cscli scenarios install crowdsecurity/appsec-vpatch1type: leaky2format: 3.03name: crowdsecurity/appsec-vpatch4description: "Identify attacks flagged by CrowdSec AppSec"5## See appsec-native.yaml for reasons why we created a negative startsWith here, we want to ignore is native_rules but catch any of our DSL rules.6filter: "evt.Meta.log_type == 'appsec-block' && evt.Meta.rule_name not startsWith 'native_rule'"7distinct: evt.Meta.rule_name8leakspeed: "60s"9capacity: 110groupby: evt.Meta.source_ip11blackhole: 1m12labels:13 service: http14 confidence: 315 spoofable: 016 classification:17 - attack.T119018 label: "Blocked by CrowdSec AppSec"19 behavior: "http:exploit"20 remediation: true21