type: trigger
name: kupidonia/cap-empty-asn
description: "Instant captcha for IPs with missing ASN"
# Проверяем, что это HTTP и поле ASN пустое (или равно нулю)
filter: "evt.Meta.service == 'http' and (evt.Enriched.ASNNumber == '' or evt.Enriched.ASNNumber == '0')"
groupby: evt.Meta.source_ip
blackhole: 1m
labels:
  service: http
  type: antispam
  remediation: captcha