cscli scenarios install jusabatier/apereo-cas-bfDetect failed CAS authentications :
1# cas bruteforce2type: leaky3name: jusabatier/apereo-cas-bf4description: "Detect CAS bruteforce"5filter: "evt.Meta.log_type == 'cas_failed-auth'"6leakspeed: "10s"7references:8 - http://wikipedia.com/cas-bf-is-bad9capacity: 510groupby: evt.Meta.source_ip11blackhole: 1m12reprocess: true13labels:14 service: http15 confidence: 316 spoofable: 017 classification:18 - attack.T111019 behavior: "http:bruteforce"20 label: "CAS Bruteforce"21 remediation: true22---23# cas user-enum24type: leaky25name: jusabatier/apereo-cas-bf_user-enum26description: "Detect CAS user enum bruteforce"27filter: evt.Meta.log_type == 'cas_failed-auth'28groupby: evt.Meta.source_ip29distinct: evt.Meta.target_user30leakspeed: 10s31capacity: 532blackhole: 1m33labels:34 service: http35 confidence: 336 spoofable: 037 classification:38 - attack.T158939 - attack.T111040 behavior: "http:bruteforce"41 label: "CAS User Enum Bruteforce"42 remediation: true43