[CARBONBLACK-APP-CONTROL] User Login denied (Warning)

alert any $HOME_NET any -> $HOME_NET any (msg:"[CARBONBLACK-APP-CONTROL] User Login denied (Warning)"; program:cb_protect
| cb_app_control
| 1
| bit9
| carbonblack; content:"type=
| 22
| Policy Enforcement
| 22
| "; content:"subtype=
| 22
| User Login denied
| 22
| "; nocase; parse_src_ip:1; reference:url,community.carbonblack.com/t5/Documentation-Downloads/CB-Protection-Events-Guide-v8-1-10/ta-p/91842; classtype:system-event; sid:5011121; rev:1; metadata:deployment Server,affected_product NONE,affected_version NONE,mitigation NONE,deprecation_reason NONE,tag NONE, created_at 2023_02_15, updated_at 2023_02_15, mitre_tactic_id NONE, mitre_technique_id NONE;)