cscli scenarios install openappsec/openappsec-ldap-injection1type: trigger2debug: false3name: openappsec/openappsec-ldap-injection4description: "Detect openappsec 'prevent' securityActions on 'LDAP Injection' events (when waf blocks malicious request)"5filter: evt.Meta.log_type == 'openappsec_security_log' and Lower(evt.Meta.security_action) in ['prevent', 'detect'] and Lower(evt.Meta.incident_type) contains 'ldap injection'6groupby: evt.Meta.source_ip7blackhole: 5m8labels:9 service: http10 classification:11 - attack.T159512 - attack.T119013 spoofable: 014 confidence: 215 behavior: "http:exploit"16 label: "Openappsec 'ldap injection' detection"17 remediation: true18