cscli parsers install crowdsecurity/calibre-web-whitelistWhen loading the homepage of a Calibre-Web instance, requests for all book covers shown on the homepage are made (/cover/<book number>/md?c=<numbers>). Since the book covers have no extension, they are not considered static files and will trigger http-crawl-non_statics if this whitelist is not used once there are more than ~40 books shown on the homepage.
1name: crowdsecurity/calibre-web-whitelist2description: "Whitelist events from calibre-web"3filter: "evt.Meta.service == 'http' && evt.Meta.log_type in ['http_access-log', 'http_error-log']"4whitelist:5 reason: "Calibre-Web whitelist"6 expression:7 - evt.Meta.http_status in ['200', '304'] && evt.Meta.http_verb == 'GET' && evt.Meta.http_path matches '^\\/cover\\/(\\d+)\\/md\\?c=(\\d+)$' # When loading book covers8