type: leaky
name: kupidonia/cap-site-scan-30-10m
description: "Crawling more than 30 pages in 10 minutes"
filter: "evt.Meta.log_type == 'http_access-log' and evt.Parsed.static_resource == 'false'"
groupby: "evt.Meta.source_ip"
capacity: 30
leakspeed: "20s"
blackhole: "1m"
labels:
  service: http
  type: scan
  remediation: ban