IPS got triggered a dozen times for this protection and i think to know what's behind it, although i'm not sure how to resolve this.
I might believe this is due to a host(s) that starts multiple sessions to copy/write on the SAN, which has many different nodes that is written to, concurrently.
The screenshot shows the different nodes being written to. I left the last octet of the noes visible for you to see.
I could make an IPS exception for the that specific source, which than ignores this IPS signature but i'm afraid i would miss the moment a potential real brute force scan is being executed.
How to resolve this issue in the best way possible?