Sagan low stable other

[AS400] AUTFAIL - Not authorized to object

[AS400] AUTFAIL - Not authorized to object

View Source

Detection Logic

alert any $EXTERNAL_NET any -> $HOME_NET any (msg:"[AS400] AUTFAIL - Not authorized to object"; content: " MAF0100 "; default_proto: tcp; classtype: unsuccessful-user; normalize; after: track by_username, count 3, seconds 900; threshold: type suppress, track by_username, count 2, seconds 900; sid:5003774; rev:1;)

Field Validations

Loading…

Comments (0)

Loading comments...