#Block all from Coraza
type: trigger
name: custom/coraza-waf
description: "Ban immediately on Coraza WAF hits"
filter: "evt.Meta.log_type == 'modsecurity'"
groupby: "evt.Meta.source_ip"
blackhole: 1m
labels:
  service: http
  type: exploit
  remediation: true

