[CROWDSTRIKE] Possible Initial Access - User accessed IP associated with malicious activity

alert any any any -> any any (msg:"[CROWDSTRIKE] Possible Initial Access - User accessed IP associated with malicious activity"; program:CrowdStrike; content:"A user accessed an IP associated with malicious activity"; content:"tactic=Initial Access"; parse_src_ip:1; threshold: type suppress, track by_src, count 1, seconds 86400; normalize; classtype:suspicious-traffic; sid:5017620; rev:2;)