Assistance with login rule

[r s <wera711 () gmail com>]

Hi,

I'm trying to write a snort rule that can examine users trying to login to
our cisco equipment with the following user names: "peake" and "emergency"

The subnet of the devices is 172.16.1.0/24. Am I close with this rule:

alert tcp any -> 172.16.1.0/24 22 (content:"peake | emergency";
msg: "CISCO LOGIN DETECTED !":)

Thanks

------------------------------------------------------------------------------

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users