[DELL EMC UNITY] BRUTE FORCE ATTEMPT [1]

alert any $EXTERNAL_NET any -> any $HOME_NET (msg:"[DELL EMC UNITY] BRUTE FORCE ATTEMPT [1]"; content: "failed: Principal User"; xbits: set,brute_force,track ip_src, expire 21600; default_proto: tcp; default_dst_port: any; classtype: brute-force; program: sshd; normalize; parse_src_ip: 1; parse_port; after: track by_src, count 10, seconds 300; threshold: type suppress, track by_src, count 1, seconds 300; reference: url,XXXXXXXXX; sid: 5006588; rev:1;)