Sagan high stable other

[CISCO-PIXASA] Login denied [Brute Force] [10/1]

[CISCO-PIXASA] Login denied [Brute Force] [10/1]

View Source

Detection Logic

alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-PIXASA] Login denied [Brute Force] [10/1]"; append_program; meta_content: ""%sagan%", %ASA,%PIX,%FWSM; pcre: "/%ASA[-]+6-605004
| %PIX[-]+6-605004
| %FWSM[-]+6-605004/"; parse_src_ip: 1; parse_port; after: track by_src, count 10, seconds 300; threshold: type suppress, track by_src, count 1, seconds 86400/"; classtype: brute-force; xbits: set,brute_force,track ip_src,expire 21600; sid: 5000842; rev: 13;)

Field Validations

Loading…

Comments (0)

Loading comments...