I wrote this rule so that when there are more than three failed SSH connection attempts that there is an alert but it is not working. Are these rules badly written? Or if not I ask the exact writing of the rule.
It's an emergency it's for a sustain in a few weeks...
This is my rule:
alert tcp 192.168.1.30 any -> 192.168.1.50 22 ( msg:"SSH Brute Force Attempt"; flow:established,to_server; content:"SSH"; nocase; offset:0; depth:3; detection_filter:track by_src, count 3, seconds 60; sid:10000001; rev:1;)