[ORACLE] Brute force authentication failure [5/1]

alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[ORACLE] Brute force authentication failure [5/1]"; content: "RETURNCODE
| 3a
| [4]
| 22
| 1017
| 22
| "; after: track by_src, count 5, seconds 300; threshold: type suppress, track by_src, count 1, seconds 300; xbits: set,brute_force,track ip_src, expire 21600; default_proto: tcp; default_dst_port: 1521; classtype: brute-force; parse_src_ip: 1; sid:5002949; rev: 4;)