#cscli decisions list | grep "kupidonia/ban-smart-bot-"
#cscli decisions list | grep -E "ID|kupidonia/ban-smart-bot-"
type: leaky
name: kupidonia/ban-smart-bot-many-page-1
description: "Detects aggressive scraping through deep pagination"
filter: "evt.Meta.log_type == 'http_access-log' && evt.Parsed.request contains '/s/'"
groupby: "evt.Meta.source_ip"
capacity: 15
leakspeed: "30s"
blackhole: 10m
labels:
  service: http
  type: scan
  remediation: true
---
type: leaky
name: kupidonia/ban-smart-bot-many-page-2
description: "Detects aggressive scraping through deep pagination"
filter: "evt.Meta.log_type == 'http_access-log' && evt.Parsed.request contains '/s/'"
groupby: "evt.Meta.source_ip"
capacity: 20
leakspeed: "1m"
blackhole: 10m
labels:
  service: http
  type: scan
  remediation: true
---
type: leaky
name: kupidonia/ban-smart-bot-many-page-3
description: "Detects aggressive scraping through deep pagination"
filter: "evt.Meta.log_type == 'http_access-log' && evt.Parsed.request contains '/s/'"
groupby: "evt.Meta.source_ip"
capacity: 40
leakspeed: "160s"
blackhole: 10m
labels:
  service: http
  type: scan
  remediation: true
---
type: leaky
name: kupidonia/ban-smart-bot-rotator-user-agent
description: "Detects IPs rotating multiple different User-Agents"
filter: "evt.Meta.log_type == 'http_access-log' && evt.Parsed.http_user_agent != ''"
groupby: "evt.Meta.source_ip"
distinct: "evt.Parsed.http_user_agent"
capacity: 6
leakspeed: "24h"
blackhole: "1h"
labels:
  service: http
  type: scraper
  remediation: captcha
---
type: trigger
name: kupidonia/ban-smart-bot-wordpress-scanner
description: "Instantly bans IPs looking for WordPress specific files/paths"
# Ищем совпадения: в URL есть куски wp-admin, wp-login и т.д., или xmlrpc.php
filter: "evt.Meta.log_type == 'http_access-log' && (evt.Parsed.request matches '(?i).*wp-(admin|login|content|includes|config).*' || evt.Parsed.request contains 'xmlrpc.php')"
groupby: "evt.Meta.source_ip"
blackhole: "1h"
labels:
  service: http
  type: exploit
  remediation: ban
---
type: leaky
name: kupidonia/ban-smart-bot-many-404
description: "Detects IPs generating too many 404 Not Found errors"
filter: 'evt.Meta.log_type == "http_access-log" && evt.Parsed.status == "404" && not (evt.Parsed.request matches "(?i)\\.(jpg|jpeg|png|gif|css|js|ico|webp|svg|woff2?)(\\?.*)?$")'
groupby: "evt.Meta.source_ip"
capacity: 20
leakspeed: "10s"
blackhole: "1h"
labels:
  service: http
  type: scan
  remediation: ban
---
type: trigger
name: kupidonia/cap-mac-chrome146
description: "Send fake Mac OS + Chrome 146 bots to CAPTCHA"
filter: evt.Meta.service == 'http' and evt.Parsed.http_user_agent contains 'Mac OS X 10_15_7' and (evt.Parsed.http_user_agent contains 'Chrome/146.0.0.0' or evt.Parsed.http_user_agent contains 'Chrome/148.0.0.0')
groupby: evt.Meta.source_ip
blackhole: 2m
labels:
  service: http
  type: antispam
  remediation: captcha
---
type: trigger
name: custom/captcha-all-mac10-15-7
description: "Send ALL Mac OS X 10_15_7 traffic to CAPTCHA"
filter: >
  evt.Meta.service == 'http' and 
  evt.Parsed.http_user_agent contains 'Mac OS X 10_15_7'
groupby: evt.Meta.source_ip
blackhole: 2m
labels:
  service: http
  type: antispam
  remediation: captcha