cscli scenarios install plague-doctor/sharry-bfDetect failed Sharry authentications:
1# Sharry bruteforce2type: leaky3name: plague-doctor/sharry-bf4description: "Detect Sharry bruteforce attacks"5filter: "evt.Meta.service == 'sharry' && evt.Meta.log_type == 'sharry_failed_auth'"6leakspeed: 20s7capacity: 48groupby: evt.Meta.source_ip9blackhole: 1m10reprocess: true11labels:12 service: sharry13 type: bruteforce14 classification:15 - attack.T111016 remediation: true17 behavior: http:bruteforce18 spoofable: 019 confidence: 32021