cscli scenarios install crowdsecurity/ssh-slow-bfDetect slow ssh bruteforce authentications :
1# ssh bruteforce2type: leaky3name: crowdsecurity/ssh-slow-bf4description: "Detect slow ssh bruteforce"5filter: "evt.Meta.log_type == 'ssh_failed-auth'"6leakspeed: "60s"7references:8 - http://wikipedia.com/ssh-bf-is-bad9capacity: 1010groupby: evt.Meta.source_ip11blackhole: 1m12reprocess: true13labels:14 service: ssh15 remediation: true16 confidence: 317 spoofable: 018 classification:19 - attack.T111020 behavior: "ssh:bruteforce"21 label: "SSH Slow Bruteforce"22---23# ssh user-enum24type: leaky25name: crowdsecurity/ssh-slow-bf_user-enum26description: "Detect slow ssh user enum bruteforce"27filter: evt.Meta.log_type == 'ssh_failed-auth'28groupby: evt.Meta.source_ip29distinct: evt.Meta.target_user30leakspeed: 60s31capacity: 1032blackhole: 1m33labels:34 service: ssh35 remediation: true36 confidence: 337 spoofable: 038 classification:39 - attack.T111040 behavior: "ssh:bruteforce"41 label: "SSH Slow User Enumeration"42