cscli scenarios install LePresidente/grafana-bfDetect failed Grafana authentications:
1# grafana BF scan2name: LePresidente/grafana-bf3description: "Detect grafana bruteforce"4filter: "evt.Meta.service == 'grafana' && evt.Meta.log_type == 'auth_failed'"5#debug: true6type: leaky7groupby: evt.Meta.source_ip8leakspeed: "20s"9capacity: 510blackhole: 1m11labels:12 service: grafana13 behavior: "http:bruteforce"14 classification:15 - attack.T111016 spoofable: 017 confidence: 318 label: "Grafana Bruteforce"19 remediation: true20