Fix CrowdSec GeoIP filter syntax
This commit is contained in:
parent
c3adfa7e25
commit
4790078ff9
1 changed files with 1 additions and 1 deletions
|
|
@ -93,7 +93,7 @@ in
|
|||
localConfig.profiles = [
|
||||
{
|
||||
name = "block_non_de";
|
||||
filters = [ "Alert.Remediation == true && Alert.GetScope() == 'Ip' && Alert.Enriched.IsoCode != 'DE' && Alert.Enriched.IsoCode != ''" ];
|
||||
filters = [ "Alert.Remediation == true && Alert.GetScope() == 'Ip' && Alert.Source.Cn != 'DE' && Alert.Source.Cn != ''" ];
|
||||
decisions = [
|
||||
{
|
||||
type = "ban";
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue