[PALO-ALTO] GlobalProtect VPN Authentication Failed Possible Brute-Force [10/1]

alert any $HOME_NET any -> $HOME_NET any (msg:"[PALO-ALTO] GlobalProtect VPN Authentication Failed Possible Brute-Force [10/1]"; content:",SYSTEM,auth,"; content:",auth-fail,"; after:track by_src, count 10, seconds 300; threshold:type suppress, track by_src, count 1, seconds 86400; xbits:set,brute-force,track ip_src,expire 28800; parse_src_ip:1; parse_dst_ip:2; reference:url,https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/monitoring/view-and-manage-logs/log-types-and-severity-levels/authentication-logs; content: ",vsys"; classtype:attempted-user; sid:5014086; rev:3; metadata:deployment Server,affected_product NONE,affected_version NONE,mitigation NONE,deprecation_reason NONE,tag NONE, created_at 2023_12_06, updated_at 2024_06_06, mitre_tactic_id TA0006, mitre_technique_id T1110;)