cscli scenarios install aidalinfo/couchdb-bfDetect failed CouchDB authentication :
leakspeed of 60s, capacity of 10, Group by IP leakspeed of 10s, capacity of 5, Group by IP
1# couchdb slow bruteforce2type: leaky3name: aidalinfo/couchdb-slow-bf4description: "Detect slow Couchdb bruteforce/enum"5filter: evt.Meta.log_type == 'bf-enum-couchdb'6leakspeed: "60s"7capacity: 108groupby: evt.Meta.source_ip9blackhole: 1m10reprocess: true11labels:12 service: couchdb13 remediation: true14 confidence: 315 spoofable: 016 classification:17 - attack.T111018 behavior: "database:bruteforce"19 label: "Couchdb low Bruteforce"20---21# couchdb bruteforce22type: leaky23name: aidalinfo/couchdb-bf24description: "Detect Couchdb bruteforce/enum"25filter: evt.Meta.log_type == 'bf-enum-couchdb'26leakspeed: "10s"27capacity: 528groupby: evt.Meta.source_ip29blackhole: 1m30reprocess: true31labels:32 service: couchdb33 confidence: 334 spoofable: 035 classification:36 - attack.T111037 behavior: "database:bruteforce"38 label: "Couchdb Bruteforce"39 remediation: true