2026-05-15 02:50:14 +00:00
|
|
|
name: crowdsecurity/geoip-allow-us-de
|
|
|
|
|
description: "Block all countries except US and Germany"
|
|
|
|
|
filter: "evt.Enriched.IsoCode != 'US' && evt.Enriched.IsoCode != 'DE'"
|
2026-05-15 02:57:27 +00:00
|
|
|
whitelist:
|
|
|
|
|
reason: "GeoIP block - country not in allowlist"
|
|
|
|
|
expression:
|
|
|
|
|
- "evt.Enriched.IsoCode == 'US'"
|
|
|
|
|
- "evt.Enriched.IsoCode == 'DE'"
|
