1type: leaky
2name: crowdsecurity/http-apiscp-bf
3description: "detect apisCP dashboard bruteforce"
4debug: false
5# success auth on apisCP returns 303
6filter: "evt.Meta.log_type == 'http_access-log' && evt.Meta.http_path startsWith '/apps/login' && evt.Parsed.verb == 'POST' && evt.Meta.http_status == '200'"
7groupby: evt.Meta.source_ip
8capacity: 5
9leakspeed: 10s
10blackhole: 5m
11labels:
12  service: apisCP
13  confidence: 3
14  spoofable: 0
15  classification:
16    - attack.T1110
17  behavior: "http:bruteforce"
18  label: "apisCP bruteforce"
19  remediation: true
20