Update and rename custom-scenarios.yaml to windows-username-filter.yaml

plugins/scenarios/windows-username-filter.yaml

@@ -1,4 +1,3 @@
-# scanarios:
 type: trigger
 name: custom/forbidden-usernames
 description: "Block IPs attempting RDP logins with forbidden usernames"
@@ -15,21 +14,3 @@ labels:
   label: "Windows Bruteforce Username"
   remediation: true
   service: windows
-
----
-
-type: trigger
-name: custom/geoip-block-non-uk
-description: "Block traffic from non-UK IP addresses"
-filter: "evt.Enriched.IsoCode != '' && evt.Enriched.IsoCode != 'GB'"
-groupby: evt.Meta.source_ip
-reprocess: true
-labels:
-  confidence: 3
-  spoofable: 0
-  classification:
-    - network.geo-blocking
-  behavior: "windows:geo-blocking"
-  label: "Non-UK Traffic Block"
-  remediation: true
-  service: windows