+
+ <rule id="2507" level="0">
+ <decoded_as>openldap</decoded_as>
+ <description>OpenLDAP group.</description>
+ </rule>
+
+ <rule id="2508" level="3">
+ <if_sid>2507</if_sid>
+ <match>ACCEPT from</match>
+ <description>OpenLDAP connection open.</description>
+ </rule>
+
+ <rule id="2509" level="5" timeframe="10" frequency="0">
+ <if_sid>2507</if_sid>
+ <if_matched_sid>2508</if_matched_sid>
+ <same_id />
+ <match>RESULT tag=97 err=49</match>
+ <description>OpenLDAP authentication failed.</description>
+ </rule>
+