1name: darkclip/charon-ipsec-bf
2#debug: true
3description: "Detect Charon IPsec slow bruteforce"
4filter: "evt.Meta.log_type == 'charon_ipsec_auth_fail'"
5type: leaky
6groupby: evt.Meta.source_ip
7leakspeed: "60s"
8capacity: 10
9blackhole: 1m
10labels:
11  service: charon_ipsec
12  behavior: "generic:bruteforce"
13  classification:
14    - attack.T1110
15  spoofable: 0
16  confidence: 3
17  label: "Charon IPsec Slow Bruteforce"
18  remediation: true
19