Fix CrowdSec GeoIP filter syntax

This commit is contained in:
ashisgreat22 2026-03-18 21:54:34 +01:00
parent c3adfa7e25
commit 4790078ff9

View file

@ -93,7 +93,7 @@ in
localConfig.profiles = [
{
name = "block_non_de";
filters = [ "Alert.Remediation == true && Alert.GetScope() == 'Ip' && Alert.Enriched.IsoCode != 'DE' && Alert.Enriched.IsoCode != ''" ];
filters = [ "Alert.Remediation == true && Alert.GetScope() == 'Ip' && Alert.Source.Cn != 'DE' && Alert.Source.Cn != ''" ];
decisions = [
{
type = "ban";