cscli parsers install Guezli/mailcow-f2b-bansParses ban lines emitted by Mailcow's internal netfilter-mailcow component
(Mailcow's own F2B-equivalent that lives inside the Mailcow Docker network).
Two log patterns are recognized:
| Source | Sample line | Trigger |
|---|---|---|
| Auto-ban from F2B regex | CRIT: Banning 198.51.100.42/32 for 60 minutes | regex match against Mailcow internal failure counters |
Manual perm-ban from F2B_BLACKLIST | CRIT: Added host/network 198.51.100.42 to denylist | static blacklist via Mailcow admin UI |
Extracted fields:
source_ip -- the banned IPban_duration_min -- duration in minutes (only set on auto-bans)log_type -- set to mailcow_f2b_ban for the downstream scenarioservice -- set to mailcow-f2bThe netfilter-mailcow container logs to stdout in a plain-text format
(no syslog, no JSON), so the docker acquisition tags it via labels.type:
1source: docker2container_name:3 - mailcowdockerized-netfilter-mailcow-14labels:5 type: mailcow-f2b
The parser filter then keys off evt.Parsed.program == 'mailcow-f2b',
which crowdsecurity/non-syslog populates automatically from the
acquisition labels.type.
This parser is meant to be paired with Guezli/mailcow-f2b-feed, which
turns each parsed ban event into a Crowdsec LAPI decision so the
host-side nftables-bouncer can act on Mailcow-internal bans.
1filter: "evt.Parsed.program == 'mailcow-f2b' && (evt.Parsed.message contains 'Banning' || evt.Parsed.message contains 'Added host/network')"2onsuccess: next_stage3name: Guezli/mailcow-f2b-bans4description: "Parse Mailcow netfilter-mailcow ban lines (auto-rule-trigger + manual perm-ban)"5pattern_syntax:6 # netfilter-mailcow prefixes every line with an ISO-8601-like timestamp7 # (e.g. "2026-05-09 13:50:00 CRIT: Banning ...")8 MAILCOW_F2B_TS: '%{YEAR}-%{MONTHNUM}-%{MONTHDAY} %{HOUR}:%{MINUTE}:%{SECOND}'910nodes:11 - grok:12 # Two patterns netfilter-mailcow emits as CRIT-bans:13 # "<ts> CRIT: Banning <IP>/<N> for <M> minutes" -> auto-trigger via F2B regex (CIDR-suffix present)14 # "<ts> CRIT: Added host/network <IP> to denylist" -> manual perm-ban via F2B_BLACKLIST (no CIDR-suffix)15 pattern: '%{MAILCOW_F2B_TS:ts}.*?(?:Banning|Added host/network) %{IP:banned_ip}(?:/\d+)?(?: for %{NUMBER:ban_min} minutes| to denylist)'16 apply_on: message17 statics:18 - target: evt.StrTime19 expression: evt.Parsed.ts20 - meta: source_ip21 expression: evt.Parsed.banned_ip22 - meta: log_type23 value: mailcow_f2b_ban24 - meta: ban_duration_min25 expression: evt.Parsed.ban_min26 - meta: service27 value: mailcow-f2b28