type: leaky
name: kupidonia/cap-many-spisok
description: "Rate limit for /spisok/ and /spiski/ (catch slow scrapers)"
filter: "evt.Meta.log_type == 'http_access-log' and (evt.Parsed.request contains '/spisok/' or evt.Parsed.request contains '/spiski/')"
groupby: "evt.Meta.source_ip"
capacity: 15
leakspeed: "1m"
blackhole: "5m"
labels:
  service: http
  type: bruteforce
  remediation: capcha
---
type: leaky
name: kupidonia/cap-many-spisok-20
description: "Detects slow scrapers reading more than 20 /spisok/ pages per hour"
filter: "evt.Meta.log_type in ['http_access-log', 'http_error-log'] and evt.Parsed.request contains '/spisok/'"
groupby: "evt.Meta.source_ip"
capacity: 20
leakspeed: "3m"
blackhole: 15m
labels:
  service: http
  type: scraper
  remediation: true