name: default_ip_remediation
#debug: true
filters:
- Alert.Remediation == true && Alert.GetScope() == "Ip"
decisions:
- type: ban
duration: 24h
duration_expr: "Sprintf('%dh', (GetDecisionsCount(Alert.GetValue()) + 1) * 24)"
notifications:
- discord # Set the webhook in /etc/crowdsec/notifications/slack.yaml before enabling this.
on_success: break
name: default_ip_remediation
#debug: true
filters:
- Alert.Remediation == true && Alert.GetScope() == "Ip"
decisions:
- type: ban
duration: 24h
duration_expr: "Sprintf('%dh', (GetDecisionsCount(Alert.GetValue()) + 1) * 24)"
notifications:
- discord # Set the webhook in /etc/crowdsec/notifications/slack.yaml before enabling this.
on_success: break