Exercise : 1
alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"SCAN XMAS"; flow:stateless; flags:FPU; sid:1; rev:1;)

Exercise: 2
alert tcp $EXTERNAL_NET any -> $HOME_NET 80 (msg:"Warning!!, A host is trying to access /admin"; content:"/admin"; sid:3; rev:1; classtype:web-application-activity;)


Exercise: 3
alert tcp any any -> $HOME_NET 22 (msg:"Potential SSH Brute Force Attack"; \
 flow:to_server; \
 flags:S; \
 threshold:type threshold, track by_src, count 3, seconds 60; \
 classtype:attempted-dos; \
 sid:2001219; \
 rev:4; resp:rst_all; \
 )

