appsec-rate-limit-logs

1onsuccess: next_stage1
2format: 3.0
3#debug: true
4filter: "evt.Parsed.program == 'appsec' && evt.Parsed.source == 'crowdsec-appsec-rate-limit'"2
5name: crowdsecurity/appsec-rate-limit-logs
6description: "Parse AppSec rate limit events"
7statics:3
8  - meta: service
9    value: appsec
10  - meta: log_type
11    value: appsec-rate-limit
12  - meta: source_ip
13    expression: "evt.Parsed.source_ip"
14  - meta: target_host
15    expression: "evt.Parsed.target_host"
16  - meta: request_uuid
17    expression: "evt.Parsed.req_uuid"
18  - meta: target_uri
19    expression: "evt.Parsed.target_uri"
20  - meta: http_verb
21    expression: "evt.Parsed.method"
22  - meta: http_user_agent
23    expression: "evt.Parsed.user_agent"
24  - meta: rate_limit_key
25    expression: "evt.Parsed.rate_limit_key"
26  - meta: rate_limit
27    expression: "evt.Parsed.rate_limit"
28  - meta: remediation_cmpt_ip
29    expression: "evt.Parsed.remediation_cmpt_ip"