cscli scenarios install Jgigantino31/mealie-bfDetect failed mealie authentications:
Note: Mealie prints each failed authentication to the log twice causing each failed log in to count as two failed attempts! This means effective leakspeed is 20s and effective capacity is 5.
1# mealie BF scan2name: Jgigantino31/mealie-bf3description: "Detect mealie bruteforce"4filter: "evt.Meta.log_type == 'mealie_failed_auth'"5#debug: true6type: leaky7groupby: evt.Meta.source_ip8leakspeed: 10s9capacity: 1010blackhole: 1m11labels:12 service: mealie13 behavior: "http:bruteforce"14 spoofable: 015 confidence: 316 classification:17 - attack.T111018 label: "Mealie Bruteforce"19 remediation: true20