{
  "title": "juniper_ssh_too_many_failures",
  "description": "Juniper sshd: too many password failures for one connection attempt (possible brute-force) - juniper.csv row 13. Built from the provided report, not yet verified against real device output.",
  "source": "rule \"juniper_ssh_too_many_failures\"\nwhen\n  contains(to_string($message.message), \"Too many password failures\")\nthen\n  set_field(\"vendor\", \"juniper\");\n  set_field(\"event_type\", \"ssh_too_many_failures\");\n  set_field(\"severity_tag\", \"warning\");\nend"
}