cscli scenarios install crowdsecurity/dovecot-spamSpam detection for dovecot (capacity of 3 and leakspeed of 360s)
Contribution by https://github.com/LtSich
1#contribution by @ltsich2type: leaky3name: crowdsecurity/dovecot-spam4description: "Detect Dovecot bruteforce"5debug: false6filter: "evt.Meta.log_type == 'dovecot_logs' && evt.Meta.dovecot_login_result == 'auth_failed'"7groupby: evt.Meta.source_ip8capacity: 39leakspeed: "360s"10blackhole: 5m11labels:12 confidence: 313 spoofable: 014 classification:15 - attack.T111016 behavior: "pop3/imap:bruteforce"17 label: "Dovecot Bruteforce"18 service: dovecot19 remediation: true20