Crowdsec-Stuff/notes.md

Whitelist by AS Number

Redit post source

#/etc/crowdsec/postoverflows/s01-whitelist/asn-whitelist.yaml
name: zz-whitelist-ASN
description: Whitelist some ASN
#debug: true
whitelist:
  reason: Whitelisted ASN
  expression:
    - evt.Overflow.Alert.GetScenario() == 'LePresidente/http-generic-403-bf' && Lower(evt.Overflow.Alert.Source.AsName) contains 'vodafone'