Content
- Log parsers2
- Attack scenarios1
Amavis - Bruteforce ProtectionParent3 items
Amavis - Bruteforce Protection
Collection
- Version
- 0.2
- Name
- crowdsecurity/amavis
amavis support : parser and blocking scenario
Installation
sudo cscli collections install crowdsecurity/amavisThen reload CrowdSec: sudo systemctl reload crowdsec
Sign in to see which of your engines run it →Configuration
Hover a line or a note to see what each field does.
name: crowdsecurity/amavisparsers:- crowdsecurity/amavis-logs- crowdsecurity/syslog-logsscenarios:- crowdsecurity/amavis-blockeddescription: "amavis support : parser and blocking scenario"labels:label: "Amavis - Bruteforce Protection"author: crowdsecuritytags:- security_engine- clamav- amavis
Installed on
Know where it runs
Sign in to see the Security Engines that run this collection, the version they run and whether it was modified locally.
Documentation
Amavis collection
A collection for Amavis :
- amavis parser
- base scenario to ban IPs sending infected emails
Acquisition template
Example acquisition for this collection :
File based
1filenames:2 - /var/log/amavis.log3 - /var/log/maillog4labels:5 type: syslog
Journalctl based
1---2source: journalctl3journalctl_filter:4 - "SYSLOG_IDENTIFIER=amavis"5labels:6 type: syslog