Scenarios and changes?

crowdsec
1

I have finally got Crowdsec setup and parsing my traefik files hopefully migrating from fail2ban.
I checked the validity of some scenarios and one typical one I would have expected to fire off was word-press scans.

I can see these were not triggered (via cscli explain with verbose) - and checked the yaml definition. It looks like this scan expects the ‘wp-’ to be in the URL path and to end with ‘.php’. The malicious scans I see in my own logs are for wp- but end in XML.
Can I simply amend the yaml and simplify the requirement (dropping the suffix ‘.php’) or is there some other way to amend this scenario?

2

you definitely create your own scenarios!
but before you dig into I would double check existing ones - by default scenarios don’t create a “decision” immediately (they need multiple hits) so you might need multiple tries to generate alert/decision.