freeipa: filter out service principals from kerberos brute-force rule

Author: Oddly

rules/integrations/freeipa/credential_access_freeipa_kerberos_brute_force.toml

@@ -80,6 +80,7 @@ type = "esql"
 query = '''
 from logs-freeipa.kdc-*
 | where event.outcome == "failure"
+    and freeipa.kdc.client_principal not like "*/*"
 | stats Esql.failure_count = count(*) by freeipa.kdc.client_principal, source.ip
 | where Esql.failure_count >= 25
 '''