cscli collections install crowdsecurity/http-dos
This collection of scenarios detects specific HTTP DoS tools that are not detected by default HTTP scenarios.
To work correctly, it requires the associated HTTP collection of your webserver to be present, such as nginx or apache2.
Given the very nature of the scenarios, proper testing is advised to avoid false-positives: