Comments (3)
Thinking more about it I believe the "client denied by server configuration" errors should belong to the crowdsecurity/http-crawl-non_statics
or crowdsecurity/http-probing
. Fail2ban does not make the distinction and catch them with apache-auth plugin.
Crowdsec could benefit from #51 to detect a login/password brute force with specific error log messages.
from hub.
Hello @ririsoft
Thanks for you feedback!
A PR has been opened and is in work in progress about this issue which add/fix the following things:
- apache2 errors log support
- add a generic http brute force detection scenario
Note: Once the PR will be merged, those change will only be available for the crowdsec >= v1 which is currently in pre-release.
About the access.log
that you shared, it is normal that the IP has not been detected by crowdsec
.
Indeed, we can see that the attacker only try to access to 5 files, and then come back hours later.
As we can see in the crowdsecurity/http-probing
configuration, the bucket capacity is 10, so it can't overflow .
Last thing, i think that if the http_probing
scenario is not triggered, it's because your access.log are not parsed. I can help you to parse them in #52
I hope i answered your question,
from hub.
@AlteredCoder Are there plans to link those to a scenario? As of now it gets detected but not remediated because sub_type "permission_denied" is not linked to a scenario afaik.
from hub.
Related Issues (20)
- [http-logs] Should check for HTTP verb?
- ssh-bf are not detected when AllowUsers are defined HOT 1
- [nextcloud-whitelist] Not fully working with HAProxy because of http_verb HOT 1
- http-probing - Nextcloud false positive HOT 2
- Mysql logs are not parsed on my Server - Solution HOT 1
- [blackhole] Groupby should be set on every blackhole sceanario
- Grafana logs are not parsed correctly when using LePresidente/grafana HOT 1
- Authelia parser is still using jsonextract it should be changed UnmarshalJSON
- [ModSecurity] Parser wont parse
- CI: validate .index.json
- Incorrect regular expression in crowdsecurity/exim-logs HOT 2
- Add http_referer to the http_base.yaml context HOT 3
- [UnmarshalJSON] check if line startsWith `{` HOT 1
- crowdsecurity/nginx-proxy-manager-logs parser failure HOT 2
- Vaultwarden parser doesn't handle time zones HOT 2
- Personal Git repo support? HOT 2
- False positive http-crawl-non_statics with Nextcloud Deck mobile app HOT 7
- Whitelist Good Actors - WP Rocket HOT 1
- Caddy Log Parser : client ip is not parsed HOT 1
- New version of OWASP CRS breaks the Modsecurity parser HOT 2
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from hub.