1name: cbrandlehner/mailscanner-blacklisted
2description: Detects MailScanner logs where a message is marked as spam due to blacklisting
3type: trigger
4filter: "evt.Meta.log_type == 'mailscanner_blacklist' && evt.Parsed.spam_reason == 'blacklisted'"
5groupby: evt.Parsed.source_ip
6blackhole: 5m
7labels:
8  type: spam
9  remediation: true
10  behavior: "smtp:spam"
11  spoofable: 0
12  confidence: 2
13  label: "MailScanner detected an SMTP message from a blacklisted sender"
14  service: smtp
15
16