1name: cbrandlehner/mailscanner-highscore-spam
2description: Detects spam messages in MailScanner logs with score > 20.0
3type: leaky
4filter: "evt.Meta.log_type == 'mailscanner_spam' && float(evt.Parsed.spam_score) > 20.0"
5groupby: evt.Parsed.source_ip
6leakspeed: 10s
7capacity: 1
8blackhole: 5m
9labels:
10  type: spam
11  remediation: true
12  behavior: "smtp:spam"
13  spoofable: 0
14  confidence: 1
15  label: "MailScanner classified an SMTP email as SPAM with a spam_score higher 20"
16  service: smtp
17
18