cscli scenarios install crowdsecurity/mariadb-bfDetect several failed mariadb authentications.
leakspeed of 10s, capacity of 5
1# mariadb bruteforce2type: leaky3#debug: true4name: crowdsecurity/mariadb-bf5description: "Detect mariadb bruteforce"6filter: evt.Meta.log_type == 'mariadb_failed_auth'7leakspeed: "10s"8capacity: 59groupby: evt.Meta.source_ip10blackhole: 5m11labels:12 remediation: true13 service: mariadb14 classification:15 - attack.T111016 behavior: "database:bruteforce"17 label: "MariaDB Bruteforce"18 spoofable: 019 confidence: 320