[SYSLOG] Authentication failure - Brute force [25/5]

alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[SYSLOG] Authentication failure - Brute force [25/5]"; content:!"TACACS"; nocase; pcre: "/failed to authorize
| failed authentication
| wrong password given
| repeated login failures
| authentication failed
| authentication failures
| access denied
| access not allowed
| failed to authenticate/i"; content: !"
| 24
| Session ID
| 3a
| "; content:!"access denied by ACL"; content:!"server certificate authentication failed"; normalize; content:!"Kerberos"; content:!"IPSEC: Received an ESP packet"; content:!"reason=
| 22
| IEEE 802.1X authentication failed"; content:!"session.token.rotate"; parse_src_ip: 1; parse_port; parse_proto; classtype: brute-force; after: track by_src, count 25, seconds 300; threshold: type suppress, track by_src, count 1, seconds 86400; xbits: set,brute_force,track ip_src, expire 21600; sid: 5000119; rev:21;)