Content
- Log parsers1
- Attack scenarios1
Zimbra - Bruteforce Protection
Collection
- Version
- 0.2
- Name
- firewallservices/zimbra
zimbra support : parser and spammer detection
Installation
sudo cscli collections install firewallservices/zimbraThen reload CrowdSec: sudo systemctl reload crowdsec
Sign in to see which of your engines run it →Configuration
Hover a line or a note to see what each field does.
name: firewallservices/zimbraparsers:- firewallservices/zimbra-logsscenarios:- firewallservices/zimbra-bfdescription: "zimbra support : parser and spammer detection"labels:label: "Zimbra - Bruteforce Protection"author: firewallservicestags:- security_engine- linux- spam- bruteforce- zimbra
Installed on
Know where it runs
Sign in to see the Security Engines that run this collection, the version they run and whether it was modified locally.
Documentation
Zimbra collection
A collection to parse Zimbra's logs and detect brut force on the following services
- web authentication form
- SMTP
- IMAP
Acquisition template
Example acquisition for this collection :
1filenames:2 - /opt/zimbra/log/mailbox.log3labels:4 type: zimbra
notes :
- If you are using
syslog, set type tosysloginstead - Depending on your distribution/OS, paths to log files might change
- Only relevant if you are manually installing collection