Hub configuration

Name: CRS Anomaly Alert
Author: barnoux

More info

CRS Anomaly Alert Detection Scenario by barnoux | CrowdSec Hub

« CRS Anomaly Alert »
v0.1 by barnoux / crs-anomaly-score
Attack scenariohttpNot spoofableMedium confidence

Web exploitation detected via Core Rule Set inbound anomaly scoring set by the user in crs-setup.conf

Installation

cscli scenarios install barnoux/crs-anomaly-score

YAML Configuration

1type: trigger
2name: barnoux/crs-anomaly-score
3description: "Web exploitation detected via Core Rule Set inbound anomaly scoring set by the user in crs-setup.conf"
4filter: evt.Meta.log_type == 'modsecurity' && evt.Parsed.ruleid == '949110'
5groupby: evt.Meta.source_ip
6blackhole: 2m
7labels:
8  remediation: true
9  classification:
10    - attack.T1595
11    - attack.T1190
12  behavior: "http:exploit"
13  label: "CRS Anomaly Alert"
14  spoofable: 0
15  confidence: 2
16  service: http
17

Hub configuration

« CRS Anomaly Alert »v0.1 by barnoux / crs-anomaly-scoreAttack scenariohttpNot spoofableMedium confidenceMITRE:T1595MITRE:T1190

« CRS Anomaly Alert »
v0.1 by barnoux / crs-anomaly-score
Attack scenariohttpNot spoofableMedium confidence