cscli scenarios install crowdsecurity/exchange-bf1type: leaky2name: crowdsecurity/exchange-bf3description: "Detect Exchange bruteforce (SMTP,IMAP,POP3)"4filter: evt.Meta.service == 'exchange' && evt.Meta.sub_type == 'auth_fail'5groupby: evt.Meta.source_ip6leakspeed: 10s7capacity: 58blackhole: 1m9labels:10 confidence: 311 spoofable: 012 classification:13 - attack.T111014 behavior: "pop3/imap:bruteforce"15 label: "Microsoft Exchange Bruteforce"16 remediation: true17 service: exchange18