cscli scenarios install LearningSpot/hestiacp-bfDetect failed authentications for Hestiacp :
leakspeed of 1m, capacity of 5, blackhole of 1m on source ip and user enumeration
1# Hestiacp Bruteforce2type: leaky3name: LearningSpot/hestiacp-bf4description: "Detect Hestiacp Bruteforce"5filter: evt.Meta.log_type == 'hestiacp_failed_auth'6groupby: evt.Meta.source_ip7leakspeed: 1m8capacity: 59blackhole: 1m10labels:11 service: hestiacp12 classification:13 - attack.T111014 behavior: "http:bruteforce"15 confidence: 316 spoofable: 017 label: "hestiacp Bruteforce"18 remediation: true19---20# Hestiacp User Enumeration21type: leaky22name: LearningSpot/hestiacp-bf-user-enum23description: "Detect Hestiacp User Enumeration Bruteforce"24filter: evt.Meta.log_type == 'hestiacp_failed_auth'25distinct: evt.Meta.target_user26groupby: evt.Meta.source_ip27leakspeed: 1m28capacity: 529blackhole: 1m30labels:31 service: hestiacp32 classification:33 - attack.T158934 - attack.T111035 behavior: "http:bruteforce"36 confidence: 337 spoofable: 038 label: "Hestiacp User Enumeration"39 remediation: true40