[DUO] Authentication - Brute Force [4/5]

alert any $HOME_NET any -> $EXTERNAL_NET any (msg: "[DUO] Authentication - Brute Force [4/5]"; content: "event_type
| 22 3A 20 22
| authentication"; content: "result
| 22 3A 20 22
| denied"; json_content: !".reason", "user_cancelled"; json_map: "username",".user.name"; parse_src_ip:1; after:track by_src&by_username, count 4, seconds 300; threshold: type suppress, track by_src&by_username, count 1, seconds 86400; classtype: attempted-user; program: duo; sid:5006528; rev:5;)