Content
- Collections1
- Log parsers4
- Attack scenarios1
Windows - Generic ProtectionParent6 direct items · 11 with nested collections
Windows - Generic Protection
Collection
- Version
- 0.3
- Name
- crowdsecurity/windows
core windows support : windows event log + bf detection
Install with a top-level collection
1 collection include itsudo cscli collections install crowdsecurity/exchangeInstalls 10 parsers and 49 scenarios.
View Exchange - Bruteforce Protection →Installation
sudo cscli collections install crowdsecurity/windowsThen reload CrowdSec: sudo systemctl reload crowdsec
Sign in to see which of your engines run it →Configuration
Hover a line or a note to see what each field does.
name: crowdsecurity/windowsparsers:- crowdsecurity/windows-logs- crowdsecurity/windows-auth- crowdsecurity/geoip-enrich- crowdsecurity/dateparse-enrichscenarios:- crowdsecurity/windows-bfcollections:- crowdsecurity/whitelist-good-actorsdescription: "core windows support : windows event log + bf detection"labels:label: "Windows - Generic Protection"author: crowdsecuritytags:- security_engine- windows
Installed on
Know where it runs
Sign in to see the Security Engines that run this collection, the version they run and whether it was modified locally.
Documentation
Windows collection
This collection installs a parser for windows event logs + flat file, and a parser/scenario for auth bruteforce