Content
- Log parsers1
- Attack scenarios1
Installation
sudo cscli collections install a1ad/meshcentralThen reload CrowdSec: sudo systemctl reload crowdsec
Sign in to see which of your engines run it →Configuration
Hover a line or a note to see what each field does.
parsers:- a1ad/meshcentral-logsscenarios:- a1ad/meshcentral-bfdescription: "Meshcentral support : parser and brute-force detection"author: a1adtags:- linux- brute-force- meshcentral
Installed on
Know where it runs
Sign in to see the Security Engines that run this collection, the version they run and whether it was modified locally.
Documentation
A collection to defend Meshcentral instance against common attacks :
- Meshcentral parser
- Meshcentral bruteforce detection
Acquisition template
Example acquisition for this collection :
You need to add the following in the Meshcentral config file before Meshcentral starts logging: "authLog": "/opt/meshcentral/meshcentral-data/auth.log"
1---2filenames:3 - /opt/meshcentral/meshcentral-data/auth.log4labels:5 type: meshcentral
For Docker directly
1---2source: docker3container_name:4 - meshcentral5#container_id:6# - 843ee92d231b7labels:8 type: meshcentral