cscli scenarios install openappsec/openappsec-xxe1type: trigger2#debug: true3name: openappsec/openappsec-xxe4description: "Detect openappsec 'prevent' securityActions on 'XML External Entity' events (when waf blocks malicious request)"5filter: evt.Meta.log_type == 'openappsec_security_log' and Lower(evt.Meta.security_action) in ['prevent', 'detect'] and Lower(evt.Meta.incident_type) contains 'xml external entity'6groupby: evt.Meta.source_ip7blackhole: 5m8labels:9 confidence: 210 spoofable: 011 classification:12 - attack.T159513 - attack.T119014 behavior: "http:exploit"15 label: "Openappsec 'XML External Entity' detection"16 remediation: true17 service: http18