cscli scenarios install crowdsecurity/suricata-alertsAutomatically react to high severity alerts generated by your Suricata :
1# for max (1) priority : kill on sight2type: trigger3name: crowdsecurity/suricata-major-severity4description: "Detect exploit attempts via emerging threat rules"5filter: "evt.Meta.log_type == 'suricata_alert' && evt.Parsed.proto == 'TCP' && evt.Meta.suricata_rule_severity == '1'"6groupby: evt.Meta.source_ip7blackhole: 1m8reprocess: true9labels:10 service: suricata11 remediation: true12 confidence: 113 spoofable: 314 classification:15 - attack.T119016 - attack.T159517 behavior: "generic:exploit"18 label: "Suricata Severity 1 Event"1920---21# for lower (2) priority : wait for >=3 different signatures being triggered22# we intentionally avoid scenarios on priority 3 and such that are too sensitive to false positives23type: leaky24capacity: 225leakspeed: 20s26distinct: evt.Meta.suricata_alert_signature_id27name: crowdsecurity/suricata-high-medium-severity28description: "Detect exploit attempts via emerging threat rules"29filter: "evt.Meta.log_type == 'suricata_alert' && evt.Parsed.proto == 'TCP' && evt.Meta.suricata_rule_severity == '2'"30groupby: evt.Meta.source_ip31blackhole: 1m32reprocess: true33labels:34 service: suricata35 confidence: 136 spoofable: 337 classification:38 - attack.T119039 - attack.T159540 behavior: "generic:exploit"41 label: "Suricata Severity 2 Event"42