cscli scenarios install schiz0phr3ne/radarr-bfDetect failed Radarr authentications:
1# Radarr bruteforce2type: leaky3name: schiz0phr3ne/radarr-bf4description: "Detect Radarr bruteforce"5filter: "evt.Meta.log_type in ['radarr_failed_authentication']"6leakspeed: "15s"7capacity: 58groupby: evt.Meta.source_ip9blackhole: 1m10reprocess: true11labels:12 service: radarr13 confidence: 314 spoofable: 015 classification:16 - attack.T111017 behavior: "http:bruteforce"18 label: "Radarr Bruteforce"19 remediation: true20---21# Radarr user enum bruteforce22type: leaky23name: schiz0phr3ne/radarr-bf_user-enum24description: "Detect Radarr user enum bruteforce"25filter: "evt.Meta.log_type in ['radarr_failed_authentication']"26leakspeed: "30s"27capacity: 528groupby: evt.Meta.source_ip29distinct: evt.Meta.username30blackhole: 1m31reprocess: true32labels:33 service: radarr34 confidence: 335 spoofable: 036 classification:37 - attack.T158938 - attack.T111039 behavior: "http:bruteforce"40 label: "Radarr User Enumeration"41 remediation: true42