Hi Thibault
time="04-11-2021 11:55:47" level=info msg="Ip 34.245.204.174 performed 'crowdsecurity/http-probing' (13 events over 1m33.240032522s) at 2021-11-04 11:55:47.849649143 +0000 UTC m=+73604.010430156"
time="04-11-2021 11:55:48" level=info msg="(3c1f443a494fb47370e37e34680787eerc0sj7zOceruPRSl/crowdsec) crowdsecurity/http-probing by ip 34.245.204.174 (IE) : 4h ban on Ip 34.245.204.174"
There should be more logs ?
The yaml file is located in /etc/crowdsec/parsers/s02-enrich/
name: crowdsecurity/totoscraper
description: "Whitelist events from toto scraper"
whitelist:
reason: "toto scraper"
expression:
- evt.Parsed.http_user_agent matches "Toto-Scraper/.* Acme \\(https://www.acme.com/en/digital-website\\)"
ua exemple :
Toto-Scraper/1.2.5 Acme (https://www.acme.com/en/digital-website)
Thanks