Detection Logic
alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[SYSTEMD] SERVICE_START Failure"; program: audit; content: "SERVICE
| 5F
| START"; content: "res
| 3D
| failed"; after: track by_src, count 5, seconds 30; threshold: type suppress, track by_src, count 5, seconds 300; classtype: system-error; sid:5005972; rev:2;)Field Validations
Loading…
Comments (0)
Loading comments...