type: trigger
name: kupidonia/cap-honeypot
description: "Detects dumb bots appending /indev to random URLs"
filter: "evt.Meta.log_type in ['http_access-log', 'http_error-log'] && evt.Parsed.request matches '^/.+/indev([/?].*)?$'"
groupby: evt.Meta.source_ip
blackhole: 1m
labels:
  service: http
  type: capcha
  remediation: true