type: trigger
name: kupidonia/cap-unknown-country
description: "Send unknown countries to Captcha"
filter: "evt.Meta.source_ip != '' && evt.Meta.source_ip not in ['127.0.0.1', '::1'] && evt.Enriched.IsoCode == ''"
groupby: evt.Meta.source_ip
blackhole: 1m
labels:
  service: http
  type: geo-block
  remediation: true
