cscli scenarios install crowdsecurity/endlessh-bf1# endlessh bruteforce2type: leaky3name: crowdsecurity/endlessh-bf4description: "Detect SSH bruteforce caught by Endlessh"5filter: "evt.Meta.log_type == 'endlessh_accept'"6leakspeed: "5m"7references:8 - http://wikipedia.com/ssh-bf-is-bad9capacity: 510groupby: evt.Meta.source_ip11blackhole: 120m12reprocess: true13labels:14 confidence: 315 spoofable: 016 classification:17 - attack.T111018 behavior: "ssh:bruteforce"19 label: "Endlessh Bruteforce"20 service: endlessh21 remediation: true22