Install with a top-level collection
1 collection include itsudo cscli collections install crowdsecurity/exchangeInstalls 10 parsers and 49 scenarios.
View Exchange - Bruteforce Protection →Installation
sudo cscli parsers install crowdsecurity/exchange-pop-logsThen reload CrowdSec: sudo systemctl reload crowdsec
Sign in to see which of your engines run it →Configuration
Hover a line or a note to see what each field does.
filter: "evt.Parsed.program == 'exchange-pop'"onsuccess: next_stage#debug: truename: crowdsecurity/exchange-pop-logsdescription: "Parse exchange POP logs"#dateTime,sessionId,seqNumber,sIp,cIp,user,duration,rqsize,rpsize,command,parameters,context,puid#2022-06-20T00:03:48.531Z,0000000000001E86,1,192.168.9.241:995,192.168.9.212:33526,testuser,171,21,69,auth, PLAIN,"R=""-ERR Authentication failure: unknown user name or bad password."";Msg=""AuthFailed:LogonDenied,User: testuser"";ErrMsg=AuthFailed:LogonDenied",grok:pattern: "%{TIMESTAMP_ISO8601:date},%{DATA:session_id},%{INT:sequence_number},%{IPORHOST:server_ip}:%{INT:server_port},%{IPORHOST:client_ip}:%{INT:client_port},%{DATA:username},%{INT:duration},%{INT:rqsize},%{INT:rpsize},%{WORD:command},%{DATA:parameters},%{DATA}AuthFailed:LogonDenied\",%{DATA:puid}?"apply_on: messagestatics:- target: evt.StrTimeexpression: evt.Parsed.date- meta: source_ipexpression: evt.Parsed.client_ip- meta: servicevalue: exchange- meta: log_typevalue: pop- meta: sub_typevalue: auth_fail
Installed on
Know where it runs
Sign in to see the Security Engines that run this log parser, the version they run and whether it was modified locally.