Sagan high stable other

[KEY9] Unauthorized Access Attempted

[KEY9] Unauthorized Access Attempted

View Source

Detection Logic

alert any $HOME_NET any -> $HOME_NET any (msg:"[KEY9] Unauthorized Access Attempted"; program:k9; json_content:".event_type","access"; json_content:".description","Unauthorized Access Attempt."; json_map: "src_ip", ".ip_address"; normalize; after: track by_src, count 2, seconds 60; classtype:attempted-user; sid:5015945; rev:2; metadata:created_at 2025_05_05, updated_at 2025_11_18;)

Field Validations

Loading…

Comments (0)

Loading comments...