cscli scenarios install LearningSpot/litellm-bfDetect failed authentications for Litellm :
leakspeed of 1m, capacity of 5, blackhole of 1m on source ip
1# Litellm bruteforce2type: leaky3name: LearningSpot/litellm-bf4description: "Detect bruteforce attempts to Litellm"5filter: "evt.Meta.log_type == 'litellm_failed_auth' && evt.Meta.status == '401'"6groupby: evt.Meta.source_ip7leakspeed: 1m8capacity: 59blackhole: 1m10labels:11 service: litellm12 classification:13 - attack.T111014 behavior: "http:bruteforce"15 confidence: 316 spoofable: 017 label: "Litellm Bruteforce"18 remediation: true19