aykhans/my-self-host-services
1
0 Fork 0
mirror of https://github.com/aykhans/my-self-host-services.git synced 2026-10-17 20:43:52 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

crowdsec: whitelist first-party client false positives (Matrix media/rooms, DAV auth)

Browse Source
This commit is contained in:
aykhans committed 2026-08-05 08:10:02 +00:00
1 parent e577bf7304
commit 175e3b4416
3 files changed
+13 -3
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

crowdsec/parsers/s02-enrich/whitelist-dav-auth-challenge.yaml
+6
View File
@@ -0,0 +1,6 @@
name: aykhans/whitelist-dav-auth-challenge
description: "Prevent http-generic-bf false positives from DAV clients' auth-challenge 401s"
whitelist:
reason: "CalDAV/CardDAV/WebDAV clients (Thunderbird etc.) send an unauthenticated PROPFIND and get 401 by design; real DAV auth brute-force is still covered by the Stalwart auth-bruteforce scenario reading Stalwart's own logs"
expression:
- evt.Meta.service == 'http' and evt.Meta.http_status == '401' and evt.Meta.http_path startsWith '/dav/'