[AZURE-EVENTHUB] Microsoft SQL Authentication Failure - Possible Brute Force [10/1]

alert any $HOME_NET any -> $HOME_NET any (msg:"[AZURE-EVENTHUB] Microsoft SQL Authentication Failure - Possible Brute Force [10/1]"; program:azureEventHub; json_content:".category","SQLSecurityAuditEvents"; json_content:".properties.action_name","DATABASE AUTHENTICATION FAILED"; json_map:"src_ip",".properties.client_ip"; after:track by_src,count 10,seconds 300; threshold:type suppress,track by_src, count 1, seconds 86400; xbits:set,brute-force,track ip_src,expire 28800; classtype:attempted-user; sid:5014090; rev:1; metadata:deployment Endpoint,affected_product NONE,affected_version NONE,mitigation NONE,deprecation_reason NONE,tag NONE, created_at 2023_01_20, updated_at 2023_01_20, mitre_tactic_id TA0006, mitre_technique_id T1110;)