8 lines
315 B
YAML
8 lines
315 B
YAML
name: crowdsecurity/geoip-allow-us-de
|
|
description: "Block all countries except US and Germany"
|
|
filter: "evt.Enriched.IsoCode != 'US' && evt.Enriched.IsoCode != 'DE'"
|
|
whitelist:
|
|
reason: "GeoIP block - country not in allowlist"
|
|
expression:
|
|
- "evt.Enriched.IsoCode == 'US'"
|
|
- "evt.Enriched.IsoCode == 'DE'" |