Openappsec 'http limit violation' detection Detection Scenario by openappsec | CrowdSec Hub

Openappsec 'http limit violation' detection

Attack scenariohttp:dosMITRE T1595MITRE T1190

By: openappsec
Version: 0.3
Name: openappsec/openappsec-http-limit-violation
Remediation: Ban

Detect openappsec 'prevent' securityActions on 'Http limit violation' events (when waf blocks malicious request)

Install with a top-level collection

1 collection include it

sudo cscli collections install openappsec/openappsec

Installs 1 parser and 20 scenarios.

View open-appsec - Log Analysis →

Installation

sudo cscli scenarios install openappsec/openappsec-http-limit-violation

Then reload CrowdSec: sudo systemctl reload crowdsec

Configuration

Hover a line or a note to see what each field does.

scenarios/openappsec/openappsec-http-limit-violation.yaml· 17 linesGitHub

1type: trigger1
2#debug: true
3name: openappsec/openappsec-http-limit-violation
4description: "Detect openappsec 'prevent' securityActions on 'Http limit violation' events (when waf blocks malicious request)"
5filter: evt.Meta.log_type == 'openappsec_security_log' and Lower(evt.Meta.security_action) in ['prevent', 'detect'] and Lower(evt.Meta.incident_type) contains 'http limit violation'2
6groupby: evt.Meta.source_ip3
7blackhole: 5m4
8labels:
9  service: http
10  classification:5
11    - attack.T1595
12    - attack.T1190
13  spoofable: 0
14  confidence: 1
15  behavior: "http:dos"
16  label: "Openappsec 'http limit violation' detection"
17  remediation: true6

Installed on

Know where it runs

Sign in to see the Security Engines that run this attack scenario, the version they run and whether it was modified locally.