[ARTILLERY] SSH brute force violation

alert any $EXTERNAL_NET any -> $HOME_NET any (msg:"[ARTILLERY] SSH brute force violation"; content: "SSH brute forcing violations"; xbits: set, honeypot ,track ip_src, expire 86400; xbits: set, brute_force ,track ip_src, expire 86400; default_proto: tcp; default_dst_port: $SSH_PORT; classtype: brute-force; parse_src_ip: 1; program: Artillery; reference: url,www.trustedsec.com/downloads/artillery; sid:5002089; rev:5;)