alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-MERAKI] WPA failed authentication attempt"; content: "type=device_packet_flood"; content: "packet='deauth'"; classtype: attempted-user; reference: url,meraki.cisco.com/lib/pdf/meraki_whitepaper_air_marshal.pdf; sid:5003049; rev:1;)
-- Main.Sagan-Wiki-Add - 2017-3-20
New revisions of 5003049 will be below...
alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-MERAKI] WPA failed authentication attempt"; content: "type=device_packet_flood"; content: "packet='deauth'"; classtype: attempted-user; reference: url,meraki.cisco.com/lib/pdf/meraki_whitepaper_air_marshal.pdf; sid:5003049; rev:2;)
-- Main.Sagan-Wiki-Add - 2021-4-12