type: trigger
name: kupidonia/ban-sorry-from-search
description: "/sorry from search"
filter: >
  evt.Meta.log_type == 'http_access-log' and 
  evt.Parsed.request startsWith '/sorry' and 
  (evt.Parsed.http_referer contains 'yandex.ru' or 
   evt.Parsed.http_referer contains 'google.ru' or 
   evt.Parsed.http_referer contains 'google.com' or 
   evt.Parsed.http_referer contains 'bing.ru' or 
   evt.Parsed.http_referer contains 'bing.com' or 
   evt.Parsed.http_referer contains 'dzen.ru')
labels:
  service: http
  type: bot
  remediation: true