Upsun - Generic Protection

Upsun collection

A collection to defend Upsun applications against common attacks:

• nginx parser (for Upsun nginx logs)
• base http scenarios (crawl, 404 scan, brute force)

This collection detects base HTTP scenarios on Upsun nginx logs sent via HTTP logs.

For more info check out the UpSun project template //todo, add

Acquisition template

Example acquisition for this collection:

1source: http
2# Change the port if necessary
3listen_addr: 127.0.0.1:8888
4path: /
5auth_type: headers
6# Choose your header name and value
7# And use them in your httplog-integration configuration
8headers:
9    crowdsecLogForward: yourHeaderHere
10labels:
11  type: upsun-httplog
12log-level: warn

notes:

• This collection is specifically designed for Upsun platform
• Supported acquisition for files and HTTP Logs
• Authentication is handled via custom headers for security
• This collection is used in the crowdsec project template: //todo, add