cscli scenarios install crowdsecurity/postfix-helo-rejectedPostfix helo rejected is a log message generated when a client sends a HELO or EHLO command that is rejected by the server. This can happen for a variety of reasons, such as the client using an invalid hostname or the server being configured to reject certain types of HELO commands.
You can see the configuration for the restrictions placed on HELO commands within https://www.postfix.org/postconf.5.html#smtpd_helo_restrictions
1# postfix helo rejected because it did not match postfix restrictions2type: leaky3name: crowdsecurity/postfix-helo-rejected4description: "Detect HELO rejections"5filter: "evt.Meta.log_type == 'postfix' && evt.Meta.action == 'reject' && evt.Meta.reason startsWith 'Helo command rejected'"6references:7 - https://www.postfix.org/postconf.5.html#smtpd_helo_restrictions8groupby: evt.Meta.source_ip9capacity: 110leakspeed: 600s11blackhole: 1m12reprocess: false13labels:14 service: postfix15 remediation: true16 confidence: 217 spoofable: 018 classification:19 - attack.T159520 - attack.T159221 behavior: "smtp:spam"22 label: "Postfix Helo Rejected"23