type: trigger
name: kupidonia/cap-all-clouds
description: "Instant captcha for ANY provider with Cloud in ASOrg name"
filter: "evt.Meta.log_type == 'http_access-log' && evt.Enriched.ASOrg matches '(?i)cloud'"
groupby: "evt.Meta.source_ip"
blackhole: 1m
labels:
  service: http
  type: captcha
  remediation: true