[GCP] Login Failure - Brute Force [5/1]

alert any $HOME_NET any -> $EXTERNAL_NET any (msg: "[GCP] Login Failure - Brute Force [5/1]"; content: "cloudaudit.googleapis.com"; content: "google.login.LoginService.loginFailure"; parse_src_ip: 1; json_map:"username", ".protoPayload.authenticationInf"; xbits: set,brute_force,track ip_src, expire 21600; after: track by_src&by_username, count 5, seconds 60; threshold: type suppress, track by_src&by_username, count 1, seconds 21600; classtype: brute-force; sid: 5005995; rev:3;)