CyberMind-FR
aeb4825b25
Pure-shell WiFi MAC address security monitor detecting randomized MACs, OUI anomalies, MAC floods, and spoofing. Integrates with CrowdSec via JSON log parsing and provides real-time hostapd hotplug detection. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
10 lines
246 B
YAML
10 lines
246 B
YAML
type: trigger
|
|
name: secubox/mac-spoof
|
|
description: "Detect MAC address spoofing on WiFi"
|
|
filter: "evt.Parsed.event_type == 'spoof_detected'"
|
|
groupby: "evt.Meta.source_mac"
|
|
remediation: false
|
|
labels:
|
|
service: mac-guardian
|
|
type: wifi_mac_spoof
|