Lutz Finsterle
ecca92f3ed
Since Jul 12 the stack ingests Synology DSM syslog (fids/fids2 -> Log Center -> 192.168.0.142:5514/udp), but only the published port was in the working tree and the actual config lived exclusively in the crowdsec-config named volume -- a volume reset would have silently dropped the Synology detection and the escalating ban policy. Moved into the repo and bind-mounted (single source of truth; the shadowed copies were removed from the volume): - crowdsec/acquis-synology.yaml -> acquis.d/synology.yaml (syslog listener) - crowdsec/parsers/famfihome-synology-connection.yaml -> s01-parse/ (local parser for DSM 7 "Connection" failed sign-ins -> synology-dsm-bf) - crowdsec/profiles.yaml (escalating ban (count+1)*12h, capped at 168h) Also commits the previously untracked 5514:514/udp port mapping. Verified after recreate: syslog listener bound on :514, lines arriving from 192.168.0.234, traefik access.log tail active, local parser loaded, cscli explain on a DSM sign-in failure still reaches crowdsecurity/synology-dsm-bf, 26 active decisions preserved, both bouncers pulling. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
31 lines
1.5 KiB
YAML
31 lines
1.5 KiB
YAML
name: default_ip_remediation
|
|
#debug: true
|
|
filters:
|
|
- Alert.Remediation == true && Alert.GetScope() == "Ip"
|
|
decisions:
|
|
- type: ban
|
|
duration: 12h
|
|
# Escalating ban: 1st 12h; repeat offenders (while still listed) 24h, 36h ...; capped at 168h (7d)
|
|
duration_expr: Sprintf('%dh', min((GetDecisionsCount(Alert.GetValue()) + 1) * 12, 168))
|
|
# notifications:
|
|
# - slack_default # Set the webhook in /etc/crowdsec/notifications/slack.yaml before enabling this.
|
|
# - splunk_default # Set the splunk url and token in /etc/crowdsec/notifications/splunk.yaml before enabling this.
|
|
# - http_default # Set the required http parameters in /etc/crowdsec/notifications/http.yaml before enabling this.
|
|
# - email_default # Set the required email parameters in /etc/crowdsec/notifications/email.yaml before enabling this.
|
|
on_success: break
|
|
---
|
|
name: default_range_remediation
|
|
#debug: true
|
|
filters:
|
|
- Alert.Remediation == true && Alert.GetScope() == "Range"
|
|
decisions:
|
|
- type: ban
|
|
duration: 12h
|
|
duration_expr: Sprintf('%dh', min((GetDecisionsCount(Alert.GetValue()) + 1) * 12, 168))
|
|
# notifications:
|
|
# - slack_default # Set the webhook in /etc/crowdsec/notifications/slack.yaml before enabling this.
|
|
# - splunk_default # Set the splunk url and token in /etc/crowdsec/notifications/splunk.yaml before enabling this.
|
|
# - http_default # Set the required http parameters in /etc/crowdsec/notifications/http.yaml before enabling this.
|
|
# - email_default # Set the required email parameters in /etc/crowdsec/notifications/email.yaml before enabling this.
|
|
on_success: break
|