[
  {
    "EventLimit": 7,
    "Message": "Over 7 pam auth failure events in 10 minute",
    "OutTable": "UserAuth",
    "RuleName": "PAM_AuthFail_10m",
    "SQLQuery": "SELECT Id FROM Auth WHERE DateStamp >= timestamp(date_sub(now(), interval 10 minute)) AND (Message LIKE \"%fail%\" AND Message LIKE \"%pam%\")",
    "Severity": 2,
    "SourceTable": "Auth",
    "TimeInt": 10
  },
  {
    "EventLimit": 3,
    "Message": "Over 3 pam auth failure events for root in 10 minutes",
    "OutTable": "UserAuth",
    "RuleName": "PAM_RootFail_10m",
    "SQLQuery": "SELECT Id FROM Auth WHERE DateStamp >= timestamp(date_sub(now(), interval 10 minute)) AND (Message LIKE \"%fail%\" AND Message LIKE \"%pam%\" AND Message LIKE \"%root%\")",
    "Severity": 5,
    "SourceTable": "Auth",
    "TimeInt": 10
  }
]

Convert example rules to JSON
Convert example rules to JSON
