cscli scenarios install sdwilsh/navidrome-bfDetect failed Navidrome authentication attempts:
Note that this matches the default configuration of the
Navidrome configuration
for AuthRequestLimit and AuthRequestLength. ↩
1---2blackhole: 1m3capacity: 54description: A scenario that detects excessive login attempts per unique IP5filter: evt.Meta.log_type == 'navidrome_failed_auth'6groupby: evt.Meta.source_ip7labels:8 behavior: generic:bruteforce9 classification:10 - attack.T111011 confidence: 312 cti: true13 label: Navidrome Login Bruteforce14 remediation: true15 service: navidrome16 spoofable: 017 type: bruteforce18leakspeed: 20s19name: sdwilsh/navidrome-bf20type: leaky21