1name: crowdsecurity/seo-bots-whitelist
2description: "Whitelist good search engine crawlers"
3whitelist:
4  reason: "good bots (search engine crawlers)"
5  expression: 
6    - "any(File('rdns_seo_bots.txt'), { len(#) > 0 && evt.Enriched.reverse_dns endsWith #})"
7    - "RegexpInFile(evt.Enriched.reverse_dns, 'rdns_seo_bots.regex')"
8    - "any(File('ip_seo_bots.txt'), { len(#) > 0 && IpInRange(evt.Overflow.Alert.Source.IP ,#)})"
9data:
10  - source_url: https://hub-data.crowdsec.net/whitelists/benign_bots/search_engine_crawlers/rdns_seo_bots.txt
11    dest_file: rdns_seo_bots.txt
12    type: string
13  - source_url: https://hub-data.crowdsec.net/whitelists/benign_bots/search_engine_crawlers/rnds_seo_bots.regex
14    dest_file: rdns_seo_bots.regex
15    type: regexp
16  - source_url: https://hub-data.crowdsec.net/whitelists/benign_bots/search_engine_crawlers/ip_seo_bots.txt
17    dest_file: ip_seo_bots.txt
18    type: string