Update Security_Containers/crowdsec/postoverflows/s01-whitelist/geoip-allow.yaml

2026-05-15 02:57:27 +00:00
parent dbea3dcf05
commit 6c6612c582
1 changed files with 5 additions and 4 deletions
@@ -1,7 +1,8 @@
 name: crowdsecurity/geoip-allow-us-de
 description: "Block all countries except US and Germany"
 filter: "evt.Enriched.IsoCode != 'US' && evt.Enriched.IsoCode != 'DE'"
-blackhole: 1m
-labels:
-  type: geo_block
-remediation: true
+whitelist:
+  reason: "GeoIP block - country not in allowlist"
+  expression:
+    - "evt.Enriched.IsoCode == 'US'"
+    - "evt.Enriched.IsoCode == 'DE'"