Install with a top-level collection
1 collection include itsudo cscli collections install crowdsecurity/exchangeInstalls 10 parsers and 49 scenarios.
View Exchange - Bruteforce Protection →Installation
sudo cscli parsers install crowdsecurity/exchange-smtp-logsThen reload CrowdSec: sudo systemctl reload crowdsec
Sign in to see which of your engines run it →Configuration
Hover a line or a note to see what each field does.
filter: "evt.Parsed.program == 'exchange-smtp'"onsuccess: next_stage#debug: truename: crowdsecurity/exchange-smtp-logsdescription: "Parse exchange SMTP logs"#date-time,connector-id,session-id,sequence-number,local-endpoint,remote-endpoint,event,data,context#2022-04-28T13:24:50.200Z,EXCHANGE-1\Default Frontend EXCHANGE-1,08DA28A9AF671267,15,192.168.9.241:25,192.168.9.212:28657,>,535 5.7.3 Authentication unsuccessful,grok:pattern: "%{TIMESTAMP_ISO8601:date},%{DATA:connector_id},%{DATA:session_id},%{INT:sequence_number},%{IPORHOST:server_ip}:%{INT:server_port},%{IPORHOST:client_ip}:%{INT:client_port},%{DATA:event},%{INT:smtp_code} [^ ]+ %{DATA:smtp_message},"apply_on: messagestatics:- target: evt.StrTimeexpression: evt.Parsed.date- meta: source_ipexpression: evt.Parsed.client_ip- meta: smtp_messageexpression: evt.Parsed.smtp_message- meta: servicevalue: exchange- meta: log_typevalue: smtp- meta: sub_typevalue: auth_fail
Installed on
Know where it runs
Sign in to see the Security Engines that run this log parser, the version they run and whether it was modified locally.
Documentation
A parser for exchange SMTP protocol logs.