1type: leaky
2name: crowdsecurity/fortinet-vpn-bruteforce
3description: "Detect fortinet VPN bruteforce"
4debug: false
5filter: "evt.Meta.service == 'fortinet' && evt.Meta.sub_type == 'vpn' && evt.Meta.action == 'ssl-login-fail' && evt.Meta.tunnel_type == 'ssl-web'"
6groupby: evt.Meta.source_ip
7capacity: 5
8leakspeed: 2m
9blackhole: 5m
10labels:
11  confidence: 3
12  spoofable: 0
13  classification:
14    - attack.T1110
15  behavior: "http:bruteforce"
16  label: "Fortinet VPN Bruteforce"
17  service: fortinet
18  remediation: true
19