_4.12,hipaa_164.312.a.1,nist_800_53_SC.7,tsc_CC6.7,tsc_CC6.8,
+
+
+
+
+ 87761
+
+ Multiple pfSense firewall block events from same source (wrapped).
+
+ T1110
+
+ pfsense,
+
+
+
+
+
+
+
+
+
+
+ web|attack|attacks
+ etc/lists/blacklist-alienvault
+ IP address found in AlienVault reputation database.
+
+
+
+
+
+
+
+
+
+
+ 9705
+ watchdog@invalid
+ Dovecot: mailcow watchdog health check (ignored)
+
+
+
+
+ 9707
+ rip=172.22.1.
+ Dovecot: mailcow watchdog IMAP probe disconnect (ignored)
+
+
+
+
+ 9706
+ imap(chris@wittenberger.us)
+ Dovecot: own-mailbox routine session disconnect (ignored)
+
+
+
+
+ 9706
+ managesieve-login: Disconnected: Connection closed (no auth attempts
+ Mailcow watchdog managesieve healthcheck - suppressed
+
+
+
+
+ 9700
+ no auth attempts
+ Dovecot: connection with no auth attempt from $(srcip)
+ dovecot,recon,
+
+
+
+
+ 100205
+
+ Dovecot: aggressive port scanning from $(srcip) - possible attack precursor
+ dovecot,recon,attack,
+
+
+
+
+
+
+
+
+
+
+ 9701
+ Dovecot successful login - suppressed (routine IMAP polling)
+
+
+
+
+
+
+
+
+
+
+ gitea
+ Gitea event (parent)
+
+
+
+
+ 100400
+ router: polling
+ Gitea: router polling - suppressed
+
+
+
+ 100400
+ router: completed
+ Gitea: router completed request - suppressed
+
+
+
+
+ 100400
+ Failed authentication attempt
+ Gitea: failed authentication attempt
+ authentication_failed,
+
+ T1110
+
+
+
+
+
+ 100410
+ Gitea: possible brute force (5+ failed logins in 2 min)
+ authentication_failures,
+
+ T1110
+
+
+
+
+
+ 100400
+ new user signed up|created user
+ Gitea: new user account created
+
+
+
+ 100400
+ deleted user|DeleteUser
+ Gitea: user account deleted
+
+
+
+
+ 100400
+ add public key|added SSH key|AddPublicKey
+ Gitea: SSH key added to account
+
+
+
+ 100400
+ delete public key|deleted SSH key|DeletePublicKey
+ Gitea: SSH key removed from account
+
+
+
+
+ 100400
+ access token|AccessToken
+ Gitea: access token activity
+
+
+
+
+ 100400
+ ResetPasswd|recover_account
+ Gitea: password reset / account recovery
+
+
+
+
+ 100400
+ repository deleted|DeleteRepository
+ Gitea: repository deleted
+
+
+
+
+ 100400
+ TwoFactor|two-factor|TOTP
+ Gitea: 2FA event
+
+
+
+
+
+
+
+
+
+
+ 3332
+
+ Postfix SASL: brute force login attempt from $(srcip)
+ authentication_failed,brute_force,
+
+
+
+
+ 100310
+ 100204
+
+ Mail: successful login after brute force from $(srcip) - ACCOUNT COMPROMISED
+ authentication_success,brute_force_success,attack,
+
+
+
+
+ 3332
+
+
+ Postfix SASL: distributed brute force targeting user $(dstuser)
+ authentication_failed,brute_force,distributed,
+
+
+
+
+ 100310
+
+ Postfix SASL: persistent brute force from $(srcip) - 3+ bursts in 24h
+ authentication_failed,brute_force,persistent,
+
+
+
+
+ 3332
+ src_subnet
+ Postfix SASL: coordinated brute force from subnet $(src_subnet).0/24
+ authentication_failed,brute_force,subnet_scan,
+
+
+
+
+ 3332
+
+
+ Postfix SASL: credential stuffing against user $(dstuser) from multiple IPs
+ authentication_failed,brute_force,distributed,credential_stuffing,
+
+
+
+
+ 3332
+ Postfix SASL: high volume of authentication failures (50+ in 1h)
+ authentication_failed,brute_force,volume,
+
+
+