Hello, I would like to try the following behavior with a scenario, but it won’t work as expected.
All requests, matching a filter, should land in the same bucket with a capacity of 5. After the 5th request, each request should cause an overflow. The decision should have “captcha” as the action.
What I understand is, that the value of groupby, is deciding, in which bucket the request will land, so I can’t groupby the ip. It should be another value which is the same for all requests I want to handle with that.
For testing purposes, I set the capacity to 1. So I expect that after the first requests, the second should cause a decision, and the same with the next request with another ip, as long the capacity is reached. But it’s not working as expected.
My scenario looks like the following:
type: leaky
name: bu/foreign-users
description: "detect users outside of eu"
filter: "evt.Meta.log_type == 'http_access-log' && evt.Meta.IsInEU == 'false'"
leakspeed: "20s"
capacity: 1
groupby: evt.Enriched.ASNNumber
blackhole: 0
reprocess: false
debug: true
labels:
service: http
type: server-check
remediation: true
The behavior is, that after the first request I’m getting a decision, the third request won’t cause a decision, but the 4th request is landing again in the decision list.
+----+----------+--------------------+-----------------+---------+---------+---------------+--------+--------------------+----------+
| ID | SOURCE | SCOPE:VALUE | REASON | ACTION | COUNTRY | AS | EVENTS | EXPIRATION | ALERT ID |
+----+----------+--------------------+-----------------+---------+---------+---------------+--------+--------------------+----------+
| 3 | crowdsec | Ip:149.154.159.150 | bu/server-guard | captcha | DE | 9009 M247 Ltd | 2 | 3h59m8.667557561s | 3 |
| 1 | crowdsec | Ip:149.154.159.148 | bu/server-guard | captcha | DE | 9009 M247 Ltd | 2 | 3h58m55.141157649s | 1 |
+----+----------+--------------------+-----------------+---------+---------+---------------+--------+--------------------+----------+
2 duplicated entries skipped
What I want to achieve is, that when we get more than a specific count of requests from another country to a specific url within a defined time range, we want to show a captcha in the client. So our bouncer should react on the decision captcha and a special header to the request. Is this possible somehow with using the leaky buckets from CrowdSec?
Thanks in advance!
).