cscli scenarios install crowdsecurity/mysql-bfDetect several failed mysql authentications.
leakspeed of 10s, capacity of 5
1# mysql bruteforce2type: leaky3#debug: true4name: crowdsecurity/mysql-bf5description: "Detect mysql bruteforce"6filter: evt.Meta.log_type == 'mysql_failed_auth'7leakspeed: "10s"8capacity: 59groupby: evt.Meta.source_ip10blackhole: 5m11labels:12 remediation: true13 confidence: 314 spoofable: 015 classification:16 - attack.T111017 behavior: "database:bruteforce"18 label: "MySQL Bruteforce"19 service: mysql20