cscli scenarios install crowdsecurity/fortinet-vpn-bruteforceDetect Fortinet VPN bruteforce
leakspeed of 10s, capacity of 5
1type: leaky2name: crowdsecurity/fortinet-vpn-bruteforce3description: "Detect fortinet VPN bruteforce"4debug: false5filter: "evt.Meta.service == 'fortinet' && evt.Meta.sub_type == 'vpn' && evt.Meta.action == 'ssl-login-fail' && evt.Meta.tunnel_type == 'ssl-web'"6groupby: evt.Meta.source_ip7capacity: 58leakspeed: 2m9blackhole: 5m10labels:11 confidence: 312 spoofable: 013 classification:14 - attack.T111015 behavior: "http:bruteforce"16 label: "Fortinet VPN Bruteforce"17 service: fortinet18 remediation: true19