type: trigger
name: kupidonia/ban-bad-ru-asn
description: "Instant ban for datacenter ASNs "
filter: "evt.Meta.log_type == 'http_access-log' && evt.Enriched.ASNNumber in ['9123', '12555', '50214', '61178', '214574', '208969', '35048', '205090', '213220']"
groupby: "evt.Meta.source_ip"
blackhole: 1m
labels:
  service: http
  type: ban
  remediation: true
