Whitelist by ASNNumber

crowdsec
3

Thank you, it works!

I also had to change the AS numbers to strings (i.e. '3215' instead of 3215`):

name: zz-whitelist-AS
description: Whitelist some AS
debug: true
whitelist:
  reason: Whitelisted AS
  expression:
    - evt.Overflow.Alert.Source.AsNumber in ['3215', '15557', '12322', '5410']
2 Likes