cscli scenarios install timokoessler/gitlab-bfDetect failed GitLab authentications:
1# gitlab bruteforce2type: leaky3name: timokoessler/gitlab-bf4description: "Detect gitlab bruteforce"5filter: "evt.Meta.log_type in ['gitlab_failed_password', 'gitlab_failed_totp']"6leakspeed: "20s"7capacity: 58groupby: evt.Meta.source_ip9blackhole: 1m10reprocess: true11labels:12 service: gitlab13 behavior: "vcs:bruteforce"14 classification:15 - attack.T111016 spoofable: 017 confidence: 318 label: "Gitlab Bruteforce"19 remediation: true20---21# gitlab user enum bruteforce22type: leaky23name: timokoessler/gitlab-bf_user-enum24description: "Detect gitlab user enum bruteforce"25filter: "evt.Meta.log_type == 'gitlab_failed_password'"26leakspeed: "40s"27capacity: 528groupby: evt.Meta.source_ip29distinct: evt.Meta.username30blackhole: 1m31reprocess: true32labels:33 service: gitlab34 behavior: "vcs:bruteforce"35 classification:36 - attack.T158937 - attack.T111038 spoofable: 039 confidence: 340 label: "Gitlab User Enumeration"41 remediation: true42