<group name="asterisk,">
        <rule id="102000" level="0">
                <description>Grouping of Asterisk rules</description>
                <decoded_as>asterisk</decoded_as>
        </rule>

        <rule id="102002" level="0">
                <match>Username/auth name mismatch</match>
                <description>an unknown username</description>
                <if_sid>102000</if_sid>
        </rule>

        <rule id="102003" level="10" frequency="10" timeframe="600">
                <if_matched_sid>102002</if_matched_sid>
                <description>Enumeration of users on asterisk in process</description>
        </rule>

        <rule id="102004" level="6">
                <if_sid>102000</if_sid>
                <match>Wrong password</match>
                <description>Someone got the password wrong</description>
        </rule>

        <rule id="102006" level="10" frequency="10" timeframe="600">
               <if_matched_sid>102004</if_matched_sid>
                <description>A password cracking attack in process</description>
       </rule>
</group>

