cscli scenarios install crowdsecurity/pgsql-bfDetect several failed postgresql authentications.
leakspeed of 10s, capacity of 5
1# pgsql bruteforce2type: leaky3#debug: true4name: crowdsecurity/pgsql-bf5description: "Detect PgSQL bruteforce"6filter: evt.Meta.log_type == 'pgsql_failed_auth'7leakspeed: "10s"8capacity: 59groupby: evt.Meta.source_ip10blackhole: 5m11labels:12 service: pgsql13 remediation: true14 confidence: 315 spoofable: 016 classification:17 - attack.T111018 behavior: "database:bruteforce"19 label: "Postgres Bruteforce"20