cscli scenarios install crowdsecurity/ssh-refused-connDetect refused connections to SSHD based on hosts deny and allow rules.
Typically these are defined in different locations based on the distribution.
/etc/hosts.deny and /etc/hosts.allow1type: trigger2name: crowdsecurity/ssh-refused-conn3description: "Detect sshd refused connections"4filter: "evt.Meta.log_type == 'ssh_refused_conn'"5groupby: evt.Meta.source_ip6blackhole: 1m7reprocess: false8labels:9 service: ssh10 confidence: 011 spoofable: 012 classification:13 - attack.T159514 label: "SSH Refused Connection"15 behavior: "generic:scan"16 remediation: true17