تشخیص تلاش‌های نفوذ در لاگ‌های MikroTik

/system logging action
add name=remote-syslog target=remote remote=192.168.88.200 remote-port=514 bsd-syslog=yes syslog-facility=local0

/system logging
add topics=info action=remote-syslog
add topics=warning action=remote-syslog
add topics=error action=remote-syslog
add topics=critical action=remote-syslog

/ip firewall filter
add chain=input action=drop log=yes log-prefix="INPUT-DROP:"
add chain=input src-address-list=ssh_blacklist protocol=tcp dst-port=22 action=drop log=yes log-prefix="SSH-BLACKLIST:"

/log print where message~"login failure"

/log print where message~"INPUT-DROP"

/log print where topics~"system"

/system script
add name=sec-audit source={
    :local userCount [/user print count-only]
    :local scriptCount [/system script print count-only]
    :local schedCount [/system scheduler print count-only]
    /log info message="SEC-AUDIT: users=$userCount scripts=$scriptCount schedulers=$schedCount"
}

/system scheduler add name=sec-audit interval=15m on-event=sec-audit

/system logging action
add name=email-critical target=email email=admin@example.com

/system logging
add topics=critical action=email-critical
add topics=error action=email-critical