[SALESFORCE] Possible Brute Force Failed Login Attempts [25/1]

alert any $HOME_NET any -> $HOME_NET any (msg:"[SALESFORCE] Possible Brute Force Failed Login Attempts [25/1]"; program:salesforce_streaming_api_data; json_content:".channel","/event/LoginEventStream"; json_content:!".data.payload.Status","Success"; json_nocase; json_map:"src_ip",".data.payload.SourceIp"; after:track by_src, count 5,seconds 300; threshold:type suppress,track by_src, count 1, seconds 86400; xbits:set,brute_force,track ip_src, expire 21600; classtype:system-event; reference:url,https://developer.salesforce.com/docs/atlas.en-us.platform_events.meta/platform_events/platform_events_objects_monitoring.htm; sid:5014046; rev:1;)