Listing 1. Directive in .xml Format

<directive id="101"
           name="Unauthorized Access to Web Server"
           priority="5">
   <rule type="detector"
         name="NMAP Scan from Foreign host"
         from="ANY"
         to="web.server.ip.address"
         port_from="ANY"
         port_to="22"
         reliability="1"
         occurrence="1"
         plugin_id="1001"
         plugin_sid="2000537,2000545"
         sticky="true"
         sticky_different="SRC_IP">
      <rules>
         <rule type="detector"
               name="Too Many Logins"
               from="web.server.ip.address"
               to="ANY"
               port_from="ANY"
               port_to="ANY"
               reliability="+2"
               occurrence="2"
               time_out="86400"
               plugin_id="7010"
               plugin_sid="5716"/>
      </rules>
   </rule>
</directive>