cscli scenarios install crowdsecurity/amavis-blockedThis amavis scenario bans an IP as soon as it is detected sending messages that have been blocked by amavis.
1type: trigger2name: crowdsecurity/amavis-blocked3description: "Ban IPs that are blocked by amavis"4filter: evt.Meta.log_type == 'amavis' && evt.Parsed.amavis_action == 'Blocked' && evt.Parsed.amavis_category == 'INFECTED'5groupby: evt.Meta.source_ip6blackhole: 5m7labels:8 service: amavis9 confidence: 310 spoofable: 011 classification:12 - attack.T120313 - attack.T120414 behavior: "mail:malware"15 label: "Infected Email"16 remediation: true17