title: Using snort/suricata, I want to generate an SSH alert for every failed login to my Home Network
body: <p>I am setting up an Intrusion Detection System (IDS) using Suricata. I want to write a custom rule which will generate an alert whenever a failed login attempts occur to my virtual machine.</p>
  
  <p>Example:</p>
  
  <blockquote>
    <p>alert tcp any any -> $HOME_NET 22 (msg:"SSH Brute Force Attempt";flow:established,to_server;content:"SSH";nocase;offset:0; depth:4;detection_filter:track by_src, count 2, seconds 2;sid:2005; rev:1;)</p>
  </blockquote>
  
  <p>I tried various combinations for SSH rule but not able to see any alerts in the Suricata Alerts section with multiple bad SSH attempts. (Bad attempts => using invalid password to generate alerts)</p>
  
  <p>Kindly let me know how to go about this.</p>