cscli scenarios install crowdsecurity/sabnzbd-bfDetect failed sabnzbd authentications :
1# sabnzbd bruteforce2type: leaky3name: crowdsecurity/sabnzbd-bf4description: "Detect sabnzbd bruteforce"5filter: "evt.Meta.service == 'sabnzbd' && evt.Meta.log_type == 'sabnzbd_failed_auth'"6leakspeed: "10s"7capacity: 38groupby: evt.Meta.source_ip9blackhole: 1m10reprocess: true11labels:12 service: sabnzbd13 confidence: 314 spoofable: 015 classification:16 - attack.T111017 label: "Sabnzbd Bruteforce"18 behavior: "generic:bruteforce"19 remediation: true20---21# sabnzbd slow bruteforce22type: leaky23name: crowdsecurity/sabnzbd-slow-bf24description: "Detect sabnzbd slow bruteforce"25filter: "evt.Meta.service == 'sabnzbd' && evt.Meta.log_type == 'sabnzbd_failed_auth'"26leakspeed: "60s"27capacity: 1028groupby: evt.Meta.source_ip29blackhole: 1m30reprocess: true31labels:32 service: sabnzbd33 confidence: 334 spoofable: 035 classification:36 - attack.T111037 label: "Sabnzbd Bruteforce"38 behavior: "generic:bruteforce"39 remediation: true