cscli scenarios install firix/authentik-bfDetect failed authentik authentications:
1# Authentik BF scan2type: leaky3name: firix/authentik-bf4description: "Detect authentik bruteforce"5filter: evt.Meta.log_type in ['authentik_failed_auth', 'authentik_invalid_username']6groupby: evt.Meta.source_ip7leakspeed: 20s8capacity: 59blackhole: 1m10labels:11 service: authentik12 behavior: "http:bruteforce"13 spoofable: 014 confidence: 315 classification:16 - attack.T111017 label: "Authentik Bruteforce"18 remediation: true19---20# Authentik user-enum21type: leaky22name: firix/authentik-bf_user-enum23description: "Detect authentik user enum bruteforce"24filter: evt.Meta.log_type in ['authentik_failed_auth', 'authentik_invalid_username']25groupby: evt.Meta.source_ip26distinct: evt.Meta.username27leakspeed: 1m28capacity: 529blackhole: 1m30labels:31 service: authentik32 behavior: "http:bruteforce"33 spoofable: 034 confidence: 335 classification:36 - attack.T158937 - attack.T111038 label: "Authentik User Enumeration"39 remediation: true40