1type: leaky
2format: 3.0
3name: crowdsecurity/appsec-native
4description: "Identify attacks flagged by CrowdSec AppSec via native rules"
5filter: "evt.Meta.log_type == 'appsec-block' && evt.Meta.rule_name startsWith 'native_rule'"
6leakspeed: "30s"
7capacity: 3
8groupby: evt.Meta.source_ip
9blackhole: 1m
10labels:
11  service: http
12  confidence: 1
13  spoofable: 0
14  classification:
15    - attack.T1110
16  label: "Blocked by CrowdSec AppSec"
17  behavior: "http:exploit"
18  remediation: true
19