type: trigger
name: kupidonia/cap-http11
description: "Catches bots on HTTP/1.1 with fake modern User-Agent"
filter: "evt.Meta.log_type == 'http_access-log' and evt.Parsed.http_version in ['1.1', '1.0'] and evt.Parsed.http_user_agent matches 'Chrome/1[1-9][0-9]|Firefox/1[1-9][0-9]|OS 1[6-9]_|OS [2-9][0-9]_|Version/1[6-9]|Version/[2-9][0-9]'"
labels:
  service: http
  type: bot
  remediation: captcha