type: trigger
name: kupidonia/cap-pikabu
description: "Instant captcha for pikabu.ru links"
filter: |
  evt.Meta.log_type == 'http_access-log' and 
  evt.Parsed.http_referer contains 'pikabu.ru' and 
  not (evt.Parsed.request matches '(?i).*\\.(css|js|jpg|jpeg|png|gif|webp|svg|ico|woff|woff2).*')
groupby: evt.Meta.source_ip
blackhole: 1m
labels:
  service: http
  type: antispam
  remediation: captcha