cscli scenarios install crowdsecurity/crowdsec-appsec-inband1type: leaky2filter: evt.Meta.log_type == 'appsec-block' && evt.Parsed.action in ["deny", "drop"]3#debug: true4name: crowdsecurity/crowdsec-appsec-inband5description: IP has triggered multiples InBand CrowdSec appsec rules6blackhole: 1m7leakspeed: 30s8capacity: 19groupby: evt.Meta.source_ip10distinct: evt.Appsec.GetName()11labels:12 confidence: 313 spoofable: 014 classification:15 - attack.T119016 behavior: "http:exploit"17 label: "Triggered multiple InBand CrowdSec AppSec rules"18 service: http19 remediation: true20