Sagan high stable other

[CISCO-MERAKI] 802.1x EAP(RADIUS) failed authentication attempt [10/5]

[CISCO-MERAKI] 802.1x EAP(RADIUS) failed authentication attempt [10/5]

View Source

Detection Logic

alert any $EXTERNAL_NET any -> $HOME_NET any (msg:"[CISCO-MERAKI] 802.1x EAP(RADIUS) failed authentication attempt [10/5]"; content:"type=8021x_eap_failure"; after:track by_username, count 10, seconds 300; threshold: type suppress, track by_string, count 1, seconds 86400; normalize; classtype: attempted-user; sid:5003048; metadata: updated_on 2023_08_02; rev:3;)

Field Validations

Loading…

Comments (0)

Loading comments...