cscli scenarios install crowdsecurity/supavisor-bfDetects brute force attacks against PostgreSQL databases through the Supavisor connection pooler.
This scenario triggers when multiple authentication failures are detected from the same IP address. It detects wrong password attempts via Supavisor's auth_query authentication method.
| Parameter | Value | Description |
|---|---|---|
capacity | 5 | Failed attempts before triggering |
leakspeed | 30s | Time window for counting |
blackhole | 5m | Cooldown after trigger |
| Label | Value |
|---|---|
confidence | 3 |
spoofable | 0 |
classification | attack.T1110 |
remediation | true |
1source: docker2container_name_regexp:3 - "supabase-supavisor"4 - "supabase-supavisor-.*"5labels:6 type: supavisor
1type: leaky2name: crowdsecurity/supavisor-bf3description: "Detect brute force attacks against PostgreSQL via Supavisor connection pooler"4filter: evt.Meta.log_type == 'supavisor_auth_fail'5groupby: evt.Meta.source_ip6capacity: 57leakspeed: 30s8blackhole: 5m9labels:10 service: supavisor11 confidence: 312 spoofable: 013 classification:14 - attack.T111015 behavior: "database:bruteforce"16 label: "Supavisor bruteforce"17 remediation: true18