CyberMind-FR
aeb4825b25
Pure-shell WiFi MAC address security monitor detecting randomized MACs, OUI anomalies, MAC floods, and spoofing. Integrates with CrowdSec via JSON log parsing and provides real-time hostapd hotplug detection. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
13 lines
309 B
YAML
13 lines
309 B
YAML
type: leaky
|
|
name: secubox/mac-flood
|
|
description: "Detect MAC address flood on a WiFi interface"
|
|
filter: "evt.Parsed.event_type in ['randomized_mac', 'new_station']"
|
|
groupby: "evt.Parsed.iface"
|
|
capacity: 10
|
|
leakspeed: 15s
|
|
blackhole: 5m
|
|
remediation: false
|
|
labels:
|
|
service: mac-guardian
|
|
type: wifi_mac_flood
|