type: leaky
name: kupidonia/ban-many-sorry
description: "Detects bots stuck in a loop or aggressively scraping the /sorry page"
filter: "evt.Meta.log_type in ['http_access-log', 'http_error-log'] and evt.Parsed.request contains '/sorry'"
groupby: "evt.Meta.source_ip"
capacity: 6
leakspeed: "2s"
blackhole: 1m
labels:
  service: http
  type: scan
  remediation: true
---
type: leaky
name: kupidonia/ban-many-sorry-8
description: "Ban bots stuck in a loop and blindly hitting the /sorry page"
filter: "evt.Meta.log_type == 'http_access-log' && evt.Meta.http_path contains '/sorry'"
groupby: "evt.Meta.source_ip"
capacity: 8
leakspeed: "1m"
blackhole: 5m
labels:
  service: http
  type: abuse
  remediation: true
---
type: leaky
name: kupidonia/ban-slow-sorry
description: "Catch low and slow bots hitting /sorry over a long period"
filter: "evt.Meta.log_type in ['http_access-log', 'http_error-log'] and evt.Parsed.request contains '/sorry'"
groupby: "evt.Meta.source_ip"
capacity: 10
leakspeed: "30m"
blackhole: 15m
labels:
  service: http
  type: crawler
  remediation: true