From c02ebbfd7fca63645f96b8d7b002af2df7f58f96 Mon Sep 17 00:00:00 2001 From: Sebastien Blot Date: Mon, 1 Jun 2026 17:33:52 +0200 Subject: [PATCH 01/36] add wip scenarios for challenge mode --- .../challenge-request-with-no-submission.yaml | 20 +++++++++++++++++++ .../challenge-too-many-request.yaml | 19 ++++++++++++++++++ .../challenge-too-many-submit.yaml | 19 ++++++++++++++++++ 3 files changed, 58 insertions(+) create mode 100644 scenarios/crowdsecurity/challenge-request-with-no-submission.yaml create mode 100644 scenarios/crowdsecurity/challenge-too-many-request.yaml create mode 100644 scenarios/crowdsecurity/challenge-too-many-submit.yaml diff --git a/scenarios/crowdsecurity/challenge-request-with-no-submission.yaml b/scenarios/crowdsecurity/challenge-request-with-no-submission.yaml new file mode 100644 index 00000000000..c1c0a11eb0f --- /dev/null +++ b/scenarios/crowdsecurity/challenge-request-with-no-submission.yaml @@ -0,0 +1,20 @@ +type: counter +format: 3.0 +#debug: true +name: crowdsecurity/appsec-challenge-request-with-no-submission +description: "Client made too many request to challenge page" +filter: "evt.Meta.log_type == 'appsec-challenge' && (evt.Meta.challenge_event == 'requested' || evt.Meta.challenge_event == 'submitted')" +cancel_on: "evt.Meta.log_type == 'appsec-challenge' && evt.Meta.challenge_event == 'submitted'" +duration: 60s +capacity: -1 +cache_size: 1 +groupby: evt.Meta.source_ip +blackhole: 10s +labels: + service: http + confidence: 0 + spoofable: 0 + classification: + - attack.T1110 + label: "Blocked by CrowdSec AppSec" + behavior: "http:exploit" diff --git a/scenarios/crowdsecurity/challenge-too-many-request.yaml b/scenarios/crowdsecurity/challenge-too-many-request.yaml new file mode 100644 index 00000000000..795bc607045 --- /dev/null +++ b/scenarios/crowdsecurity/challenge-too-many-request.yaml @@ -0,0 +1,19 @@ +type: leaky +format: 3.0 +#debug: true +name: crowdsecurity/appsec-challenge-too-many-requests +description: "Client made too many request to challenge page" +filter: "evt.Meta.log_type == 'appsec-challenge' && evt.Meta.challenge_event == 'requested'" +leakspeed: "60s" +capacity: 5 +groupby: evt.Meta.source_ip +blackhole: 1m +labels: + service: http + confidence: 0 + spoofable: 0 + classification: + - attack.T1110 + label: "Blocked by CrowdSec AppSec" + behavior: "http:exploit" + remediation: true diff --git a/scenarios/crowdsecurity/challenge-too-many-submit.yaml b/scenarios/crowdsecurity/challenge-too-many-submit.yaml new file mode 100644 index 00000000000..47ab5fe1c96 --- /dev/null +++ b/scenarios/crowdsecurity/challenge-too-many-submit.yaml @@ -0,0 +1,19 @@ +type: leaky +format: 3.0 +#debug: true +name: crowdsecurity/appsec-challenge-too-many-submissions +description: "Client made too many submissions for challenge" +filter: "evt.Meta.log_type == 'appsec-challenge' && evt.Meta.challenge_event == 'submitted'" +leakspeed: "60s" +capacity: 5 +groupby: evt.Meta.source_ip +blackhole: 1m +labels: + service: http + confidence: 0 + spoofable: 0 + classification: + - attack.T1110 + label: "Blocked by CrowdSec AppSec" + behavior: "http:exploit" + remediation: true From f07f5b7a8b4b71ccd0a860782b9f54179b654859 Mon Sep 17 00:00:00 2001 From: Sebastien Blot Date: Mon, 1 Jun 2026 17:48:17 +0200 Subject: [PATCH 02/36] update appsec parser for challenge events --- parsers/s01-parse/crowdsecurity/appsec-logs.yaml | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/parsers/s01-parse/crowdsecurity/appsec-logs.yaml b/parsers/s01-parse/crowdsecurity/appsec-logs.yaml index 185d5bf54fe..daf92412f3c 100644 --- a/parsers/s01-parse/crowdsecurity/appsec-logs.yaml +++ b/parsers/s01-parse/crowdsecurity/appsec-logs.yaml @@ -18,10 +18,16 @@ statics: #was the request blocked ? - meta: log_type expression: | - evt.Appsec.HasInBandMatches ? "appsec-block" : "appsec-info" + evt.Parsed.source == "crowdsec-appsec-challenge" ? + "appsec-challenge" : + (evt.Appsec.HasInBandMatches ? "appsec-block" : "appsec-info") - meta: rule_name expression: evt.Appsec.GetName() - meta: rule_ids expression: Sprintf("%+v", evt.Appsec.GetRuleIDs()) - meta: remediation_cmpt_ip expression: "evt.Parsed.remediation_cmpt_ip" + - meta: challenge_event + expression: evt.Parsed.challenge_event + - meta: fsid + expression: evt.Parsed.fsid From 612b0e0562cd55a4056a31723a9d2c3295716473 Mon Sep 17 00:00:00 2001 From: Sebastien Blot Date: Tue, 2 Jun 2026 11:38:16 +0200 Subject: [PATCH 03/36] add basic appsec-config for challenge --- appsec-configs/crowdsecurity/simple-bot-challenge.yaml | 5 +++++ 1 file changed, 5 insertions(+) create mode 100644 appsec-configs/crowdsecurity/simple-bot-challenge.yaml diff --git a/appsec-configs/crowdsecurity/simple-bot-challenge.yaml b/appsec-configs/crowdsecurity/simple-bot-challenge.yaml new file mode 100644 index 00000000000..a4527d8680d --- /dev/null +++ b/appsec-configs/crowdsecurity/simple-bot-challenge.yaml @@ -0,0 +1,5 @@ +name: crowdsecurity/simple-bot-challenge +inband: + post_eval: + - apply: + - SendChallenge() \ No newline at end of file From 7a2e15f7bf71175027d75967f1fdb7080bea76ec Mon Sep 17 00:00:00 2001 From: Thibault Koechlin Date: Mon, 15 Jun 2026 14:54:16 +0200 Subject: [PATCH 04/36] bundle files in a collection, exclude well-known paths, split parsers, add context --- .../challenge-exclude-crawler-files.yaml | 11 +++++ .../challenge-exclude-feeds.yaml | 10 +++++ .../challenge-exclude-webhooks.yaml | 8 ++++ .../crowdsecurity/simple-bot-challenge.yaml | 13 +++++- .../crowdsecurity/appsec-bot-challenge.md | 35 ++++++++++++++++ .../crowdsecurity/appsec-bot-challenge.yaml | 26 ++++++++++++ .../crowdsecurity/appsec_bot_detection.yaml | 23 ++++++++++ .../appsec-bot-detection-logs.yaml | 42 +++++++++++++++++++ .../s01-parse/crowdsecurity/appsec-logs.yaml | 10 +---- .../crowdsecurity/appsec-bot-detected.yaml | 17 ++++++++ 10 files changed, 185 insertions(+), 10 deletions(-) create mode 100644 appsec-configs/crowdsecurity/challenge-exclude-crawler-files.yaml create mode 100644 appsec-configs/crowdsecurity/challenge-exclude-feeds.yaml create mode 100644 appsec-configs/crowdsecurity/challenge-exclude-webhooks.yaml create mode 100644 collections/crowdsecurity/appsec-bot-challenge.md create mode 100644 collections/crowdsecurity/appsec-bot-challenge.yaml create mode 100644 contexts/crowdsecurity/appsec_bot_detection.yaml create mode 100644 parsers/s01-parse/crowdsecurity/appsec-bot-detection-logs.yaml create mode 100644 scenarios/crowdsecurity/appsec-bot-detected.yaml diff --git a/appsec-configs/crowdsecurity/challenge-exclude-crawler-files.yaml b/appsec-configs/crowdsecurity/challenge-exclude-crawler-files.yaml new file mode 100644 index 00000000000..f166f120346 --- /dev/null +++ b/appsec-configs/crowdsecurity/challenge-exclude-crawler-files.yaml @@ -0,0 +1,11 @@ +name: crowdsecurity/challenge-exclude-crawler-files +# Let well-known crawler files fly through without a challenge. SetLegitimateBot() is +# strictly per-request (never persisted to a cookie or across requests), so this cannot +# be abused to whitelist a session for other paths. +inband: + pre_eval: + - filter: >- + req.URL.Path in ['/robots.txt', '/ads.txt', '/app-ads.txt', '/sitemap.xml'] || + req.URL.Path startsWith '/.well-known/' + apply: + - SetLegitimateBot() diff --git a/appsec-configs/crowdsecurity/challenge-exclude-feeds.yaml b/appsec-configs/crowdsecurity/challenge-exclude-feeds.yaml new file mode 100644 index 00000000000..178c865b323 --- /dev/null +++ b/appsec-configs/crowdsecurity/challenge-exclude-feeds.yaml @@ -0,0 +1,10 @@ +name: crowdsecurity/challenge-exclude-feeds +# Let syndication feed endpoints fly through without a challenge. SetLegitimateBot() is +# strictly per-request (never persisted to a cookie or across requests). +inband: + pre_eval: + - filter: >- + req.URL.Path in ['/feed', '/rss', '/atom.xml'] || + req.URL.Path startsWith '/feed/' || req.URL.Path startsWith '/rss/' + apply: + - SetLegitimateBot() diff --git a/appsec-configs/crowdsecurity/challenge-exclude-webhooks.yaml b/appsec-configs/crowdsecurity/challenge-exclude-webhooks.yaml new file mode 100644 index 00000000000..3e625628f5c --- /dev/null +++ b/appsec-configs/crowdsecurity/challenge-exclude-webhooks.yaml @@ -0,0 +1,8 @@ +name: crowdsecurity/challenge-exclude-webhooks +# Let third-party webhook callbacks fly through without a challenge. SetLegitimateBot() is +# strictly per-request (never persisted to a cookie or across requests). +inband: + pre_eval: + - filter: "req.URL.Path in ['/webhooks/stripe', '/webhooks/github', '/webhooks/sendgrid']" + apply: + - SetLegitimateBot() diff --git a/appsec-configs/crowdsecurity/simple-bot-challenge.yaml b/appsec-configs/crowdsecurity/simple-bot-challenge.yaml index a4527d8680d..259d32bdf00 100644 --- a/appsec-configs/crowdsecurity/simple-bot-challenge.yaml +++ b/appsec-configs/crowdsecurity/simple-bot-challenge.yaml @@ -1,5 +1,14 @@ name: crowdsecurity/simple-bot-challenge inband: post_eval: - - apply: - - SendChallenge() \ No newline at end of file + # Skip the challenge for verified good bots (forward-confirmed rDNS) and for requests a + # well-known-path exclusion config flagged via SetLegitimateBot(). The flag is per-request only. + - filter: "!IsLegitimateBot(req.RemoteAddr, req.UserAgent(), req.URL.Path)" + apply: + - SendChallenge() + on_challenge_submit: + # Reject submissions whose fingerprint fast-detect flags a known bot. The resulting "rejected" + # event feeds crowdsecurity/appsec-bot-detected (alert only, no active ban). + - filter: "fingerprint.IsBot()" + apply: + - RejectSubmission("known bot (fast bot detection)") diff --git a/collections/crowdsecurity/appsec-bot-challenge.md b/collections/crowdsecurity/appsec-bot-challenge.md new file mode 100644 index 00000000000..5b52cc0acf5 --- /dev/null +++ b/collections/crowdsecurity/appsec-bot-challenge.md @@ -0,0 +1,35 @@ +# AppSec Bot Challenge + +This collection enables CrowdSec AppSec **challenge mode** for bot detection: visitors are served a +lightweight proof-of-work + browser-fingerprint challenge, and clients flagged as known bots by the +fast bot detection are rejected. + +What it ships: + + - `crowdsecurity/simple-bot-challenge`: challenges incoming requests, skips verified good bots + (forward-confirmed rDNS), and rejects challenge submissions whose fingerprint trips the fast bot + detection. + - Well-known-path exclusion configs (`challenge-exclude-crawler-files`, `-feeds`, `-webhooks`) that + let machine-facing endpoints (`/robots.txt`, `/.well-known/*`, feeds, webhooks) through without a + challenge. The exclusion is strictly per-request and is never persisted to a cookie or across + requests, so it cannot be abused to whitelist a session for other paths. + - A dedicated bot-detection parser tracking the fingerprint session id (`fsid`) and OS. + - Scenarios that alert on detected bots and on challenge abuse. + - A user-friendly alert context exposing `fsid`, OS, and the bot signals that fired. + +## Enabling bot challenge + +Add the `crowdsecurity/simple-bot-challenge` appsec-config to your WAF acquisition, plus any of the +well-known-path exclusion configs you need: + +```yaml +appsec_configs: + - crowdsecurity/simple-bot-challenge + - crowdsecurity/challenge-exclude-crawler-files + - crowdsecurity/challenge-exclude-feeds + - crowdsecurity/challenge-exclude-webhooks +labels: + type: appsec +listen_addr: 127.0.0.1:7422 +source: appsec +``` diff --git a/collections/crowdsecurity/appsec-bot-challenge.yaml b/collections/crowdsecurity/appsec-bot-challenge.yaml new file mode 100644 index 00000000000..058352dd4c5 --- /dev/null +++ b/collections/crowdsecurity/appsec-bot-challenge.yaml @@ -0,0 +1,26 @@ +name: crowdsecurity/appsec-bot-challenge +parsers: + - crowdsecurity/appsec-logs + - crowdsecurity/appsec-bot-detection-logs +appsec-configs: + - crowdsecurity/simple-bot-challenge + - crowdsecurity/challenge-exclude-crawler-files + - crowdsecurity/challenge-exclude-feeds + - crowdsecurity/challenge-exclude-webhooks +scenarios: + - crowdsecurity/appsec-bot-detected + - crowdsecurity/appsec-challenge-too-many-requests + - crowdsecurity/appsec-challenge-too-many-submissions + - crowdsecurity/appsec-challenge-request-with-no-submission +contexts: + - crowdsecurity/appsec_base + - crowdsecurity/appsec_bot_detection +description: "AppSec bot detection: challenge mode with fast-detect bot rejection and well-known-path exclusions" +labels: + label: "WAF - Bot Challenge" +author: crowdsecurity +tags: + - waf + - appsec + - http + - bot diff --git a/contexts/crowdsecurity/appsec_bot_detection.yaml b/contexts/crowdsecurity/appsec_bot_detection.yaml new file mode 100644 index 00000000000..bbe99f516fd --- /dev/null +++ b/contexts/crowdsecurity/appsec_bot_detection.yaml @@ -0,0 +1,23 @@ +# User-friendly context for AppSec bot-detection / challenge events. +# Each detected_signals line emits a readable signal name only when its flag is set, +# so the console shows a compact list of what tripped the fast bot detection. +context: + fingerprint_id: + - evt.Meta.fsid + operating_system: + - evt.Meta.os + user_agent: + - evt.Meta.http_user_agent + bot_detected: + - evt.Meta.fingerprint_bot + challenge_event: + - evt.Meta.challenge_event + detected_signals: + - "evt.Unmarshaled.fingerprint.Bot.Webdriver ? 'webdriver' : ''" + - "evt.Unmarshaled.fingerprint.Bot.Selenium ? 'selenium' : ''" + - "evt.Unmarshaled.fingerprint.Bot.CDP ? 'chrome-devtools-protocol' : ''" + - "evt.Unmarshaled.fingerprint.Bot.Playwright ? 'playwright' : ''" + - "evt.Unmarshaled.fingerprint.Bot.BotUserAgent ? 