1type: leaky
2name: Azlaroc/sftpgo-bf
3description: "Detect SFTPGo bruteforce attacks on FTP/SSH"
4filter: "evt.Meta.log_type == 'sftpgo_auth' && evt.Meta.is_failed_login == 'true'"
5groupby: evt.Meta.source_ip
6capacity: 3
7leakspeed: "30s"
8blackhole: 5m
9labels:
10  service: sftpgo
11  confidence: 3
12  spoofable: 0
13  classification:
14    - attack.T1110
15  behavior: "sftp:bruteforce"
16  label: "SFTPGo Bruteforce"
17  remediation: true
18