1type: leaky
2name: aidalinfo/tcpudp-flood-traefik
3description: "Detect TCP/UDP flood"
4filter: "evt.Meta.log_type == 'traefik_tcpudp'"
5groupby: "evt.Meta.source_ip"
6capacity: 1000
7cache_size: 10
8leakspeed: "10s"
9blackhole: 5m
10labels:
11  remediation: true
12  classification:
13    - attack.T1498
14  spoofable: 0
15  confidence: 2
16  label: "UDP or TCP Flood Traefik"
17