[PALO-ALTO] GlobalProtect VPN Successful Login from Outside HOME_COUNTRY

alert any $HOME_NET any -> $HOME_NET any (msg:"[PALO-ALTO] GlobalProtect VPN Successful Login from Outside HOME_COUNTRY"; content:",SYSTEM,auth,"; content:",auth-success,"; country_code:track by_src,isnot $HOME_COUNTRY; parse_src_ip:1; reference:url,https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/monitoring/view-and-manage-logs/log-types-and-severity-levels/authentication-logs; content: ",vsys"; classtype:attempted-user; sid:5014088; rev:2; metadata:deployment Server,affected_product NONE,affected_version NONE,mitigation NONE,deprecation_reason NONE,tag NONE, created_at 2023_12_06, updated_at 2023_12_06, mitre_tactic_id TA0006, mitre_technique_id T1110;)