1type: leaky
2name: crowdsecurity/exim-spam
3description: "Detect spam on Exim"
4#debug: true
5filter: "evt.Meta.log_type == 'spam-attempt' && evt.Meta.service == 'exim'"
6groupby: evt.Meta.source_ip
7capacity: 3
8leakspeed: "360s"
9blackhole: 5m
10labels:
11  confidence: 3
12  spoofable: 0
13  behavior: "smtp:spam"
14  label: "Exim Spam"
15  remediation: true
16  service: smtp
17