+ </rule>
+
+ <rule id="9403" level="10" frequency="6" timeframe="120">
+ <if_matched_sid>9401</if_matched_sid>
+ <same_source_ip />
+ <description>Roundcube brute force (multiple failed logins).</description>
+ <group>authentication_failures,</group>
+ </rule>