cscli scenarios install aidalinfo/couchdb-crawlSame of crawl reverse proxy, distinct by path, leakspeed 0.5, capacity 40
1type: leaky2name: aidalinfo/couchdb-crawl3description: "Detect aggressive crawl on CouchDB"4filter: evt.Meta.log_type == 'crawl-couchdb'5distinct: evt.Meta.path_db6leakspeed: 0.5s7capacity: 408#debug: true9#this limits the memory cache (and event_sequences in output) to five events10cache_size: 511groupby: evt.Meta.source_ip12blackhole: 1m13labels:14 service: couchdb15 confidence: 116 spoofable: 017 classification:18 - attack.T159519 behavior: "http:crawl"20 label: "CouchDB Crawl"21 remediation: true