type: trigger
name: kupidonia/ban-dzen
description: "Block Dzen immediately except allowed URLs"
filter: |
  evt.Meta.log_type == 'http_access-log' and 
  evt.Parsed.http_referer contains 'dzen.ru' and 
  !(evt.Parsed.request contains '/otvety-' or evt.Parsed.request contains '/ezhednevnyj-test' or evt.Parsed.request contains 'for-dzen') and
  !(evt.Parsed.request matches '(?i).*\\.(css|js|jpg|jpeg|png|gif|webp|svg|ico|woff|woff2).*')
groupby: evt.Meta.source_ip
blackhole: 1m
labels:
  service: http
  type: ban
  remediation: true