cscli scenarios install crowdsecurity/postfix-non-smtp-commandPostfix non-SMTP commands is a log message generated when a client sends a command that is not recognized by the server. This primarily happens when a IP address is enumerating services on a machine.
1type: trigger2name: crowdsecurity/postfix-non-smtp-command3description: "Detect scanning of postfix service through non-SMTP commands"4filter: "evt.Meta.service == 'postfix' && evt.Meta.log_type_enh == 'non-smtp-command'"5groupby: evt.Meta.source_ip6blackhole: 1m7reprocess: false8labels:9 service: postfix10 remediation: true11 confidence: 312 spoofable: 013 behavior: "generic:scan"14 label: "Postfix Non-SMTP Command"