cscli scenarios install fulljackz/pureftpd-bf1# Pureftpd authent bruteforce2type: leaky3name: fulljackz/pureftpd-bf4description: "Detect pureftpd bruteforce"5filter: "evt.Meta.log_type == 'pftpd_failed-auth'"6leakspeed: "10s"7capacity: 58groupby: evt.Meta.source_ip9blackhole: 1m10reprocess: true11labels:12 service: ftp13 confidence: 314 spoofable: 015 classification:16 - attack.T111017 behavior: "ftp:bruteforce"18 label: "PureFTPD Bruteforce"19 remediation: true20