cscli scenarios install timokoessler/uptime-kuma-bfDetect failed Uptime Kuma authentications:
1# Uptime Kuma bruteforce2type: leaky3name: timokoessler/uptime-kuma-bf4description: "Detect Uptime Kuma bruteforce"5filter: "evt.Meta.log_type in ['uptime_kuma_failed_password', 'uptime_kuma_failed_totp']"6leakspeed: "15s"7capacity: 58groupby: evt.Meta.source_ip9blackhole: 1m10reprocess: true11labels:12 service: uptime-kuma13 classification:14 - attack.T111015 behavior: "http:bruteforce"16 label: "Uptime Kuma Bruteforce"17 spoofable: 018 confidence: 319 remediation: true20---21# Uptime Kuma user enum bruteforce22type: leaky23name: timokoessler/uptime-kuma-bf_user-enum24description: "Detect Uptime Kuma user enum bruteforce"25filter: "evt.Meta.log_type in ['uptime_kuma_failed_password', 'uptime_kuma_failed_totp']"26leakspeed: "30s"27capacity: 528groupby: evt.Meta.source_ip29distinct: evt.Meta.username30blackhole: 1m31reprocess: true32labels:33 service: uptime-kuma34 classification:35 - attack.T158936 - attack.T111037 behavior: "http:bruteforce"38 label: "Uptime Kuma User Enumeration"39 spoofable: 040 confidence: 341 remediation: true42