cscli scenarios install LePresidente/ombi-bfDetect failed emby authentications:
1# emby bruteforce2type: leaky3name: LePresidente/ombi-bf4description: "Detect Ombi bruteforce"5filter: "evt.Meta.log_type == 'ombi_auth_failed'"6leakspeed: 1m7capacity: 58groupby: evt.Meta.source_ip9blackhole: 5m10reprocess: true11labels:12 service: ombi13 behavior: "http:bruteforce"14 spoofable: 015 confidence: 316 classification:17 - attack.T111018 label: "Ombi Bruteforce"19 remediation: true20