type: trigger
name: kupidonia/cap-other-countries-asn
description: "Instant captcha for datacenter ASNs of other Countries"
filter: "evt.Meta.log_type == 'http_access-log' && evt.Enriched.ASNNumber in ['24940', '55286', '203020', '5503', '43395', '3257', '134450', '212238', '8452', '12312', '212283', '3209', '132203', '200373']"
groupby: "evt.Meta.source_ip"
blackhole: 1m
labels:
  service: http
  type: captcha
  remediation: true
