1type: trigger
2name: barnoux/crs-anomaly-score
3description: "Web exploitation detected via Core Rule Set inbound anomaly scoring set by the user in crs-setup.conf"
4filter: evt.Meta.log_type == 'modsecurity' && evt.Parsed.ruleid == '949110'
5groupby: evt.Meta.source_ip
6blackhole: 2m
7labels:
8  remediation: true
9  classification:
10    - attack.T1595
11    - attack.T1190
12  behavior: "http:exploit"
13  label: "CRS Anomaly Alert"
14  spoofable: 0
15  confidence: 2
16  service: http
17