cscli scenarios install crowdsecurity/postfix-relay-deniedPostfix relay denied access is a log message generated when a client tries to relay an email through the server without being authorized to do so. This can happen for a variety of reasons, such as the client not being authenticated or the server not being configured to allow relaying from the client's IP address.
Many bots and spammers try to exploit open relays to send spam emails, so it's important to monitor for these types of events and take action to prevent unauthorized relaying.
1# postfix relay access denied2type: leaky3name: crowdsecurity/postfix-relay-denied4description: "Detect multiple open relay attempts"5filter: "evt.Meta.log_type == 'postfix' && evt.Meta.action == 'reject' && evt.Meta.reason == 'Relay access denied'"6references:7 - https://en.wikipedia.org/wiki/Open_mail_relay8groupby: evt.Meta.source_ip9capacity: 110leakspeed: 600s11blackhole: 1m12reprocess: false13labels:14 service: postfix15 remediation: true16 confidence: 317 spoofable: 018 classification:19 - attack.T159520 - attack.T119021 behavior: "smtp:spam"22 label: "Postfix Relay Denied"23