Hi I want to do some custom rules for ssh brute force and would like to leverage the ssh parser. What I want to do initially is just count *established* ssh sessions and alert on thresholds. The current rules trigger on scans and brute force since they alert on flags S12. Russell