1# pgsql bruteforce
2type: leaky
3#debug: true
4name: crowdsecurity/pgsql-bf
5description: "Detect PgSQL bruteforce"
6filter: evt.Meta.log_type == 'pgsql_failed_auth'
7leakspeed: "10s"
8capacity: 5
9groupby: evt.Meta.source_ip
10blackhole: 5m
11labels:
12 service: pgsql
13 remediation: true
14 confidence: 3
15 spoofable: 0
16 classification:
17  - attack.T1110
18 behavior: "database:bruteforce"
19 label: "Postgres Bruteforce"
20