type: trigger
name: kupidonia/ban-saelmon-bot
description: "Мгновенный бан для бота saelmon"
filter: "evt.Meta.log_type == 'http_access-log' and evt.Parsed.http_user_agent contains 'saelmon'"
groupby: "evt.Meta.source_ip"
blackhole: "1m"
labels:
  service: http
  type: bot
  remediation: true