1type: leaky
2name: crowdsecurity/freeswitch-acl-reject
3description: "Detect freeswitch acl rejects"
4filter: "evt.Meta.service == 'freeswitch' && evt.Meta.sub_type == 'acl_reject'"
5leakspeed: "10s"
6capacity: 15
7groupby: evt.Meta.source_ip
8blackhole: 1m
9labels:
10  confidence: 3
11  spoofable: 0
12  classification:
13    - attack.T1190
14  behavior: "http:exploit"
15  label: "CVE-2018-13379"
16  remediation: true
17  service: freeswitch
18