cscli scenarios install crowdsecurity/home-assistant-bfDetect several failed Home assistant authentications.
leakspeed of 10s, capacity of 5
1# home-assistant bruteforce2type: leaky3#debug: true4name: crowdsecurity/home-assistant-bf5description: "Detect Home Assistant bruteforce"6filter: evt.Meta.log_type == 'home-assistant_failed_auth'7leakspeed: "10s"8capacity: 59groupby: evt.Meta.source_ip10blackhole: 5m11labels:12 confidence: 313 spoofable: 014 classification:15 - attack.T111016 behavior: "iot:bruteforce"17 label: "Home Assistant Bruteforce"18 service: home-assistant19 remediation: true20