secubox-openwrt/package/secubox/secubox-app-mac-guardian/files/etc/crowdsec/scenarios/secubox-mac-flood.yaml
CyberMind-FR 373d77368e feat(mac-guardian): Rename to secubox-app-mac-guardian and add LuCI interface
Rename package folder to follow secubox-app-* convention and add
luci-app-mac-guardian with KISS dashboard: status cards, client table
with trust/block actions, recent alerts, and configuration form.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-02-03 16:06:48 +01:00

13 lines
309 B
YAML

type: leaky
name: secubox/mac-flood
description: "Detect MAC address flood on a WiFi interface"
filter: "evt.Parsed.event_type in ['randomized_mac', 'new_station']"
groupby: "evt.Parsed.iface"
capacity: 10
leakspeed: 15s
blackhole: 5m
remediation: false
labels:
service: mac-guardian
type: wifi_mac_flood