cscli collections install cyrille37/sympa_wwA collection to defend Sympa - Mailing List Management Software instance against common attacks:
This collection protects against HTTP scanning attempts that try to discover non-existing actions or lists. Since Sympa returns HTTP 200 responses even for non-existent resources with user-facing error messages, standard web server log analysis cannot detect these scans. This collection uses Sympa's own logs to detect and block such attempts.
Example acquisition for this collection :
1---2filenames:3 - /var/log/sympa.log4labels:5 type: syslog
Or using journalctl:
1---2source: journalctl3journalctl_filter:4 - "_SYSTEMD_UNIT=wwsympa.service"5labels:6 type: syslog