Question about Postoverflow rules

crowdsec
1

Hi everyone,

I struggle a bit with using Postoverflow rules. For a Nextcloud instance I am testing CrowdSec + AppSec with, although having the Nextcloud Whitelist ruleset installed, I still need to whiteliste a few things more and I want to do this as specific as possible. I got my rules running for now, but on the way to a working ruleset, I came across a few problems I do not understand.

I will post a few rules that work and do not work for a certain scenario, and it would help if someone could explain why the one works and the other does not.

ALL the rules (even the ones working) have in common, that they do not trigger when doing a ‘cscli explain’ with the respective Logline.

Example A is for the http-sensitive-files scenario.

This rule does not work, although it gets parsed it does not whitelist.

name: custom/nextcloud-http-sensitive-files-whitelist
description: "Nextcloud Whitelisting WebDAV http-sensitive-files."

whitelist:
  reason: "Nextcloud Whitelisting http-sensitive-files"

  expression:
    - evt.Overflow.Alert.Scenario == "crowdsecurity/http-sensitive-files" and
      all(evt.Overflow.Alert.Events, {
        .GetMeta("http_path") matches `^/remote.php/dav/files/(?:/.*)?$`})

This one does work for this scenario:

name: custom/nextcloud-http-sensitive-files-whitelist
description: "Nextcloud Whitelisting WebDAV http-sensitive-files."

whitelist:
  reason: "Nextcloud Whitelisting http-sensitive-files"

  expression:
    - evt.Overflow.Alert.Scenario == "crowdsecurity/http-sensitive-files" and
      all(evt.Overflow.Alert.Events, .GetMeta("http_path") startsWith "/remote.php/dav/files/")

By omitting the {}, putting the expression in one line and using startsWith instead of matches with a RegEx makes it work… but the non-working is not triggering an error when restarting / reloading CrowdSec, so I am not sure if the Syntax is incorrect here. Maybe matches with RegEx are not meant to work for PostOverflows?

Example B is for the http-probing scenario.

This rule does not work, although it gets hit, it does not trigger a Whitelist event:

name: custom/nextcloud-http-probing-whitelist
description: "Nextcloud Whitelisting WebDAV http-probing."

whitelist:
  reason: "Nextcloud Whitelisting http-probing"

  expression:
    - evt.Overflow.Alert.Scenario == "crowdsecurity/http-probing" and
      all(evt.Overflow.Alert.Events, {
        .GetMeta("http_path") matches `^/remote.php/dav/files/(?:/.*)?$`})

This one does work:

name: custom/nextcloud-http-probing-whitelist
description: "Nextcloud Whitelisting WebDAV http-probing."

whitelist:
  reason: "Nextcloud Whitelisting http-probing"

  expression:
    - evt.Overflow.Alert.Scenario == "crowdsecurity/http-probing" and
      all(evt.Overflow.Alert.Events, {
        .GetMeta("http_path") startsWith "/remote.php/dav/files/" ||
        .GetMeta("http_path") startsWith "/apps/files_trashbin/"})

This one I also changed to startsWith instead of a RegEx and although I added “complexity” ot the 2nd one by checking for an additional path, this one seems to work as intended.

Bonus Rule from the previous example that makes CrowdSec not Start / Load, because it claims that in line 8 of the yml I am missing a -.

name: custom/nextcloud-http-probing-whitelist
description: "Nextcloud Whitelisting WebDAV http-probing."

whitelist:
  reason: "Nextcloud Whitelisting http-probing"

  expression:
    - evt.Overflow.Alert.Scenario == "crowdsecurity/http-probing" and
      all(evt.Overflow.Alert.Events, {
        .GetMeta("http_path") startsWith "/remote.php/dav/files/" ||
        .GetMeta("http_path") startsWith "/apps/files_trashbin/"
      })

Here I do not understand why an error for line 8 is triggered when parsing the file, since Line 8 here is identical to the working example above… the only change is where I put the closing }).

Any input on why the rules work / do not work is very appreciated.

Bonus Question:
None of those rules trigger when using a cscli explain. Are Postoverflows not meant to be tested / validated with cscli explain, maybe? I was only able to test the rules by triggering the scenario directly by using Nextcloud.
Sample line:

cscli explain --log '149.80.43.4 - - [09/Jul/2026:07:17:48 +0200] "PUT /remote.php/dav/files/user.name%40dom-ain.tld/internal%20Department/Testupload2/Folder/aspnetcorev2_inproc.dll HTTP/1.1" 201 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36 Edg/150.0.0.0"' --type nginx -v