2020-05-15 09:39:16 +00:00
|
|
|
profile: default_remediation
|
2020-07-02 09:44:27 +00:00
|
|
|
filter: "sig.Labels.remediation == 'true' && not sig.Whitelisted"
|
2020-05-15 09:39:16 +00:00
|
|
|
api: true # If no api: specified, will use the default config in default.yaml
|
|
|
|
|
remediation:
|
|
|
|
|
ban: true
|
|
|
|
|
slow: true
|
|
|
|
|
captcha: true
|
|
|
|
|
duration: 4h
|
|
|
|
|
outputs:
|
2020-07-16 14:05:03 +00:00
|
|
|
- plugin: database
|
2020-05-15 09:39:16 +00:00
|
|
|
---
|
|
|
|
|
profile: default_notification
|
|
|
|
|
filter: "sig.Labels.remediation != 'true'"
|
|
|
|
|
#remediation is empty, it means non taken
|
|
|
|
|
api: false
|
|
|
|
|
outputs:
|
2020-07-16 14:05:03 +00:00
|
|
|
- plugin: database # If we do not want to push, we can remove this line and the next one
|
2020-05-15 09:39:16 +00:00
|
|
|
store: false
|
2020-07-02 09:44:27 +00:00
|
|
|
---
|
|
|
|
|
profile: send_false_positif_to_API
|
|
|
|
|
filter: "sig.Whitelisted == true && sig.Labels.remediation == 'true'"
|
|
|
|
|
#remediation is empty, it means non taken
|
|
|
|
|
api: true
|
|
|
|
|
outputs:
|
2020-07-16 14:05:03 +00:00
|
|
|
- plugin: database # If we do not want to push, we can remove this line and the next one
|
2020-07-02 09:44:27 +00:00
|
|
|
store: false
|
