1type: trigger
2name: crowdsecurity/configserver-lfd-bf
3description: "Detects SSH bruteforce attempts blocked by ConfigServer."
4filter: "evt.Parsed.program == 'lfd'"
5groupby: evt.Meta.source_ip
6blackhole: 5m
7labels:
8  service: ssh
9  confidence: 3
10  spoofable: 0
11  classification:
12    - attack.T1110
13  label: "SSH Bruteforce"
14  behavior: "ssh:bruteforce"
15  remediation: true
16
17