Install with a top-level collection
1 collection include itsudo cscli collections install crowdsecurity/exchangeInstalls 10 parsers and 49 scenarios.
View Exchange - Bruteforce Protection →Installation
sudo cscli parsers install crowdsecurity/exchange-imap-logsThen reload CrowdSec: sudo systemctl reload crowdsec
Sign in to see which of your engines run it →Configuration
Hover a line or a note to see what each field does.
filter: "evt.Parsed.program == 'exchange-imap'"onsuccess: next_stage#debug: truename: crowdsecurity/exchange-imap-logsdescription: "Parse exchange IMAP logs"#dateTime,sessionId,seqNumber,sIp,cIp,user,duration,rqsize,rpsize,command,parameters,context,puid#2022-06-16T09:41:21.094Z,000000000000004B,2,192.168.9.241:993,192.168.9.212:49016,foobar,34,31,31,authenticate,PLAIN,"R=""2 NO AUTHENTICATE failed."";Msg=""AuthFailed:LogonDenied,User: foobar"";ErrMsg=AuthFailed:LogonDenied",grok:pattern: "%{TIMESTAMP_ISO8601:date},%{DATA:session_id},%{INT:sequence_number},%{IPORHOST:server_ip}:%{INT:server_port},%{IPORHOST:client_ip}:%{INT:client_port},%{DATA:username},%{INT:duration},%{INT:rqsize},%{INT:rpsize},%{WORD:command},%{DATA:parameters},%{DATA}AuthFailed:LogonDenied\",%{DATA:puid}?"apply_on: messagestatics:- target: evt.StrTimeexpression: evt.Parsed.date- meta: source_ipexpression: evt.Parsed.client_ip- meta: servicevalue: exchange- meta: log_typevalue: imap- meta: sub_typevalue: auth_fail
Installed on
Know where it runs
Sign in to see the Security Engines that run this log parser, the version they run and whether it was modified locally.