aykhans/my-self-host-services
1
0
Fork 0
mirror of https://github.com/aykhans/my-self-host-services.git synced 2026-08-29 02:14:34 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

crowdsec: whitelist Matrix client feature-probe 404s to stop http-probing false positives

Browse Source
This commit is contained in:
aykhans
2026-07-31 11:37:26 +00:00
parent dc27676d0f
commit e577bf7304
2 changed files with 9 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
crowdsec/docker-compose.yaml
+1
View File
@@ -41,6 +41,7 @@ services:
- ./parsers/s00-raw/stalwart-logs.yaml:/etc/crowdsec/parsers/s00-raw/stalwart-logs.yaml:ro
- ./parsers/s01-parse/stalwart-logs-extended.yaml:/etc/crowdsec/parsers/s01-parse/stalwart-logs-extended.yaml:ro
- ./parsers/s02-enrich/whitelist-trusted.yaml:/etc/crowdsec/parsers/s02-enrich/whitelist-trusted.yaml:ro
- ./parsers/s02-enrich/whitelist-matrix-client-probes.yaml:/etc/crowdsec/parsers/s02-enrich/whitelist-matrix-client-probes.yaml:ro
- ./scenarios/stalwart-smtp-bruteforce.yaml:/etc/crowdsec/scenarios/stalwart-smtp-bruteforce.yaml:ro
- ./scenarios/stalwart-auth-bruteforce.yaml:/etc/crowdsec/scenarios/stalwart-auth-bruteforce.yaml:ro
- ./scenarios/http-admin-interface-probing.yaml:/etc/crowdsec/scenarios/http-admin-interface-probing.yaml:ro
crowdsec/parsers/s02-enrich/whitelist-matrix-client-probes.yaml
+8
View File
@@ -0,0 +1,8 @@
name: aykhans/whitelist-matrix-client-probes
description: "Prevent http-probing false positives from Matrix client feature-detection 404s"
whitelist:
reason: "Matrix client MSC feature-detection and media preview requests return 404 by design (benign)"
expression:
- evt.Meta.service == 'http' and evt.Meta.http_status == '404' and evt.Meta.http_path startsWith '/_matrix/client/unstable/org.matrix.msc'
- evt.Meta.service == 'http' and evt.Meta.http_status == '404' and evt.Meta.http_path startsWith '/_matrix/client/v1/media/preview_url'
- evt.Meta.service == 'http' and evt.Meta.http_status == '404' and evt.Meta.http_path startsWith '/_matrix/client/' and evt.Meta.http_path contains '/rooms/'