[OKTA] BRUTE FORCE ATTEMPT [2]

alert any $EXTERNAL_NET any -> any $HOME_NET (msg:"[OKTA] BRUTE FORCE ATTEMPT [2]"; content:"FAILURE"; content: "User login to Okta"; xbits: set,brute_force,track ip_src, expire 21600; default_proto: tcp; default_dst_port: $SSH_PORT; classtype: brute-force; program: sshd; normalize; parse_src_ip: 1; parse_port; after: track by_src, count 10, seconds 300; threshold: type suppress, track by_src, count 1, seconds 300; reference:url, developer.okta.com/docs/reference/api/event-types/; sid: 5006605; rev:1;)