community-blocklist update
I'm using the custom bouncer, is there a way to differentiate community-blocklist update decisions from all other single decision? do one of the JSON key-value pair contain a value unique to blocklist update decisions?
{
"duration": "143h58m15s",
"origin": "CAPI",
"scenario": "ssh:bruteforce",
"scope": "Ip",
"type": "ban",
"value": "160.187.109.6",
"id": 83676344,
"action": "add"
}
I would like to execute a different action on the script for blocklist updates because of the massive influx of entries. I noticed that the update is fired every 2 hours, is that correct?
6 Replies
Important Information
This post has been marked as resolved. If this is a mistake please press the red button below or type
/unresolve© Created By WhyAydan for CrowdSec ❤️
Community blocklist have
"origin": "CAPI", and update every 2 hours.beautiful, thank you
Resolving community-blocklist update
This has now been resolved. If you think this is a mistake please run
/unresolvejust for completion, the
"origin": "CAPI" is only used during blocklist update?yes as other items such as subscribed blocklists come down as
lists:<name of bl>