Detection Logic
alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[SYSTEMD] Service Failed"; program: systemd; content: "
| 2E
| service
| 3A 20
| Failed"; after: track by_src, count 5, seconds 30; threshold: type suppress, track by_src, count 5, seconds 300; classtype: system-error; sid:5005974; rev:3;)Field Validations
Loading…
Comments (0)
Loading comments...