Content
- Log parsers1
- Attack scenarios1
Sympa - Generic Protection
Collection
- Version
- 0.2
- Name
- cyrille37/sympa_ww
Sympa Support : parser and http scan detection
Installation
sudo cscli collections install cyrille37/sympa_wwThen reload CrowdSec: sudo systemctl reload crowdsec
Sign in to see which of your engines run it →Configuration
Hover a line or a note to see what each field does.
name: cyrille37/sympa_wwparsers:- cyrille37/sympa_ww-logsscenarios:- cyrille37/sympa_ww-http-scandescription: "Sympa Support : parser and http scan detection"labels:label: "Sympa - Generic Protection"author: cyrille37tags:- security_engine- linux- sympa- http-scan- discovery
Installed on
Know where it runs
Sign in to see the Security Engines that run this collection, the version they run and whether it was modified locally.
Documentation
A collection to defend Sympa - Mailing List Management Software instance against common attacks:
- Sympa web service (wwsympa) parser
- Sympa http scan detection
This collection protects against HTTP scanning attempts that try to discover non-existing actions or lists. Since Sympa returns HTTP 200 responses even for non-existent resources with user-facing error messages, standard web server log analysis cannot detect these scans. This collection uses Sympa's own logs to detect and block such attempts.
Acquisition template
Example acquisition for this collection :
1---2filenames:3 - /var/log/sympa.log4labels:5 type: syslog
Or using journalctl:
1---2source: journalctl3journalctl_filter:4 - "_SYSTEMD_UNIT=wwsympa.service"5labels:6 type: syslog