Someone

<!-- TitanFTP W3C Log Format - All Fields Populated version 5.99 - 6.
date time s-ip s-port -xssocket c-ip c-port x-csocket cs-username cs-bytes sc-bytes cs-uri-stem sc-status Message
2007-09-26 15:13:50 209.189.x.x 22 0 192.168.10.220 0 912  0 0 - 0 Using "password" authentication for incoming user "root"
2007-09-26 16:15:32 209.189.x.x 22 0 192.168.10.220 0 1004 root 0 0 - 38 User "root" account disabled; returning 530
2007-09-26 07:45:41 209.189.x.x 22 0 192.168.10.24 0 1380  0 0 - 0 Using "password" authentication for incoming user "vdata"

  -->

From decoder.xml

<decoder name="titanftp">
  <use_own_name>true</use_own_name>
  <parent>windows-date-format</parent>
  <prematch offset="after_parent">^\d+.\d+.\d+.\d+ \d+ \d+</prematch>
  <regex offset="after_prematch">^ (\d+.\d+.\d+.\d+) \d+ \d+ \S+ \d+ \S+ \S+</regex>
  <order>srcip</order>
</decoder>

From titanftp_rules.xml

<!-- @(#) $Id: titanftp_rules.xml,v 1.4 2007/01/07 23:52:10 dcid Exp $
  -  TitanFTP rules for OSSEC HIDS.
  -  Author: Shohn Trojacek
  -  License: http://www.ossec.net/en/licensing.html
  -->


<!-- BETA -->

<group name="syslog,titanftp,">

  <rule id="11600" level="1">
    <decoded_as>titanftp</decoded_as>
    <description>TitanFTP Message.</description>
  </rule>

  <rule id="11602" level="3">
    <if_matched_sid>11600</if_matched_sid>
    <match>invalid password specified</match>
    <description>TitanFTP Wrong Password.</description>
    <group>authentication_failed,</group>
  </rule>

  <rule id="11603" level="3">
    <if_matched_sid>11600</if_matched_sid>
    <match>account disabled</match>
    <description>TitanFTP Account Disabled.</description>
    <group>authentication_failed,</group>
  </rule>

  <rule id="11604" level="3">
    <if_matched_sid>11600</if_matched_sid>
    <match>not found</match>
    <description>TitanFTP Account Disabled.</description>
    <group>authentication_failed,</group>
  </rule>

  <rule id="11605" level="3">
    <if_matched_sid>11600</if_matched_sid>
    <match>incoming user</match>
    <description>TitanFTP Connection Initiated.</description>
    <group>connection_attempt,</group>
  </rule>

  <rule id="11651" level="9" frequency="3" timeframe="360">
    <if_matched_sid>11604</if_matched_sid>
    <if_matched_sid>11603</if_matched_sid>
    <if_matched_sid>11602</if_matched_sid>
    <same_source_ip />
    <description>Multiple failed TitanFTP login attempts.</description>
    <group>authentication_failed,</group>
  </rule>


  <rule id="11611" level="10" frequency="8" timeframe="30">
    <if_matched_sid>11605</if_matched_sid>
    <same_source_ip />
    <description>Multiple connection attempts from same source.</description>
    <group>recon,</group>
  </rule>

</group> <!-- SYSLOG,TITANFTP -->




I wrote a script to hardlink to the TitanFTP logs, because TitanFTP uses a time stamp in the name of the file.