1type: leaky
2name: crowdsecurity/iptables-scan-multi_ports
3description: "Detect aggressive portscans"
4filter: "evt.Meta.log_type == 'iptables_drop' && evt.Meta.service == 'tcp'"
5groupby: evt.Meta.source_ip
6distinct: evt.Parsed.dst_port
7capacity: 15
8leakspeed: 5s
9blackhole: 1m
10labels:
11  remediation: true
12  classification:
13    - attack.T1595.001
14    - attack.T1018
15    - attack.T1046
16  behavior: "tcp:scan"
17  label: "TCP Port Scan"
18  spoofable: 3
19  confidence: 1
20