ipv6_to_range Postoverflow by crowdsecurity | CrowdSec Hub

ipv6_to_range

Postoverflow

By: crowdsecurity
Version: 0.1

Installation

sudo cscli postoverflows install crowdsecurity/ipv6_to_range

Then reload CrowdSec: sudo systemctl reload crowdsec

Configuration

Hover a line or a note to see what each field does.

postoverflows/s00-enrich/crowdsecurity/ipv6_to_range.yaml· 9 linesGitHub

1onsuccess: next_stage
2filter: "evt.Overflow.Alert.Remediation == true && IsIPV6(evt.Overflow.Alert.Source.IP)"1
3name: crowdsecurity/ipv6_to_range
4description: ""
5statics:
6  - target: evt.Overflow.Alert.Source.Value
7    expression: IpToRange(evt.Overflow.Alert.Source.IP, "/64")
8  - target: evt.Overflow.Alert.Source.Scope
9    value: Range

Installed on

Know where it runs

Sign in to see the Security Engines that run this postoverflow, the version they run and whether it was modified locally.

Documentation

This postoverflow check if the remediation concern an IPv6 and if yes, will change the value of the decision to the IPv6 /64 range.