1# Synology DSM auth.log bruteforce
2type: leaky
3name: crowdsecurity/synology-dsm-bf
4description: "Detect Synology DSM web auth bruteforce"
5filter: "evt.Meta.log_type == 'synology-dsm_failed_auth'"
6leakspeed: "10s"
7capacity: 5
8groupby: evt.Meta.source_ip
9blackhole: 1m
10reprocess: true
11labels:
12 service: synology_dsm
13 remediation: true
14 confidence: 3
15 spoofable: 0
16 classification:
17  - attack.T1110
18 behavior: "http:bruteforce"
19 label: "Synology DSM Bruteforce"