type: leaky
name: kupidonia/cap-many-bukva
description: "Rate limit for /bukva/ and /bukv/ (catch slow scrapers)"
filter: "evt.Meta.log_type == 'http_access-log' and (evt.Parsed.request contains '/bukva/' or evt.Parsed.request contains '/bukv/')"
groupby: "evt.Meta.source_ip"
capacity: 15
leakspeed: "1m"
blackhole: "5m"
labels:
  service: http
  type: bruteforce
  remediation: capcha