[\Advanced\Rules\Correlation Rules\Brute_force_login_likely_successful\];
CheckDescription	=S	Brute force password attack may have succeded;
Enabled	=B	1;
Priority	=L	2;
[\Advanced\Rules\Correlation Rules\Brute_force_login_likely_successful\Response\];
[\Advanced\Rules\Correlation Rules\Brute_force_login_likely_successful\Response\BANNER\];
Enabled	=B	0;
[\Advanced\Rules\Correlation Rules\Brute_force_login_likely_successful\Response\BLOCK\];
Enabled	=B	0;
[\Advanced\Rules\Correlation Rules\Brute_force_login_likely_successful\Response\DISABLE\];
Enabled	=B	0;
[\Advanced\Rules\Correlation Rules\Brute_force_login_likely_successful\Response\DISPLAY\];
Choice	=S	Default;
[\Advanced\Rules\Correlation Rules\Brute_force_login_likely_successful\Response\LOGDB\];
Choice	=S	LogWithoutRaw;
[\Advanced\Rules\Correlation Rules\Brute_force_login_likely_successful\Response\RSKILL\];
Enabled	=B	0;
[\Advanced\Rules\Correlation Rules\Brute_force_login_likely_successful\Response\SUSPEND\];
Enabled	=B	0;
[\Advanced\Rules\Correlation Rules\Brute_force_login_likely_successful\Response\SNMP\];
Enabled	=B	1;
Choice	=S	Default;
[\Advanced\Rules\Correlation Rules\Change_password_attack\];
CheckDescription	=S	Detect brute force password change attack;
Enabled	=B	0;
Priority	=L	3;
[\Advanced\Rules\Correlation Rules\Change_password_attack\Response\];
[\Advanced\Rules\Correlation Rules\Change_password_attack\Response\BANNER\];
Enabled	=B	0;
[\Advanced\Rules\Correlation Rules\Change_password_attack\Response\BLOCK\];
Enabled	=B	0;
[\Advanced\Rules\Correlation Rules\Change_password_attack\Response\DISABLE\];
Enabled	=B	0;
[\Advanced\Rules\Correlation Rules\Change_password_attack\Response\DISPLAY\];
Choice	=S	Default;
[\Advanced\Rules\Correlation Rules\Change_password_attack\Response\LOGDB\];
Choice	=S	LogWithoutRaw;
[\Advanced\Rules\Correlation Rules\Change_password_attack\Response\RSKILL\];
Enabled	=B	0;
[\Advanced\Rules\Correlation Rules\Change_password_attack\Response\SUSPEND\];
Enabled	=B	0;
[\Advanced\Rules\Correlation Rules\Change_password_attack\Response\SNMP\];
Enabled	=B	1;
Choice	=S	Default;