cscli scenarios install crowdsecurity/http-crawl-non_staticsDetect crawl (http GET/HEAD) on non-static (jpg,css,js,etc.) http pages from a single ip.
Leakspeed of 0.5s, capacity of 40
1type: leaky2name: crowdsecurity/http-crawl-non_statics3description: "Detect aggressive crawl on non static resources"4filter: "evt.Meta.log_type in ['http_access-log', 'http_error-log'] && evt.Parsed.static_ressource == 'false' && evt.Parsed.verb in ['GET', 'HEAD']"5distinct: "evt.Parsed.file_name"6leakspeed: 0.5s7capacity: 408#debug: true9#this limits the memory cache (and event_sequences in output) to five events10cache_size: 511groupby: "evt.Meta.source_ip + '/' + evt.Parsed.target_fqdn"12blackhole: 1m13labels:14 confidence: 115 spoofable: 016 classification:17 - attack.T159518 behavior: "http:crawl"19 service: http20 label: "Aggressive Crawl"21 remediation: true22