type: trigger
name: kupidonia/ban-datacenters-by-name
description: "Instant ban for hosting and cloud providers"
filter: "'ASNOrg' in evt.Enriched and evt.Enriched.ASNOrg matches '(?i).*(Biterika|WINDSTREAM|HOSTING|DigitalOcean|Hetzner|Amazon|AMAZON|Linode|Contabo|EGIHOSTING).*'"
groupby: "evt.Meta.source_ip"
blackhole: 1m
labels:
  service: http
  type: ban
  remediation: true