Files
my-self-host-services/crowdsec/profiles/profiles.yaml
T

19 lines
489 B
YAML

name: default_ip_remediation
filters:
- Alert.Remediation == true && Alert.GetScope() == "Ip"
duration_expr: Sprintf('%dh', min(730, (GetDecisionsCount(Alert.GetValue())+1)*4))
decisions:
- type: ban
duration: 4h
on_success: break
---
name: default_range_remediation
filters:
- Alert.Remediation == true && Alert.GetScope() == "Range"
duration_expr: Sprintf('%dh', min(730, (GetDecisionsCount(Alert.GetValue())+1)*4))
decisions:
- type: ban
duration: 4h
on_success: break