cscli scenarios install crowdsecurity/http-bad-user-agentDetect known bad user-agents.
Bans after two requests per minute.
1type: leaky2format: 2.03#debug: true4name: crowdsecurity/http-bad-user-agent5description: "Detect usage of bad User Agent"6filter: 'evt.Meta.log_type in ["http_access-log", "http_error-log"] && RegexpInFile(evt.Parsed.http_user_agent, "bad_user_agents.regex.txt")'7data:8 - source_url: https://hub-data.crowdsec.net/web/bad_user_agents.regex.txt9 dest_file: bad_user_agents.regex.txt10 type: regexp11 strategy: LRU12 size: 4013 ttl: 10s14capacity: 115leakspeed: 1m16groupby: "evt.Meta.source_ip"17blackhole: 2m18labels:19 confidence: 120 spoofable: 021 classification:22 - attack.T159523 behavior: "http:scan"24 label: "Bad User Agent"25 service: http26 remediation: true27