cscli scenarios install LePresidente/adguardhome-bfDetect failed AdGuardHome authentications:
1# AdGuardHome bruteforce2type: leaky3name: LePresidente/adguardhome-bf4description: "Detect AdGuardHome bruteforce attacks"5filter: "evt.Meta.log_type == 'adguardhome_failed_auth'"6leakspeed: 1m7capacity: 58groupby: evt.Meta.source_ip9blackhole: 5m10reprocess: true11labels:12 service: adguardhome13 spoofable: 014 confidence: 315 classification:16 - attack.T111017 label: "AdGuardHome Bruteforce"18 behavior: "http:bruteforce"19 remediation: true20