cscli scenarios install crowdsecurity/cpanel-bf-attemptTrigger alerts when this line is matched:
1FAILED LOGIN cpaneld: brute force attempt (user cscpanel) has locked out IP 1.2.3.4
1type: trigger2name: crowdsecurity/cpanel-bf-attempt3description: "Detect bruteforce attempt on cpanel login"4filter: "evt.Meta.log_type == 'auth_bf_attempt'"5groupby: evt.Meta.source_ip6blackhole: 5m7labels:8 confidence: 19 spoofable: 010 classification:11 - attack.T111012 behavior: "http:bruteforce"13 label: "cPanel Bruteforce"14 service: cpanel15 remediation: true