{
  "RULESAuth": [
    {
      "EventLimit": 7,
      "IsEnabled": 1,
      "Message": "Over 7 pam auth failure events in 10 minutes",
      "OutTable": "SIEMAuth",
      "RuleName": "PAM_AuthFail_10m",
      "SQLQuery": "SELECT Id FROM Auth WHERE DateStamp >= timestamp(date_sub(now(), interval 10 minute)) AND (Message LIKE \"%fail%\" AND Message LIKE \"%pam%\")",
      "Severity": 4,
      "SourceTable": "Auth",
      "TimeInt": 10
    },
    {
      "EventLimit": 3,
      "IsEnabled": 1,
      "Message": "Over 3 pam auth failure events for root in 10 minutes",
      "OutTable": "SIEMAuth",
      "RuleName": "PAM_RootFail_10m",
      "SQLQuery": "SELECT Id FROM Auth WHERE DateStamp >= timestamp(date_sub(now(), interval 10 minute)) AND (Message LIKE \"%fail%\" AND Message LIKE \"%pam%\" AND Message LIKE \"%root%\")",
      "Severity": 2,
      "SourceTable": "Auth",
      "TimeInt": 10
    }
  ]
}

{
  "RULESAuth": [
    {
      "EventLimit": 7,
      "IsEnabled": 1,
      "Message": "Over 7 pam auth failure events in 10 minutes",
      "OutTable": "SIEMAuth",
      "RuleName": "PAM_AuthFail_10m",
      "SQLQuery": "SELECT Id FROM Auth WHERE DateStamp >= timestamp(date_sub(now(), interval 10 minute)) AND (Message LIKE \"%fail%\" AND Message LIKE \"%pam%\")",
      "Severity": 4,
      "SourceTable": "Auth",
      "TimeInt": 10
    },
    {
      "EventLimit": 2,
      "IsEnabled": 1,
      "Message": "Over 2 pam auth failure events for root in 10 minutes",
      "OutTable": "SIEMAuth",
      "RuleName": "PAM_RootFail_10m",
      "SQLQuery": "SELECT Id FROM Auth WHERE DateStamp >= timestamp(date_sub(now(), interval 10 minute)) AND (Message LIKE \"%fail%\" AND Message LIKE \"%pam%\" AND Message LIKE \"%root%\")",
      "Severity": 2,
      "SourceTable": "Auth",
      "TimeInt": 10
    }
  ]
}

Tweak root auth fail rule
Tweak root auth fail rule
