1# OpenSearch web auth bruteforce
2type: leaky
3name: bouddha-fr/opensearch-dashboard-bf
4description: "Detect bruteforce attempts on OpenSearch web interface"
5filter: evt.Meta.log_type == 'opensearch_failed_auth'
6leakspeed: "10s"
7capacity: 5
8groupby: evt.Meta.source_ip
9blackhole: 5m
10labels:
11  remediation: true
12  confidence: 3
13  spoofable: 0
14  classification:
15    - attack.T1110
16  behavior: "http:bruteforce"
17  label: "OpenSearch Bruteforce"
18  service: opensearch
19