type: trigger
name: kupidonia/ban-countries
description: "Block traffic from countries"
filter: "evt.Enriched.IsoCode in ['CN', 'IN', 'VN', 'SG', 'KR', 'ID', 'HK', 'TW', 'TH', 'MY', 'PH', 'PK', 'TW', 'BR', 'NG', 'EG']"
groupby: evt.Meta.source_ip
blackhole: 1m
labels:
  type: geo-block
  remediation: true