Crowdsec Generic Test Scenario for AppSec Detection Scenario by crowdsecurity | CrowdSec Hub

Crowdsec Generic Test Scenario for AppSec

Attack scenariohttp:test

By: crowdsecurity
Version: 0.2
Name: crowdsecurity/appsec-generic-test
Remediation: Alert only

Crowdsec Generic Test Scenario for AppSec: generate an alert for appsec out of band rule for testing

Install with a top-level collection

1 collection include it

sudo cscli collections install ZoeyVid/npmplus

Installs 5 parsers and 54 scenarios, via WAF - Generic Rules.

View NPMplus →

Installation

sudo cscli scenarios install crowdsecurity/appsec-generic-test

Then reload CrowdSec: sudo systemctl reload crowdsec

Configuration

Hover a line or a note to see what each field does.

scenarios/crowdsecurity/appsec-generic-test.yaml· 14 linesGitHub

1type: trigger1
2format: 3.0
3name: crowdsecurity/appsec-generic-test
4description: "Crowdsec Generic Test Scenario for AppSec: generate an alert for appsec out of band rule for testing"
5filter: "evt.Meta.log_type == 'appsec-info' && evt.Meta.rule_name == 'crowdsecurity/appsec-generic-test'"2
6groupby: evt.Meta.source_ip3
7blackhole: 1m4
8labels:
9  confidence: 0
10  spoofable: 3
11  behavior: "http:test"
12  label: "Crowdsec Generic Test Scenario for AppSec"
13  service: http
14  remediation: false5

Installed on

Know where it runs

Sign in to see the Security Engines that run this attack scenario, the version they run and whether it was modified locally.