secubox-openwrt/package/secubox/secubox-app-mac-guardian/files/etc/crowdsec/scenarios/secubox-mac-spoof.yaml
CyberMind-FR 373d77368e feat(mac-guardian): Rename to secubox-app-mac-guardian and add LuCI interface
Rename package folder to follow secubox-app-* convention and add
luci-app-mac-guardian with KISS dashboard: status cards, client table
with trust/block actions, recent alerts, and configuration form.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-02-03 16:06:48 +01:00

10 lines
246 B
YAML

type: trigger
name: secubox/mac-spoof
description: "Detect MAC address spoofing on WiFi"
filter: "evt.Parsed.event_type == 'spoof_detected'"
groupby: "evt.Meta.source_mac"
remediation: false
labels:
service: mac-guardian
type: wifi_mac_spoof