cscli scenarios install MrShippeR/filebrowser-bfDetect failed authentications for FileBrowser :
leakspeed of 10s, capacity of 5, blackhole of 1m on source ip
1type: leaky2name: MrShippeR/filebrowser-bf3description: "Detect FileBrowser bruteforce login attempts"4filter: evt.Meta.log_type == 'filebrowser_failed_auth'5groupby: evt.Meta.source_ip6leakspeed: 10s7capacity: 58blackhole: 1m9labels:10 service: filebrowser11 confidence: 312 spoofable: 013 classification:14 - attack.T111015 behavior: "generic:bruteforce"16 label: "Filebrowser bruteforce"17 remediation: true18