cscli parsers install crowdsecurity/plex-allowlistAllowlist for Plex Media Server.
Allow events on the various transcode endpoints, timeline scrubbing and library metadata.
1name: crowdsecurity/plex-allowlist2description: "Allowlist events from Plex"3filter: "evt.Meta.service == 'http' && evt.Meta.log_type in ['http_access-log', 'http_error-log']"4whitelist:5 reason: "Plex Allowlist"6 expression:7 - evt.Meta.http_status in ['200', '206', '403', '404'] && evt.Meta.http_verb == 'GET' && evt.Meta.http_path startsWith '/video/:/transcode'8 - evt.Meta.http_status in ['200', '206', '403', '404'] && evt.Meta.http_verb == 'GET' && evt.Meta.http_path startsWith '/photo/:/transcode'9 - evt.Meta.http_status in ['200', '400', '403'] && evt.Meta.http_verb == 'GET' && evt.Meta.http_path startsWith '/:/timeline'10 - evt.Meta.http_status in ['200', '403', '404'] && evt.Meta.http_verb == 'GET' && evt.Meta.http_path startsWith '/library/metadata'11 - evt.Meta.http_status == '200' && evt.Meta.http_verb == 'GET' && evt.Meta.http_path == '/status/sessions'12 - evt.Meta.http_status == '404' && evt.Meta.http_verb == 'GET' && evt.Meta.http_path startsWith '/playQueues'13 - evt.Meta.http_status == '403' && evt.Meta.http_verb == 'POST' && evt.Parsed.request == '/log' && evt.Parsed.http_args contains 'X-Plex-Product=Plex%20Cast&X-Plex-Version='14 - evt.Meta.http_status in ['200', '206', '403', '404'] && evt.Meta.http_verb == 'GET' && evt.Meta.http_path startsWith '/music/:/transcode/universal/session'15