name: crowdsecurity/geoip-allow-us-de
description: "Block all countries except US and Germany"
filter: "evt.Enriched.IsoCode != 'US' && evt.Enriched.IsoCode != 'DE'"
blackhole: 1m
labels:
  type: geo_block
remediation: true