# False bans from normal Jira usage

**URL:** <https://discourse.crowdsec.net/t/false-bans-from-normal-jira-usage/541>\
**Category:** crowdsec\
**Created:** [January 17, 2022, 6:17pm UTC](https://discourse.crowdsec.net/t/false-bans-from-normal-jira-usage/541 "2022-01-17T18:17:11Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![arminus](https://dub1.discourse-cdn.com/flex013/user_avatar/discourse.crowdsec.net/arminus/32/263_2.png) [@arminus](https://discourse.crowdsec.net/u/arminus)\
**Post date:** [January 17, 2022, 6:17pm UTC](https://discourse.crowdsec.net/t/false-bans-from-normal-jira-usage/541/1 "2022-01-17T18:17:11Z")

</div>

It seems that we are getting frequent http-crawl-non\_statics bans on our server for “normal” work with Jira (e.g. moving tasks around in a board or simply updating them)

I know I can whitelist IPs but those change. Is there any other approach to address such a problem?

---

<div class="post-metadata">

**Author:** ![alteredCoder](https://dub1.discourse-cdn.com/flex013/user_avatar/discourse.crowdsec.net/alteredcoder/32/44_2.png) [@alteredCoder](https://discourse.crowdsec.net/u/alteredCoder)\
**Post date:** [January 18, 2022, 2:08pm UTC](https://discourse.crowdsec.net/t/false-bans-from-normal-jira-usage/541/2 "2022-01-18T14:08:33Z")

</div>

Hello @arminus,

You can whitelist a scenario only for a range or an AS. Does the IPs that changed are always in the same range ?

---

<div class="post-metadata">

**Author:** ![arminus](https://dub1.discourse-cdn.com/flex013/user_avatar/discourse.crowdsec.net/arminus/32/263_2.png) [@arminus](https://discourse.crowdsec.net/u/arminus)\
**Post date:** [January 18, 2022, 3:29pm UTC](https://discourse.crowdsec.net/t/false-bans-from-normal-jira-usage/541/3 "2022-01-18T15:29:30Z")

</div>

Thanks, I’m aware of that. Problem is, we have clients accessing that site as well and I can’t manage their IPs in the whitelist.

Is there any other way to whitelist beyond the IPs, e.g. in the endpoint, like ignore a certain URL pattern or something?

---

<div class="post-metadata">

**Author:** ![alteredCoder](https://dub1.discourse-cdn.com/flex013/user_avatar/discourse.crowdsec.net/alteredcoder/32/44_2.png) [@alteredCoder](https://discourse.crowdsec.net/u/alteredCoder)\
**Post date:** [January 18, 2022, 4:47pm UTC](https://discourse.crowdsec.net/t/false-bans-from-normal-jira-usage/541/4 "2022-01-18T16:47:11Z")

</div>

Hello,

Yes you can whitelist with a certain URL pattern.  
Can you share more information about what pattern you want to whitelist so i can help you ?

---

<div class="post-metadata">

**Author:** ![arminus](https://dub1.discourse-cdn.com/flex013/user_avatar/discourse.crowdsec.net/arminus/32/263_2.png) [@arminus](https://discourse.crowdsec.net/u/arminus)\
**Post date:** [January 19, 2022, 9:53am UTC](https://discourse.crowdsec.net/t/false-bans-from-normal-jira-usage/541/5 "2022-01-19T09:53:49Z")

</div>

I’m afraid there is no clear repro. One sure thing seems to be to drag tickets back and forth between backlog and a sprint in a Jira scrum board. Sooner or later, I’ll get banned.

Unfortunately, at that point, if I try to export Firefoxe’s network connections as .HAR file, it exports a 0 byte file only, probably b/c at this point the respective server connection is dead. cscli decisions delete --ip lets me back in but the .HAR export stills doesn’t work without reloading the entire page.

Is there some log on crowdsec’s side which would tell me in detail why the http-crawl-non\_statics rule gets triggered?

---

<div class="post-metadata">

**Author:** ![alteredCoder](https://dub1.discourse-cdn.com/flex013/user_avatar/discourse.crowdsec.net/alteredcoder/32/44_2.png) [@alteredCoder](https://discourse.crowdsec.net/u/alteredCoder)\
**Post date:** [January 19, 2022, 1:55pm UTC](https://discourse.crowdsec.net/t/false-bans-from-normal-jira-usage/541/6 "2022-01-19T13:55:39Z")

</div>

Hello,

Here is the crawl non static scenario configuration: [CrowdSec Hub](https://hub.crowdsec.net/author/crowdsecurity/configurations/http-crawl-non_statics)

To make it short, if an IP address query more than 40 differents URL (`css`, `jpeg`, `js` etc… are excluded) in a short period, the scenario will be trigger.

---

<div class="post-metadata">

**Author:** ![arminus](https://dub1.discourse-cdn.com/flex013/user_avatar/discourse.crowdsec.net/arminus/32/263_2.png) [@arminus](https://discourse.crowdsec.net/u/arminus)\
**Post date:** [January 31, 2022, 9:33am UTC](https://discourse.crowdsec.net/t/false-bans-from-normal-jira-usage/541/7 "2022-01-31T09:33:00Z")

</div>

And there is no way to whitelist a URL like, say [https://jira](https://jira).`<mydomain>`/rest/analytics/\* ?

---

<div class="post-metadata">

**Author:** ![alteredCoder](https://dub1.discourse-cdn.com/flex013/user_avatar/discourse.crowdsec.net/alteredcoder/32/44_2.png) [@alteredCoder](https://discourse.crowdsec.net/u/alteredCoder)\
**Post date:** [February 1, 2022, 11:04am UTC](https://discourse.crowdsec.net/t/false-bans-from-normal-jira-usage/541/8 "2022-02-01T11:04:12Z")

</div>

Hello,

Yes you can whitelist a URL.

For example, the whitelist can looks like (in `/etc/crowdsec/parsers/s02-enrich/`):

```auto
name: crowdsecurity/whitelists_jira
description: "Whitelist Jira false positives"
whitelist:
  reason: "Whitelist Jira False Positive"
  expression:
    - evt.Parsed.request startsWith "/rest/analytics/"

```

Which parser do you use to parse HTTP logs ? Can you paste a sample of a log to see how can we adjust the whitelist please ?

---

<div class="post-metadata">

**Author:** ![arminus](https://dub1.discourse-cdn.com/flex013/user_avatar/discourse.crowdsec.net/arminus/32/263_2.png) [@arminus](https://discourse.crowdsec.net/u/arminus)\
**Post date:** [February 1, 2022, 11:47am UTC](https://discourse.crowdsec.net/t/false-bans-from-normal-jira-usage/541/9 "2022-02-01T11:47:27Z")

</div>

The scenario is http-crawl-non\_statics.

Here’s the sanitized [log trace](https://gist.github.com/arminus/df06e4c084b8908d90b8bc26730a0b50) which led to the ban at around 31/Jan/2022:09:35:56

I don’t think this is /rest/analytics but maybe /rest/gitplugin ? (nothing fancy here, just the regular Jira git plugin)