Crowdsec Generic Test Scenario
Attack scenariossh:testMITRE T1110
- Version
- 0.3
- Name
- crowdsecurity/ssh-generic-test
- Remediation
- Alert only
Crowdsec Generic Test Scenario: SSH brute force trigger
Install with a top-level collection
5 collections include itsudo cscli collections install crowdsecurity/openbsdInstalls 6 parsers and 6 scenarios, via SSHD - Bruteforce Protection.
View OpenBSD →Installation
sudo cscli scenarios install crowdsecurity/ssh-generic-testThen reload CrowdSec: sudo systemctl reload crowdsec
Sign in to see which of your engines run it →Configuration
Hover a line or a note to see what each field does.
# ssh bruteforcetype: triggername: crowdsecurity/ssh-generic-testdescription: "Crowdsec Generic Test Scenario: SSH brute force trigger"filter: "evt.Meta.log_type == 'ssh_failed-auth' && evt.Meta.target_user == 'crowdsec-test-NtktlJHV4TfBSK3wvlhiOBnl'"groupby: evt.Meta.source_ipblackhole: 1mlabels:service: sshremediation: falseconfidence: 0spoofable: 3classification:- attack.T1110behavior: "ssh:test"label: "Crowdsec Generic Test Scenario"
Installed on
Know where it runs
Sign in to see the Security Engines that run this attack scenario, the version they run and whether it was modified locally.
Documentation
ssh generic test
This scenario is meant to check if crowdsec is correctly configured, this will trigger an alert, but no decision.
On the machine one wants to test
ssh crowdsec-test-NtktlJHV4TfBSK3wvlhiOBnl@<your-ip>
You will see in your crowdsec logs:
1time="2025-06-12T16:59:45+02:00" level=info msg="Ip <your-ip> performed 'crowdsecurity/ssh-generic-test' (1 events over 0s) at 2025-06-12 14:59:45.636887959 +0000 UTC"2time="2025-06-12T16:59:46+02:00" level=info msg="(<local API login>) alert : crowdsecurity/ssh-generic-test by ip <your-ip> xxxxxx"3time="2025-06-12T16:59:47+02:00" level=info msg="Signal push: 1 signals to push"
cscli alert list will present you this alert as well. Please note that this
scenario won't trigger any decision, and result in any remediation.
If you don't see anything in logs nor in the alerts list, then you can assume an issue in your setup
Beware this WON'T work with local ips (see whitelists that are installed by default)