Currently, I have prelude lml-installed and working properly for VPN authentication, however authentications refused to rule does not match and does not appear in prewikka.

I have installed the default configuration file that has the rule-cisco vpn.rules and pcre.rules

#LOG:Oct 29 19:18:20 vpn 1793 10/29/2003 19:18:20.190 SEV=3 AUTH/5 RPT=6 12.34.56.78  Authentication rejected: Reason = Invalid password handle = 66, server = Internal, user = gene.gomez, domain = <not specified>
regex=([\d\.]+)  Authentication rejected: Reason = (.+) handle = \d+, server = (\w+), user = (\S+), domain = (.+); \
 classification.text=VPN user authentication; \
 classification.reference(0).origin=vendor-specific; \
 classification.reference(0).meaning=vpn_id; \
 classification.reference(0).name=AUTH/5; \
 classification.reference(1).origin=vendor-specific; \
 classification.reference(1).meaning=vpn_severity; \
 classification.reference(1).name=3; \
 id=301; \
 revision=3; \
 analyzer(0).name=VPN Concentrator; \
 analyzer(0).manufacturer=Cisco; \
 analyzer(0).class=VPN; \
 assessment.impact.severity=medium; \
 assessment.impact.type=user; \
 assessment.impact.completion=failed; \
 assessment.impact.description=VPN user $4 failed authentication because of $2; \
 source(0).node.address(0).category=ipv4-addr; \
 source(0).node.address(0).address=$1; \
 target(0).user.category=application; \
 target(0).user.user_id(0).type=target-user; \
 target(0).user.user_id(0).name=$4; \
 additional_data(0).type=string; \
 additional_data(0).meaning=Failure reason; \
 additional_data(0).data=$2; \
 additional_data(1).type=string; \
 additional_data(1).meaning=Authentication server; \
 additional_data(1).data=$3; \
 additional_data(2).type=string; \
 additional_data(2).meaning=Authentication domain; \
 additional_data(2).data=$5; \
 last

Archivo pcre.rules

regex=SEV=;                include = cisco-vpn.rules;