diff --git a/modules/crowdsec.nix b/modules/crowdsec.nix
index 4b15ce9..eeba0e8 100644
--- a/modules/crowdsec.nix
+++ b/modules/crowdsec.nix
@@ -93,7 +93,7 @@ in
       localConfig.profiles = [
         {
           name = "block_non_de";
-          filters = [ "Alert.Remediation == true && Alert.GetScope() == 'Ip' && Alert.Enriched.IsoCode != 'DE' && Alert.Enriched.IsoCode != ''" ];
+          filters = [ "Alert.Remediation == true && Alert.GetScope() == 'Ip' && Alert.Source.Cn != 'DE' && Alert.Source.Cn != ''" ];
           decisions = [
             {
               type = "ban";