Content
- Collections5
- Log parsers3
- Attack scenarios1
NPMplus - Generic ProtectionParent9 direct items · 294 with nested collections
NPMplus - Generic Protection
Collection
- By
- ZoeyVid
- Version
- 0.7
- Name
- ZoeyVid/npmplus
NPMplus support: parser and generic http scenarios
Installation
sudo cscli collections install ZoeyVid/npmplusThen reload CrowdSec: sudo systemctl reload crowdsec
Sign in to see which of your engines run it →Configuration
Hover a line or a note to see what each field does.
name: ZoeyVid/npmplusparsers:- ZoeyVid/npmplus-logs- crowdsecurity/syslog-logs- crowdsecurity/dateparse-enrichcollections:- crowdsecurity/appsec-virtual-patching- crowdsecurity/appsec-generic-rules- crowdsecurity/appsec-wordpress- crowdsecurity/base-http-scenarios- crowdsecurity/wordpressscenarios:- crowdsecurity/nginx-req-limit-exceededdescription: "NPMplus support: parser and generic http scenarios"labels:label: "NPMplus - Generic Protection"author: ZoeyVidtags:- security_engine- linux- nginx- nginx-proxy- crawl- scan
Installed on
Know where it runs
Sign in to see the Security Engines that run this collection, the version they run and whether it was modified locally.
Documentation
NPMplus collection
A collection to defend NPMplus against common attacks:
- NPMplus access log parser
- base http scenarios (crawl, 404 scan, bf)
- appsec virtual patching and generic rules
Acquisition template
Example acquisition for this collection:
1filenames:2 - /opt/npmplus/nginx/logs/access.log3labels:4 type: npmplus5---6listen_addr: 0.0.0.0:74227appsec_config: crowdsecurity/appsec-default8name: appsec9source: appsec10labels:11 type: appsec
notes:
- NPMplus only writes this log file when
LOGROTATEis set totrue - Depending on your configuration, paths to log files might change
- please read more here