Sagan high stable other

[KEY9] Restricted Access Attempted

[KEY9] Restricted Access Attempted

View Source

Detection Logic

alert any $HOME_NET any -> $HOME_NET any (msg:"[KEY9] Restricted Access Attempted"; program:k9; json_content:".event_type","restricted_access_attempt"; json_content:".description","User attempted to access admin."; json_map: "src_ip", ".ip_address"; normalize; classtype:attempted-admin; sid:5015946; rev:1; metadata:created_at 2025_05_05,  updated_at 2025_06_17;)

Field Validations

Loading…

Comments (0)

Loading comments...