type: trigger
name: kupidonia/cap-empty-referer
description: "Instant captcha for empty referer"
filter: "evt.Meta.service == 'http' and (evt.Parsed.http_referer == '' or evt.Parsed.http_referer == '-')"
groupby: evt.Meta.source_ip
blackhole: 1m
labels:
  service: http
  type: antispam
  remediation: captcha
