cscli scenarios install crowdsecurity/ban-defcon-drop_rangeScenario to ban a range if more than 5 IPs from said range are banned less than 1 minute apart.
For this to work, two non-default things must be set:
/etc/crowdsec/profiles.yaml
1#...2---3name: default_range_remediation4filters:5 - Alert.Remediation == true && Alert.GetScope() == "Range"6decisions:7 - type: ban8 duration: 4h9on_success: break
true: This is needed for the events (generated by the scenarios) to be processed again by CrowdSec so they can trigger our crowdsecurity/ban-defcon-drop_range scenario. Most scenarios do not have this option enabled by default.1#TAP IT TWICE : if more than 5 unique IPs of a range are being banned, drop the range2type: leaky3#debug: true4name: crowdsecurity/ban-defcon-drop_range5description: "Ban a range if more than 5 ips from it are banned at a time"6#it's an overflow from a scenario that triggered a remediation ;)7filter: "evt.GetType() == 'overflow' && evt.Overflow.Alert.Remediation == true"8groupby: "evt.Overflow.Alert.Source.Range"9distinct: "evt.Overflow.Alert.Source.IP"10capacity: 511leakspeed: "1m"12blackhole: 5m13labels:14 remediation: true15scope:16 type: Range1718