Installation
sudo cscli parsers install crowdsecurity/actual-budget-whitelistThen reload CrowdSec: sudo systemctl reload crowdsec
Sign in to see which of your engines run it →Configuration
Hover a line or a note to see what each field does.
name: crowdsecurity/actual-budget-whitelistdescription: "Whitelist events from actual budget"filter: "evt.Meta.service == 'http' && evt.Meta.log_type in ['http_access-log', 'http_error-log']"whitelist:reason: "Actual Budget whitelist"expression:- evt.Meta.http_status in ['200', '304'] && evt.Meta.http_verb == 'GET' && evt.Meta.http_path matches '^\\/data\\/migrations\\/([A-Za-z0-9\\-\\_]+)\\.sql$' # When loading database migrations
Installed on
Know where it runs
Sign in to see the Security Engines that run this log parser, the version they run and whether it was modified locally.
Documentation
Actual Budget Whitelist
Loading Database Migrations
When loading the homepage of an Actual Budget instance, even before logging in, requests for database migrations are made (/data/migrations/<migration-name>.sql). Files ending in .sql are non static files which will trigger http-crawl-non_statics and are also sensitive files which will trigger http-sensitive-files if this whitelist is not used.