cscli postoverflows install crowdsecurity/rdnsThis will use reverse_dns method to enrich an event with the reverse dns of the IP if it exists.
1onsuccess: next_stage2filter: "evt.Overflow.Alert.GetScope() == 'Ip'"3name: crowdsecurity/rdns4description: "Lookup the DNS associated to the source IP only for overflows"5statics:6 - method: reverse_dns7 expression: evt.Overflow.Alert.Source.IP8 - meta: reverse_dns9 expression: evt.Enriched.reverse_dns10