cscli scenarios install schiz0phr3ne/sonarr-bfDetect failed Sonarr authentications:
1# Sonarr bruteforce2type: leaky3name: schiz0phr3ne/sonarr-bf4description: "Detect Sonarr bruteforce"5filter: "evt.Meta.log_type in ['sonarr_failed_authentication']"6leakspeed: "15s"7capacity: 58groupby: evt.Meta.source_ip9blackhole: 1m10reprocess: true11labels:12 service: sonarr13 confidence: 314 spoofable: 015 classification:16 - attack.T111017 behavior: "http:bruteforce"18 label: "Sonarr Bruteforce"19 remediation: true20---21# Sonarr user enum bruteforce22type: leaky23name: schiz0phr3ne/sonarr-bf_user-enum24description: "Detect Sonarr user enum bruteforce"25filter: "evt.Meta.log_type in ['sonarr_failed_authentication']"26leakspeed: "30s"27capacity: 528groupby: evt.Meta.source_ip29distinct: evt.Meta.username30blackhole: 1m31reprocess: true32labels:33 service: sonarr34 confidence: 335 spoofable: 036 classification:37 - attack.T158938 - attack.T111039 behavior: "http:bruteforce"40 label: "Sonarr User Enumeration"41 remediation: true42