cscli scenarios install schiz0phr3ne/prowlarr-bfDetect failed Prowlarr authentications:
1# Prowlarr bruteforce2type: leaky3name: schiz0phr3ne/prowlarr-bf4description: "Detect Prowlarr bruteforce"5filter: "evt.Meta.log_type in ['prowlarr_failed_authentication']"6leakspeed: "15s"7capacity: 58groupby: evt.Meta.source_ip9blackhole: 1m10reprocess: true11labels:12 service: prowlarr13 confidence: 314 spoofable: 015 classification:16 - attack.T111017 behavior: "http:bruteforce"18 label: "Prowlarr Bruteforce"19 remediation: true20---21# Prowlarr user enum bruteforce22type: leaky23name: schiz0phr3ne/prowlarr-bf_user-enum24description: "Detect Prowlarr user enum bruteforce"25filter: "evt.Meta.log_type in ['prowlarr_failed_authentication']"26leakspeed: "30s"27capacity: 528groupby: evt.Meta.source_ip29distinct: evt.Meta.username30blackhole: 1m31reprocess: true32labels:33 service: prowlarr34 confidence: 335 spoofable: 036 classification:37 - attack.T158938 - attack.T111039 behavior: "http:bruteforce"40 label: "Prowlarr User Enumeration"41 remediation: true42