Sagan high stable other

[ONELOGIN] USER_FAILED_ONELOGIN_LOGIN - Brute force [5/5]

[ONELOGIN] USER_FAILED_ONELOGIN_LOGIN - Brute force [5/5]

View Source

Detection Logic

alert any $HOME_NET any -> $EXTERNAL_NET any (msg: "[ONELOGIN] USER_FAILED_ONELOGIN_LOGIN - Brute force [5/5]"; json_content: ".event_type_id", "6"; json_map: "src_ip", ".ipaddr"; json_map: "username", ".user_name"; flexbits: set, brute_force, 21600; after: track by_src&by_username, count 5, seconds 300; threshold: type limit, track by_src&by_username, count 1, seconds 21600; classtype: brute-force; program: onelogin; sid:5006113; rev:5;)

Field Validations

Loading…

Comments (0)

Loading comments...