<if_matched_sid>3902</if_matched_sid>
<description>Courier brute force (multiple failed logins).</description>
<group>authentication_failures,</group>
<same_source_ip />
</rule>
<if_matched_sid>3902</if_matched_sid>
<description>Courier brute force (multiple failed logins).</description>
<group>authentication_failures,</group>
<same_source_ip />
</rule>