cscli scenarios install LePresidente/emby-bfDetect failed emby authentications:
1# emby bruteforce2type: leaky3name: LePresidente/emby-bf4description: "Detect emby bruteforce"5filter: "evt.Meta.log_type == 'emby_failed_auth'"6leakspeed: 1m7capacity: 58groupby: evt.Meta.source_ip9blackhole: 5m10reprocess: true11labels:12 service: emby13 behavior: "http:bruteforce"14 classification:15 - attack.T111016 spoofable: 017 confidence: 318 label: "Emby Bruteforce"19 remediation: true20