Re: Snort rules

[Y M via Snort-sigs <snort-sigs () lists snort org>]

I will assume you already have the registered ruleset. Look for sid:19559 (INDICATOR-SCAN SSH brute force login 
attempt).
________________________________
From: Snort-sigs <snort-sigs-bounces () lists snort org> on behalf of Jean Michel Tangu? via Snort-sigs <snort-sigs () 
lists snort org>
Sent: Sunday, July 22, 2018 9:49 PM
To: snort-sigs () lists snort org
Subject: [Snort-sigs] Snort rules

please it's an emergency .. I need the rule that triggers an alert automatically when more than two or three ssh login 
attempts have been made

_______________________________________________
Snort-sigs mailing list
Snort-sigs () lists snort org
https://lists.snort.org/mailman/listinfo/snort-sigs

Please visit http://blog.snort.org for the latest news about Snort!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette

Visit the Snort.org to subscribe to the official Snort ruleset, make sure to stay up to date to catch the most <a 
href=" https://snort.org/downloads/#rule-downloads";>emerging threats</a>!