Content
- Log parsers1
- Attack scenarios1
- Contexts1
Iptables - Portscan DetectionParent3 items
Iptables - Portscan Detection
Collection
- Version
- 0.3
- Name
- crowdsecurity/iptables
iptables support : logs and port-scans detection scenarios
Install with a top-level collection
1 collection include itsudo cscli collections install crowdsecurity/unifiInstalls 5 parsers and 2 scenarios.
View UniFi →Installation
sudo cscli collections install crowdsecurity/iptablesThen reload CrowdSec: sudo systemctl reload crowdsec
Sign in to see which of your engines run it →Configuration
Hover a line or a note to see what each field does.
name: crowdsecurity/iptablesparsers:- crowdsecurity/iptables-logsscenarios:- crowdsecurity/iptables-scan-multi_portscontexts:- crowdsecurity/firewall_basedescription: "iptables support : logs and port-scans detection scenarios"labels:label: "Iptables - Portscan Detection"author: crowdsecuritytags:- security_engine- linux- portscan- iptables
Installed on
Know where it runs
Sign in to see the Security Engines that run this collection, the version they run and whether it was modified locally.
Documentation
Iptables/Nftables collection
A collection for portscan detection via iptables/nftables :
- iptables/nftables parser (like in
-j LOG) - multi port scan detection
Acquisition template
Example acquisition for this collection :
1filenames:2 - /var/log/kern.log3labels:4 type: syslog
Debian 12 example (without rsyslog)
1source: journalctl2journalctl_filter:3 - "-k"4labels:5 type: syslog
notes :
- Depending on your distribution/OS, paths to log files might change
- Only relevant if you are manually installing collection