---

alert tcp any -> 192.168.56.0/24 22 (msg:"SSH Brute-Force detected"; flow:to_server; flags:S; threshold: type threshold, track by_src, count 5, seconds 30; sid:1000005; rev:1;)