cscli collections install crowdsecurity/supabase-supavisorDetect brute force attacks against self-hosted Supabase deployments using the Supavisor connection pooler.
1source: docker2container_name:3 - supabase-supavisor4labels:5 type: supavisor
For dynamic container names (Coolify, etc.):
1source: docker2container_name_regexp:3 - "supabase-supavisor"4 - "supabase-supavisor-.*"5labels:6 type: supavisor
| Attack Type | Log Pattern | Action |
|---|---|---|
| Wrong password | Exchange error: "Wrong password" | Block after 5 attempts |
| SSL required bypass | Tenant is not allowed to connect without SSL | Block after 5 attempts |
| Log Type | Reason |
|---|---|
| Bad startup payload | Supavisor doesn't log client IP |
| User not found | Supavisor doesn't log client IP |
This is a Supavisor logging limitation, not a CrowdSec limitation.
| Type | Name | Description |
|---|---|---|
| Parser | crowdsecurity/supavisor-logs | Parses Supavisor logs |
| Scenario | crowdsecurity/supavisor-bf | Brute force detection |