diff --git a/config/filter.d/uwimap-auth.conf b/config/filter.d/uwimap-auth.conf
index 30f2b7bc..c6a062dc 100644
--- a/config/filter.d/uwimap-auth.conf
+++ b/config/filter.d/uwimap-auth.conf
@@ -10,6 +10,6 @@ before = common.conf
 
 _daemon = (?:ipop3d|imapd)
 
-failregex = ^%(__prefix_line)sLogin (?:failed|excessive login failures) user=\S* auth=\S* host=.*\[<HOST>\]\s*$ 
+failregex = ^%(__prefix_line)sLogin (?:failed|excessive login failures|SYSTEM BREAK-IN ATTEMPT) user=\S* auth=\S* host=.*\[<HOST>\]\s*$ 
 
 ignoreregex =