cscli scenarios install firewallservices/lemonldap-ng-bfDetect failed Lemonldap::NG authentications :
1# Lemonldap::NG brutforce2type: leaky3#debug: true4name: firewallservices/lemonldap-ng-bf5description: "Detect Lemonldap::NG bruteforce"6filter: evt.Meta.service == 'llng' and evt.Meta.log_type == 'llng_auth_fail'7leakspeed: 30s8capacity: 59groupby: evt.Meta.source_ip10blackhole: 1m11reprocess: true12labels:13 service: ldap14 confidence: 315 spoofable: 016 classification:17 - attack.T111018 behavior: "ldap:bruteforce"19 label: "LemonLDAP Bruteforce"20 remediation: true2122---23# Lemonldap::NG user enumeration24type: leaky25#debug: true26name: firewallservices/lemonldap-ng-user-enum27description: "Detect Lemonldap::NG user enum bruteforce"28filter: evt.Meta.service == 'llng' and evt.Meta.log_type == 'llng_auth_fail'29groupby: evt.Meta.source_ip30distinct: evt.Meta.user31leakspeed: 2m32capacity: 533blackhole: 1m34labels:35 service: ldap36 confidence: 337 spoofable: 038 classification:39 - attack.T111040 - attack.T159541 behavior: "ldap:bruteforce"42 label: "LemonLDAP User Enum Bruteforce"43 remediation: true44