Content
- Log parsers2
- Attack scenarios1
Nextcloud - Bruteforce ProtectionParent3 items
Nextcloud - Bruteforce Protection
Collection
- Version
- 0.4
- Name
- crowdsecurity/nextcloud
Nextcloud support : parser and brute-force detection
Installation
sudo cscli collections install crowdsecurity/nextcloudThen reload CrowdSec: sudo systemctl reload crowdsec
Sign in to see which of your engines run it →Configuration
Hover a line or a note to see what each field does.
name: crowdsecurity/nextcloudparsers:- crowdsecurity/nextcloud-logs- crowdsecurity/nextcloud-whitelistscenarios:- crowdsecurity/nextcloud-bfdescription: "Nextcloud support : parser and brute-force detection"labels:label: "Nextcloud - Bruteforce Protection"author: crowdsecuritytags:- security_engine- linux- bruteforce- nextcloud
Installed on
Know where it runs
Sign in to see the Security Engines that run this collection, the version they run and whether it was modified locally.
Documentation
A collection to defend Nextcloud instance against common attacks :
- Nextcloud parser
- Nextcloud bruteforce, enumeration and trusted domain detection
Contributed by Håvard Moen and a1ad
Acquisition template
Example acquisition for this collection :
1---2filenames:3 - /var/www/nextcloud/data/nextcloud.log4labels:5 type: Nextcloud
1---2source: journalctl3journalctl_filter:4 - "SYSLOG_IDENTIFIER=Nextcloud"5labels:6 type: syslog
- Use the filename version if you have the default setting of logging to file
- Use the journalctl version if you are sending logs to syslog or systemd and read the logs from journald