'bot-user-agent' : ''" + - "evt.Unmarshaled.fingerprint.Bot.MissingChromeObject ? 'headless-chrome' : ''" + - "evt.Unmarshaled.fingerprint.Bot.PlatformMismatch ? 'platform-mismatch' : ''" + - "evt.Unmarshaled.fingerprint.Bot.GPUMismatch ? 'gpu-mismatch' : ''" diff --git a/parsers/s01-parse/crowdsecurity/appsec-bot-detection-logs.yaml b/parsers/s01-parse/crowdsecurity/appsec-bot-detection-logs.yaml new file mode 100644 index 00000000000..8595c6ea565 --- /dev/null +++ b/parsers/s01-parse/crowdsecurity/appsec-bot-detection-logs.yaml @@ -0,0 +1,42 @@ +onsuccess: next_stage +format: 3.0 +#debug: true +filter: "evt.Parsed.program == 'appsec' && evt.Parsed.source == 'crowdsec-appsec-challenge'" +name: crowdsecurity/appsec-bot-detection-logs +description: "Parse AppSec bot-detection / challenge events" +statics: + - meta: service + value: appsec + - meta: log_type + value: appsec-challenge + - meta: source_ip + expression: "evt.Parsed.source_ip" + - meta: target_host + expression: "evt.Parsed.target_host" + - meta: request_uuid + expression: "evt.Parsed.req_uuid" + - meta: target_uri + expression: "evt.Parsed.target_uri" + - meta: challenge_event + expression: evt.Parsed.challenge_event + - meta: challenge_difficulty + expression: evt.Parsed.challenge_difficulty + - meta: challenge_fail_reason + expression: evt.Parsed.challenge_fail_reason + - meta: fsid + expression: evt.Parsed.fsid + - meta: fingerprint_bot + expression: evt.Parsed.fingerprint_bot + - meta: http_user_agent + expression: evt.Parsed.user_agent + # raw navigator.platform, kept for precise matching + - meta: platform + expression: evt.Parsed.platform + # user-friendly OS label derived from the raw platform string + - meta: os + expression: | + evt.Parsed.platform contains "Win" ? "Windows" : + (evt.Parsed.platform contains "Mac" ? "macOS" : + (evt.Parsed.platform contains "Linux" ? "Linux" : + (evt.Parsed.platform contains "iPhone" || evt.Parsed.platform contains "iPad" ? "iOS" : + (evt.Parsed.platform contains "Android" ? "Android" : evt.Parsed.platform)))) diff --git a/parsers/s01-parse/crowdsecurity/appsec-logs.yaml b/parsers/s01-parse/crowdsecurity/appsec-logs.yaml index daf92412f3c..243981c6a6b 100644 --- a/parsers/s01-parse/crowdsecurity/appsec-logs.yaml +++ b/parsers/s01-parse/crowdsecurity/appsec-logs.yaml @@ -1,7 +1,7 @@ onsuccess: next_stage format: 3.0 #debug: true -filter: "evt.Parsed.program == 'appsec'" +filter: "evt.Parsed.program == 'appsec' && evt.Parsed.source != 'crowdsec-appsec-challenge'" name: crowdsecurity/appsec-logs description: "Parse Appsec events" statics: @@ -18,16 +18,10 @@ statics: #was the request blocked ? - meta: log_type expression: | - evt.Parsed.source == "crowdsec-appsec-challenge" ? - "appsec-challenge" : - (evt.Appsec.HasInBandMatches ? "appsec-block" : "appsec-info") + evt.Appsec.HasInBandMatches ? "appsec-block" : "appsec-info" - meta: rule_name expression: evt.Appsec.GetName() - meta: rule_ids expression: Sprintf("%+v", evt.Appsec.GetRuleIDs()) - meta: remediation_cmpt_ip expression: "evt.Parsed.remediation_cmpt_ip" - - meta: challenge_event - expression: evt.Parsed.challenge_event - - meta: fsid - expression: evt.Parsed.fsid diff --git a/scenarios/crowdsecurity/appsec-bot-detected.yaml b/scenarios/crowdsecurity/appsec-bot-detected.yaml new file mode 100644 index 00000000000..8c7d6a3cd3a --- /dev/null +++ b/scenarios/crowdsecurity/appsec-bot-detected.yaml @@ -0,0 +1,17 @@ +type: trigger +format: 3.0 +#debug: true +name: crowdsecurity/appsec-bot-detected +description: "A known bot was detected and rejected by the AppSec challenge (fast bot detection)" +filter: "evt.Meta.log_type == 'appsec-challenge' && evt.Meta.challenge_event == 'rejected'" +groupby: evt.Meta.source_ip +blackhole: 1m +labels: + service: http + confidence: 1 + spoofable: 0 + classification: + - attack.T1071 + label: "Bot detected by CrowdSec AppSec challenge" + behavior: "http:bot" + remediation: false From 47e1b42766b62e00910293812bdabb58c58201e3 Mon Sep 17 00:00:00 2001 From: Thibault Koechlin Date: Mon, 15 Jun 2026 17:41:00 +0200 Subject: [PATCH 05/36] rename to make CI happy --- ...sion.yaml => appsec-challenge-request-with-no-submission.yaml} | 0 ...o-many-request.yaml => appsec-challenge-too-many-request.yaml} | 0 ...too-many-submit.yaml => appsec-challenge-too-many-submit.yaml} | 0 3 files changed, 0 insertions(+), 0 deletions(-) rename scenarios/crowdsecurity/{challenge-request-with-no-submission.yaml => appsec-challenge-request-with-no-submission.yaml} (100%) rename scenarios/crowdsecurity/{challenge-too-many-request.yaml => appsec-challenge-too-many-request.yaml} (100%) rename scenarios/crowdsecurity/{challenge-too-many-submit.yaml => appsec-challenge-too-many-submit.yaml} (100%) diff --git a/scenarios/crowdsecurity/challenge-request-with-no-submission.yaml b/scenarios/crowdsecurity/appsec-challenge-request-with-no-submission.yaml similarity index 100% rename from scenarios/crowdsecurity/challenge-request-with-no-submission.yaml rename to scenarios/crowdsecurity/appsec-challenge-request-with-no-submission.yaml diff --git a/scenarios/crowdsecurity/challenge-too-many-request.yaml b/scenarios/crowdsecurity/appsec-challenge-too-many-request.yaml similarity index 100% rename from scenarios/crowdsecurity/challenge-too-many-request.yaml rename to scenarios/crowdsecurity/appsec-challenge-too-many-request.yaml diff --git a/scenarios/crowdsecurity/challenge-too-many-submit.yaml b/scenarios/crowdsecurity/appsec-challenge-too-many-submit.yaml similarity index 100% rename from scenarios/crowdsecurity/challenge-too-many-submit.yaml rename to scenarios/crowdsecurity/appsec-challenge-too-many-submit.yaml From 6e0a72a9cc90c99db3df27a6f793d3b43fb70b33 Mon Sep 17 00:00:00 2001 From: GitHub Action Date: Mon, 15 Jun 2026 15:41:26 +0000 Subject: [PATCH 06/36] Update index --- .index.json | 220 +++++++++++++++++++++++++++++++++++++++++++++++++++- 1 file changed, 218 insertions(+), 2 deletions(-) diff --git a/.index.json b/.index.json index 00167c79388..5c064c2cef6 100644 --- a/.index.json +++ b/.index.json @@ -25,6 +25,45 @@ } } }, + "crowdsecurity/challenge-exclude-crawler-files": { + "author": "crowdsecurity", + "content": "bmFtZTogY3Jvd2RzZWN1cml0eS9jaGFsbGVuZ2UtZXhjbHVkZS1jcmF3bGVyLWZpbGVzCiMgTGV0IHdlbGwta25vd24gY3Jhd2xlciBmaWxlcyBmbHkgdGhyb3VnaCB3aXRob3V0IGEgY2hhbGxlbmdlLiBTZXRMZWdpdGltYXRlQm90KCkgaXMKIyBzdHJpY3RseSBwZXItcmVxdWVzdCAobmV2ZXIgcGVyc2lzdGVkIHRvIGEgY29va2llIG9yIGFjcm9zcyByZXF1ZXN0cyksIHNvIHRoaXMgY2Fubm90CiMgYmUgYWJ1c2VkIHRvIHdoaXRlbGlzdCBhIHNlc3Npb24gZm9yIG90aGVyIHBhdGhzLgppbmJhbmQ6CiAgcHJlX2V2YWw6CiAgICAtIGZpbHRlcjogPi0KICAgICAgICByZXEuVVJMLlBhdGggaW4gWycvcm9ib3RzLnR4dCcsICcvYWRzLnR4dCcsICcvYXBwLWFkcy50eHQnLCAnL3NpdGVtYXAueG1sJ10gfHwKICAgICAgICByZXEuVVJMLlBhdGggc3RhcnRzV2l0aCAnLy53ZWxsLWtub3duLycKICAgICAgYXBwbHk6CiAgICAgICAgLSBTZXRMZWdpdGltYXRlQm90KCkK", + "labels": null, + "path": "appsec-configs/crowdsecurity/challenge-exclude-crawler-files.yaml", + "version": "0.1", + "versions": { + "0.1": { + "deprecated": false, + "digest": "f00a72b94fd2f59257b70b0433a7d2e273d70a0ae1b3ac96c5e745e72d30c769" + } + } + }, + "crowdsecurity/challenge-exclude-feeds": { + "author": "crowdsecurity", + "content": "bmFtZTogY3Jvd2RzZWN1cml0eS9jaGFsbGVuZ2UtZXhjbHVkZS1mZWVkcwojIExldCBzeW5kaWNhdGlvbiBmZWVkIGVuZHBvaW50cyBmbHkgdGhyb3VnaCB3aXRob3V0IGEgY2hhbGxlbmdlLiBTZXRMZWdpdGltYXRlQm90KCkgaXMKIyBzdHJpY3RseSBwZXItcmVxdWVzdCAobmV2ZXIgcGVyc2lzdGVkIHRvIGEgY29va2llIG9yIGFjcm9zcyByZXF1ZXN0cykuCmluYmFuZDoKICBwcmVfZXZhbDoKICAgIC0gZmlsdGVyOiA+LQogICAgICAgIHJlcS5VUkwuUGF0aCBpbiBbJy9mZWVkJywgJy9yc3MnLCAnL2F0b20ueG1sJ10gfHwKICAgICAgICByZXEuVVJMLlBhdGggc3RhcnRzV2l0aCAnL2ZlZWQvJyB8fCByZXEuVVJMLlBhdGggc3RhcnRzV2l0aCAnL3Jzcy8nCiAgICAgIGFwcGx5OgogICAgICAgIC0gU2V0TGVnaXRpbWF0ZUJvdCgpCg==", + "labels": null, + "path": "appsec-configs/crowdsecurity/challenge-exclude-feeds.yaml", + "version": "0.1", + "versions": { + "0.1": { + "deprecated": false, + "digest": "61f7604c4bc05209a21e8a35192310b4129539404c4e52d806e4c185919d8dd4" + } + } + }, + "crowdsecurity/challenge-exclude-webhooks": { + "author": "crowdsecurity", + "content": "bmFtZTogY3Jvd2RzZWN1cml0eS9jaGFsbGVuZ2UtZXhjbHVkZS13ZWJob29rcwojIExldCB0aGlyZC1wYXJ0eSB3ZWJob29rIGNhbGxiYWNrcyBmbHkgdGhyb3VnaCB3aXRob3V0IGEgY2hhbGxlbmdlLiBTZXRMZWdpdGltYXRlQm90KCkgaXMKIyBzdHJpY3RseSBwZXItcmVxdWVzdCAobmV2ZXIgcGVyc2lzdGVkIHRvIGEgY29va2llIG9yIGFjcm9zcyByZXF1ZXN0cykuCmluYmFuZDoKICBwcmVfZXZhbDoKICAgIC0gZmlsdGVyOiAicmVxLlVSTC5QYXRoIGluIFsnL3dlYmhvb2tzL3N0cmlwZScsICcvd2ViaG9va3MvZ2l0aHViJywgJy93ZWJob29rcy9zZW5kZ3JpZCddIgogICAgICBhcHBseToKICAgICAgICAtIFNldExlZ2l0aW1hdGVCb3QoKQo=", + "labels": null, + "path": "appsec-configs/crowdsecurity/challenge-exclude-webhooks.yaml", + "version": "0.1", + "versions": { + "0.1": { + "deprecated": false, + "digest": "7bdaa8a3d6a6f4564d12b782c10c3c7975c9230af4f843660794ad1952a1587b" + } + } + }, "crowdsecurity/crs": { "author": "crowdsecurity", "content": "bmFtZTogY3Jvd2RzZWN1cml0eS9jcnMKZGVmYXVsdF9yZW1lZGlhdGlvbjogYmFuCiNsb2dfbGV2ZWw6IGRlYnVnCm91dG9mYmFuZF9ydWxlczoKIC0gY3Jvd2RzZWN1cml0eS9jcnMKb25fbWF0Y2g6CiAtIGZpbHRlcjogSXNPdXRCYW5kID09IHRydWUKICAgYXBwbHk6CiAgICAgLSBTZW5kQWxlcnQoKQ==", @@ -92,6 +131,19 @@ } } }, + "crowdsecurity/simple-bot-challenge": { + "author": "crowdsecurity", + "content": "bmFtZTogY3Jvd2RzZWN1cml0eS9zaW1wbGUtYm90LWNoYWxsZW5nZQppbmJhbmQ6CiAgcG9zdF9ldmFsOgogICAgIyBTa2lwIHRoZSBjaGFsbGVuZ2UgZm9yIHZlcmlmaWVkIGdvb2QgYm90cyAoZm9yd2FyZC1jb25maXJtZWQgckROUykgYW5kIGZvciByZXF1ZXN0cyBhCiAgICAjIHdlbGwta25vd24tcGF0aCBleGNsdXNpb24gY29uZmlnIGZsYWdnZWQgdmlhIFNldExlZ2l0aW1hdGVCb3QoKS4gVGhlIGZsYWcgaXMgcGVyLXJlcXVlc3Qgb25seS4KICAgIC0gZmlsdGVyOiAiIUlzTGVnaXRpbWF0ZUJvdChyZXEuUmVtb3RlQWRkciwgcmVxLlVzZXJBZ2VudCgpLCByZXEuVVJMLlBhdGgpIgogICAgICBhcHBseToKICAgICAgICAtIFNlbmRDaGFsbGVuZ2UoKQogIG9uX2NoYWxsZW5nZV9zdWJtaXQ6CiAgICAjIFJlamVjdCBzdWJtaXNzaW9ucyB3aG9zZSBmaW5nZXJwcmludCBmYXN0LWRldGVjdCBmbGFncyBhIGtub3duIGJvdC4gVGhlIHJlc3VsdGluZyAicmVqZWN0ZWQiCiAgICAjIGV2ZW50IGZlZWRzIGNyb3dkc2VjdXJpdHkvYXBwc2VjLWJvdC1kZXRlY3RlZCAoYWxlcnQgb25seSwgbm8gYWN0aXZlIGJhbikuCiAgICAtIGZpbHRlcjogImZpbmdlcnByaW50LklzQm90KCkiCiAgICAgIGFwcGx5OgogICAgICAgIC0gUmVqZWN0U3VibWlzc2lvbigia25vd24gYm90IChmYXN0IGJvdCBkZXRlY3Rpb24pIikK", + "labels": null, + "path": "appsec-configs/crowdsecurity/simple-bot-challenge.yaml", + "version": "0.1", + "versions": { + "0.1": { + "deprecated": false, + "digest": "2881d29f726d947446981a828b16d6a6c32ae37bce272c51f05486ce865a2bfc" + } + } + }, "crowdsecurity/virtual-patching": { "author": "crowdsecurity", "content": "bmFtZTogY3Jvd2RzZWN1cml0eS92aXJ0dWFsLXBhdGNoaW5nCmRlZmF1bHRfcmVtZWRpYXRpb246IGJhbgppbmJhbmRfcnVsZXM6CiAtIGNyb3dkc2VjdXJpdHkvYmFzZS1jb25maWcgCiAtIGNyb3dkc2VjdXJpdHkvdnBhdGNoLSoK", @@ -7626,6 +7678,43 @@ } } }, + "crowdsecurity/appsec-bot-challenge": { + "appsec-configs": [ + "crowdsecurity/simple-bot-challenge", + "crowdsecurity/challenge-exclude-crawler-files", + "crowdsecurity/challenge-exclude-feeds", + "crowdsecurity/challenge-exclude-webhooks" + ], + "author": "crowdsecurity", + "content": "bmFtZTogY3Jvd2RzZWN1cml0eS9hcHBzZWMtYm90LWNoYWxsZW5nZQpwYXJzZXJzOgogIC0gY3Jvd2RzZWN1cml0eS9hcHBzZWMtbG9ncwogIC0gY3Jvd2RzZWN1cml0eS9hcHBzZWMtYm90LWRldGVjdGlvbi1sb2dzCmFwcHNlYy1jb25maWdzOgogIC0gY3Jvd2RzZWN1cml0eS9zaW1wbGUtYm90LWNoYWxsZW5nZQogIC0gY3Jvd2RzZWN1cml0eS9jaGFsbGVuZ2UtZXhjbHVkZS1jcmF3bGVyLWZpbGVzCiAgLSBjcm93ZHNlY3VyaXR5L2NoYWxsZW5nZS1leGNsdWRlLWZlZWRzCiAgLSBjcm93ZHNlY3VyaXR5L2NoYWxsZW5nZS1leGNsdWRlLXdlYmhvb2tzCnNjZW5hcmlvczoKICAtIGNyb3dkc2VjdXJpdHkvYXBwc2VjLWJvdC1kZXRlY3RlZAogIC0gY3Jvd2RzZWN1cml0eS9hcHBzZWMtY2hhbGxlbmdlLXRvby1tYW55LXJlcXVlc3RzCiAgLSBjcm93ZHNlY3VyaXR5L2FwcHNlYy1jaGFsbGVuZ2UtdG9vLW1hbnktc3VibWlzc2lvbnMKICAtIGNyb3dkc2VjdXJpdHkvYXBwc2VjLWNoYWxsZW5nZS1yZXF1ZXN0LXdpdGgtbm8tc3VibWlzc2lvbgpjb250ZXh0czoKICAtIGNyb3dkc2VjdXJpdHkvYXBwc2VjX2Jhc2UKICAtIGNyb3dkc2VjdXJpdHkvYXBwc2VjX2JvdF9kZXRlY3Rpb24KZGVzY3JpcHRpb246ICJBcHBTZWMgYm90IGRldGVjdGlvbjogY2hhbGxlbmdlIG1vZGUgd2l0aCBmYXN0LWRldGVjdCBib3QgcmVqZWN0aW9uIGFuZCB3ZWxsLWtub3duLXBhdGggZXhjbHVzaW9ucyIKbGFiZWxzOgogIGxhYmVsOiAiV0FGIC0gQm90IENoYWxsZW5nZSIKYXV0aG9yOiBjcm93ZHNlY3VyaXR5CnRhZ3M6CiAgLSB3YWYKICAtIGFwcHNlYwogIC0gaHR0cAogIC0gYm90Cg==", + "contexts": [ + "crowdsecurity/appsec_base", + "crowdsecurity/appsec_bot_detection" + ], + "description": "AppSec bot detection: challenge mode with fast-detect bot rejection and well-known-path exclusions", + "labels": { + "label": "WAF - Bot Challenge" + }, + "long_description": "IyBBcHBTZWMgQm90IENoYWxsZW5nZQoKVGhpcyBjb2xsZWN0aW9uIGVuYWJsZXMgQ3Jvd2RTZWMgQXBwU2VjICoqY2hhbGxlbmdlIG1vZGUqKiBmb3IgYm90IGRldGVjdGlvbjogdmlzaXRvcnMgYXJlIHNlcnZlZCBhCmxpZ2h0d2VpZ2h0IHByb29mLW9mLXdvcmsgKyBicm93c2VyLWZpbmdlcnByaW50IGNoYWxsZW5nZSwgYW5kIGNsaWVudHMgZmxhZ2dlZCBhcyBrbm93biBib3RzIGJ5IHRoZQpmYXN0IGJvdCBkZXRlY3Rpb24gYXJlIHJlamVjdGVkLgoKV2hhdCBpdCBzaGlwczoKCiAtIGBjcm93ZHNlY3VyaXR5L3NpbXBsZS1ib3QtY2hhbGxlbmdlYDogY2hhbGxlbmdlcyBpbmNvbWluZyByZXF1ZXN0cywgc2tpcHMgdmVyaWZpZWQgZ29vZCBib3RzCiAgIChmb3J3YXJkLWNvbmZpcm1lZCByRE5TKSwgYW5kIHJlamVjdHMgY2hhbGxlbmdlIHN1Ym1pc3Npb25zIHdob3NlIGZpbmdlcnByaW50IHRyaXBzIHRoZSBmYXN0IGJvdAogICBkZXRlY3Rpb24uCiAtIFdlbGwta25vd24tcGF0aCBleGNsdXNpb24gY29uZmlncyAoYGNoYWxsZW5nZS1leGNsdWRlLWNyYXdsZXItZmlsZXNgLCBgLWZlZWRzYCwgYC13ZWJob29rc2ApIHRoYXQKICAgbGV0IG1hY2hpbmUtZmFjaW5nIGVuZHBvaW50cyAoYC9yb2JvdHMudHh0YCwgYC8ud2VsbC1rbm93bi8qYCwgZmVlZHMsIHdlYmhvb2tzKSB0aHJvdWdoIHdpdGhvdXQgYQogICBjaGFsbGVuZ2UuIFRoZSBleGNsdXNpb24gaXMgc3RyaWN0bHkgcGVyLXJlcXVlc3QgYW5kIGlzIG5ldmVyIHBlcnNpc3RlZCB0byBhIGNvb2tpZSBvciBhY3Jvc3MKICAgcmVxdWVzdHMsIHNvIGl0IGNhbm5vdCBiZSBhYnVzZWQgdG8gd2hpdGVsaXN0IGEgc2Vzc2lvbiBmb3Igb3RoZXIgcGF0aHMuCiAtIEEgZGVkaWNhdGVkIGJvdC1kZXRlY3Rpb24gcGFyc2VyIHRyYWNraW5nIHRoZSBmaW5nZXJwcmludCBzZXNzaW9uIGlkIChgZnNpZGApIGFuZCBPUy4KIC0gU2NlbmFyaW9zIHRoYXQgYWxlcnQgb24gZGV0ZWN0ZWQgYm90cyBhbmQgb24gY2hhbGxlbmdlIGFidXNlLgogLSBBIHVzZXItZnJpZW5kbHkgYWxlcnQgY29udGV4dCBleHBvc2luZyBgZnNpZGAsIE9TLCBhbmQgdGhlIGJvdCBzaWduYWxzIHRoYXQgZmlyZWQuCgojIyBFbmFibGluZyBib3QgY2hhbGxlbmdlCgpBZGQgdGhlIGBjcm93ZHNlY3VyaXR5L3NpbXBsZS1ib3QtY2hhbGxlbmdlYCBhcHBzZWMtY29uZmlnIHRvIHlvdXIgV0FGIGFjcXVpc2l0aW9uLCBwbHVzIGFueSBvZiB0aGUKd2VsbC1rbm93bi1wYXRoIGV4Y2x1c2lvbiBjb25maWdzIHlvdSBuZWVkOgoKYGBgeWFtbAphcHBzZWNfY29uZmlnczoKIC0gY3Jvd2RzZWN1cml0eS9zaW1wbGUtYm90LWNoYWxsZW5nZQogLSBjcm93ZHNlY3VyaXR5L2NoYWxsZW5nZS1leGNsdWRlLWNyYXdsZXItZmlsZXMKIC0gY3Jvd2RzZWN1cml0eS9jaGFsbGVuZ2UtZXhjbHVkZS1mZWVkcwogLSBjcm93ZHNlY3VyaXR5L2NoYWxsZW5nZS1leGNsdWRlLXdlYmhvb2tzCmxhYmVsczoKICB0eXBlOiBhcHBzZWMKbGlzdGVuX2FkZHI6IDEyNy4wLjAuMTo3NDIyCnNvdXJjZTogYXBwc2VjCmBgYAo=", + "parsers": [ + "crowdsecurity/appsec-logs", + "crowdsecurity/appsec-bot-detection-logs" + ], + "path": "collections/crowdsecurity/appsec-bot-challenge.yaml", + "scenarios": [ + "crowdsecurity/appsec-bot-detected", + "crowdsecurity/appsec-challenge-too-many-requests", + "crowdsecurity/appsec-challenge-too-many-submissions", + "crowdsecurity/appsec-challenge-request-with-no-submission" + ], + "version": "0.1", + "versions": { + "0.1": { + "deprecated": false, + "digest": "84aa2d191df44e0bb6e0a6dc07df80054ae8872326a0f563de92746fa81cf93b" + } + } + }, "crowdsecurity/appsec-crs": { "appsec-configs": [ "crowdsecurity/crs" @@ -12933,6 +13022,19 @@ } } }, + "crowdsecurity/appsec_bot_detection": { + "author": "crowdsecurity", + "content": "IyBVc2VyLWZyaWVuZGx5IGNvbnRleHQgZm9yIEFwcFNlYyBib3QtZGV0ZWN0aW9uIC8gY2hhbGxlbmdlIGV2ZW50cy4KIyBFYWNoIGRldGVjdGVkX3NpZ25hbHMgbGluZSBlbWl0cyBhIHJlYWRhYmxlIHNpZ25hbCBuYW1lIG9ubHkgd2hlbiBpdHMgZmxhZyBpcyBzZXQsCiMgc28gdGhlIGNvbnNvbGUgc2hvd3MgYSBjb21wYWN0IGxpc3Qgb2Ygd2hhdCB0cmlwcGVkIHRoZSBmYXN0IGJvdCBkZXRlY3Rpb24uCmNvbnRleHQ6CiAgZmluZ2VycHJpbnRfaWQ6CiAgICAtIGV2dC5NZXRhLmZzaWQKICBvcGVyYXRpbmdfc3lzdGVtOgogICAgLSBldnQuTWV0YS5vcwogIHVzZXJfYWdlbnQ6CiAgICAtIGV2dC5NZXRhLmh0dHBfdXNlcl9hZ2VudAogIGJvdF9kZXRlY3RlZDoKICAgIC0gZXZ0Lk1ldGEuZmluZ2VycHJpbnRfYm90CiAgY2hhbGxlbmdlX2V2ZW50OgogICAgLSBldnQuTWV0YS5jaGFsbGVuZ2VfZXZlbnQKICBkZXRlY3RlZF9zaWduYWxzOgogICAgLSAiZXZ0LlVubWFyc2hhbGVkLmZpbmdlcnByaW50LkJvdC5XZWJkcml2ZXIgPyAnd2ViZHJpdmVyJyA6ICcnIgogICAgLSAiZXZ0LlVubWFyc2hhbGVkLmZpbmdlcnByaW50LkJvdC5TZWxlbml1bSA/ICdzZWxlbml1bScgOiAnJyIKICAgIC0gImV2dC5Vbm1hcnNoYWxlZC5maW5nZXJwcmludC5Cb3QuQ0RQID8gJ2Nocm9tZS1kZXZ0b29scy1wcm90b2NvbCcgOiAnJyIKICAgIC0gImV2dC5Vbm1hcnNoYWxlZC5maW5nZXJwcmludC5Cb3QuUGxheXdyaWdodCA/ICdwbGF5d3JpZ2h0JyA6ICcnIgogICAgLSAiZXZ0LlVubWFyc2hhbGVkLmZpbmdlcnByaW50LkJvdC5Cb3RVc2VyQWdlbnQgPyAnYm90LXVzZXItYWdlbnQnIDogJyciCiAgICAtICJldnQuVW5tYXJzaGFsZWQuZmluZ2VycHJpbnQuQm90Lk1pc3NpbmdDaHJvbWVPYmplY3QgPyAnaGVhZGxlc3MtY2hyb21lJyA6ICcnIgogICAgLSAiZXZ0LlVubWFyc2hhbGVkLmZpbmdlcnByaW50LkJvdC5QbGF0Zm9ybU1pc21hdGNoID8gJ3BsYXRmb3JtLW1pc21hdGNoJyA6ICcnIgogICAgLSAiZXZ0LlVubWFyc2hhbGVkLmZpbmdlcnByaW50LkJvdC5HUFVNaXNtYXRjaCA/ICdncHUtbWlzbWF0Y2gnIDogJyciCg==", + "labels": null, + "path": "contexts/crowdsecurity/appsec_bot_detection.yaml", + "version": "0.1", + "versions": { + "0.1": { + "deprecated": false, + "digest": "7d81f58a9af6a9898b60b3c201bbaec671e757a804d47fde2cd33b8230315af4" + } + } + }, "crowdsecurity/bf_base": { "author": "crowdsecurity", "content": "I2EgZ2VuZXJpYyBjb250ZXh0IGZvciBicnV0ZWZvcmNlIGJhc2VkIHNjZW5hcmlvcwpjb250ZXh0OgogIHRhcmdldF91c2VyOgogICAgLSBldnQuTWV0YS50YXJnZXRfdXNlcgo=", @@ -14040,14 +14142,29 @@ } } }, + "crowdsecurity/appsec-bot-detection-logs": { + "author": "crowdsecurity", + "content": "b25zdWNjZXNzOiBuZXh0X3N0YWdlCmZvcm1hdDogMy4wCiNkZWJ1ZzogdHJ1ZQpmaWx0ZXI6ICJldnQuUGFyc2VkLnByb2dyYW0gPT0gJ2FwcHNlYycgJiYgZXZ0LlBhcnNlZC5zb3VyY2UgPT0gJ2Nyb3dkc2VjLWFwcHNlYy1jaGFsbGVuZ2UnIgpuYW1lOiBjcm93ZHNlY3VyaXR5L2FwcHNlYy1ib3QtZGV0ZWN0aW9uLWxvZ3MKZGVzY3JpcHRpb246ICJQYXJzZSBBcHBTZWMgYm90LWRldGVjdGlvbiAvIGNoYWxsZW5nZSBldmVudHMiCnN0YXRpY3M6CiAgLSBtZXRhOiBzZXJ2aWNlCiAgICB2YWx1ZTogYXBwc2VjCiAgLSBtZXRhOiBsb2dfdHlwZQogICAgdmFsdWU6IGFwcHNlYy1jaGFsbGVuZ2UKICAtIG1ldGE6IHNvdXJjZV9pcAogICAgZXhwcmVzc2lvbjogImV2dC5QYXJzZWQuc291cmNlX2lwIgogIC0gbWV0YTogdGFyZ2V0X2hvc3QKICAgIGV4cHJlc3Npb246ICJldnQuUGFyc2VkLnRhcmdldF9ob3N0IgogIC0gbWV0YTogcmVxdWVzdF91dWlkCiAgICBleHByZXNzaW9uOiAiZXZ0LlBhcnNlZC5yZXFfdXVpZCIKICAtIG1ldGE6IHRhcmdldF91cmkKICAgIGV4cHJlc3Npb246ICJldnQuUGFyc2VkLnRhcmdldF91cmkiCiAgLSBtZXRhOiBjaGFsbGVuZ2VfZXZlbnQKICAgIGV4cHJlc3Npb246IGV2dC5QYXJzZWQuY2hhbGxlbmdlX2V2ZW50CiAgLSBtZXRhOiBjaGFsbGVuZ2VfZGlmZmljdWx0eQogICAgZXhwcmVzc2lvbjogZXZ0LlBhcnNlZC5jaGFsbGVuZ2VfZGlmZmljdWx0eQogIC0gbWV0YTogY2hhbGxlbmdlX2ZhaWxfcmVhc29uCiAgICBleHByZXNzaW9uOiBldnQuUGFyc2VkLmNoYWxsZW5nZV9mYWlsX3JlYXNvbgogIC0gbWV0YTogZnNpZAogICAgZXhwcmVzc2lvbjogZXZ0LlBhcnNlZC5mc2lkCiAgLSBtZXRhOiBmaW5nZXJwcmludF9ib3QKICAgIGV4cHJlc3Npb246IGV2dC5QYXJzZWQuZmluZ2VycHJpbnRfYm90CiAgLSBtZXRhOiBodHRwX3VzZXJfYWdlbnQKICAgIGV4cHJlc3Npb246IGV2dC5QYXJzZWQudXNlcl9hZ2VudAogICMgcmF3IG5hdmlnYXRvci5wbGF0Zm9ybSwga2VwdCBmb3IgcHJlY2lzZSBtYXRjaGluZwogIC0gbWV0YTogcGxhdGZvcm0KICAgIGV4cHJlc3Npb246IGV2dC5QYXJzZWQucGxhdGZvcm0KICAjIHVzZXItZnJpZW5kbHkgT1MgbGFiZWwgZGVyaXZlZCBmcm9tIHRoZSByYXcgcGxhdGZvcm0gc3RyaW5nCiAgLSBtZXRhOiBvcwogICAgZXhwcmVzc2lvbjogfAogICAgICBldnQuUGFyc2VkLnBsYXRmb3JtIGNvbnRhaW5zICJXaW4iID8gIldpbmRvd3MiIDoKICAgICAgKGV2dC5QYXJzZWQucGxhdGZvcm0gY29udGFpbnMgIk1hYyIgPyAibWFjT1MiIDoKICAgICAgKGV2dC5QYXJzZWQucGxhdGZvcm0gY29udGFpbnMgIkxpbnV4IiA/ICJMaW51eCIgOgogICAgICAoZXZ0LlBhcnNlZC5wbGF0Zm9ybSBjb250YWlucyAiaVBob25lIiB8fCBldnQuUGFyc2VkLnBsYXRmb3JtIGNvbnRhaW5zICJpUGFkIiA/ICJpT1MiIDoKICAgICAgKGV2dC5QYXJzZWQucGxhdGZvcm0gY29udGFpbnMgIkFuZHJvaWQiID8gIkFuZHJvaWQiIDogZXZ0LlBhcnNlZC5wbGF0Zm9ybSkpKSkK", + "description": "Parse AppSec bot-detection / challenge events", + "labels": null, + "path": "parsers/s01-parse/crowdsecurity/appsec-bot-detection-logs.yaml", + "stage": "s01-parse", + "version": "0.1", + "versions": { + "0.1": { + "deprecated": false, + "digest": "a492d46b716f7d703eaa9a5a2a16996c1c2e9f017b4e7f25aacbeb2a66d16f73" + } + } + }, "crowdsecurity/appsec-logs": { "author": "crowdsecurity", - "content": "b25zdWNjZXNzOiBuZXh0X3N0YWdlCmZvcm1hdDogMy4wCiNkZWJ1ZzogdHJ1ZQpmaWx0ZXI6ICJldnQuUGFyc2VkLnByb2dyYW0gPT0gJ2FwcHNlYyciCm5hbWU6IGNyb3dkc2VjdXJpdHkvYXBwc2VjLWxvZ3MKZGVzY3JpcHRpb246ICJQYXJzZSBBcHBzZWMgZXZlbnRzIgpzdGF0aWNzOgogIC0gbWV0YTogc2VydmljZQogICAgdmFsdWU6IGFwcHNlYwogIC0gbWV0YTogc291cmNlX2lwCiAgICBleHByZXNzaW9uOiAiZXZ0LlBhcnNlZC5zb3VyY2VfaXAiCiAgLSBtZXRhOiB0YXJnZXRfaG9zdAogICAgZXhwcmVzc2lvbjogImV2dC5QYXJzZWQudGFyZ2V0X2hvc3QiCiAgLSBtZXRhOiByZXF1ZXN0X3V1aWQKICAgIGV4cHJlc3Npb246ICJldnQuUGFyc2VkLnJlcV91dWlkIgogIC0gbWV0YTogdGFyZ2V0X3VyaQogICAgZXhwcmVzc2lvbjogImV2dC5QYXJzZWQudGFyZ2V0X3VyaSIKI3dhcyB0aGUgcmVxdWVzdCBibG9ja2VkID8KICAtIG1ldGE6IGxvZ190eXBlCiAgICBleHByZXNzaW9uOiB8CiAgICAgIGV2dC5BcHBzZWMuSGFzSW5CYW5kTWF0Y2hlcyA/ICJhcHBzZWMtYmxvY2siIDogImFwcHNlYy1pbmZvIgogIC0gbWV0YTogcnVsZV9uYW1lCiAgICBleHByZXNzaW9uOiBldnQuQXBwc2VjLkdldE5hbWUoKQogIC0gbWV0YTogcnVsZV9pZHMKICAgIGV4cHJlc3Npb246IFNwcmludGYoIiUrdiIsIGV2dC5BcHBzZWMuR2V0UnVsZUlEcygpKQogIC0gbWV0YTogcmVtZWRpYXRpb25fY21wdF9pcAogICAgZXhwcmVzc2lvbjogImV2dC5QYXJzZWQucmVtZWRpYXRpb25fY21wdF9pcCIK", + "content": "b25zdWNjZXNzOiBuZXh0X3N0YWdlCmZvcm1hdDogMy4wCiNkZWJ1ZzogdHJ1ZQpmaWx0ZXI6ICJldnQuUGFyc2VkLnByb2dyYW0gPT0gJ2FwcHNlYycgJiYgZXZ0LlBhcnNlZC5zb3VyY2UgIT0gJ2Nyb3dkc2VjLWFwcHNlYy1jaGFsbGVuZ2UnIgpuYW1lOiBjcm93ZHNlY3VyaXR5L2FwcHNlYy1sb2dzCmRlc2NyaXB0aW9uOiAiUGFyc2UgQXBwc2VjIGV2ZW50cyIKc3RhdGljczoKICAtIG1ldGE6IHNlcnZpY2UKICAgIHZhbHVlOiBhcHBzZWMKICAtIG1ldGE6IHNvdXJjZV9pcAogICAgZXhwcmVzc2lvbjogImV2dC5QYXJzZWQuc291cmNlX2lwIgogIC0gbWV0YTogdGFyZ2V0X2hvc3QKICAgIGV4cHJlc3Npb246ICJldnQuUGFyc2VkLnRhcmdldF9ob3N0IgogIC0gbWV0YTogcmVxdWVzdF91dWlkCiAgICBleHByZXNzaW9uOiAiZXZ0LlBhcnNlZC5yZXFfdXVpZCIKICAtIG1ldGE6IHRhcmdldF91cmkKICAgIGV4cHJlc3Npb246ICJldnQuUGFyc2VkLnRhcmdldF91cmkiCiN3YXMgdGhlIHJlcXVlc3QgYmxvY2tlZCA/CiAgLSBtZXRhOiBsb2dfdHlwZQogICAgZXhwcmVzc2lvbjogfAogICAgICBldnQuQXBwc2VjLkhhc0luQmFuZE1hdGNoZXMgPyAiYXBwc2VjLWJsb2NrIiA6ICJhcHBzZWMtaW5mbyIKICAtIG1ldGE6IHJ1bGVfbmFtZQogICAgZXhwcmVzc2lvbjogZXZ0LkFwcHNlYy5HZXROYW1lKCkKICAtIG1ldGE6IHJ1bGVfaWRzCiAgICBleHByZXNzaW9uOiBTcHJpbnRmKCIlK3YiLCBldnQuQXBwc2VjLkdldFJ1bGVJRHMoKSkKICAtIG1ldGE6IHJlbWVkaWF0aW9uX2NtcHRfaXAKICAgIGV4cHJlc3Npb246ICJldnQuUGFyc2VkLnJlbWVkaWF0aW9uX2NtcHRfaXAiCg==", "description": "Parse Appsec events", "labels": null, "path": "parsers/s01-parse/crowdsecurity/appsec-logs.yaml", "stage": "s01-parse", - "version": "0.5", + "version": "0.6", "versions": { "0.1": { "deprecated": false, @@ -14068,6 +14185,10 @@ "0.5": { "deprecated": false, "digest": "e44f2877c363061fef239a9af472253900674bf261e8762febd06d7ef20022a0" + }, + "0.6": { + "deprecated": false, + "digest": "7fd87e3e9de029b5db9a9fd8e1ccb40c33edeba05b084f802d04b2026683580f" } } }, @@ -19467,6 +19588,101 @@ } } }, + "crowdsecurity/appsec-bot-detected": { + "author": "crowdsecurity", + "content": "dHlwZTogdHJpZ2dlcgpmb3JtYXQ6IDMuMAojZGVidWc6IHRydWUKbmFtZTogY3Jvd2RzZWN1cml0eS9hcHBzZWMtYm90LWRldGVjdGVkCmRlc2NyaXB0aW9uOiAiQSBrbm93biBib3Qgd2FzIGRldGVjdGVkIGFuZCByZWplY3RlZCBieSB0aGUgQXBwU2VjIGNoYWxsZW5nZSAoZmFzdCBib3QgZGV0ZWN0aW9uKSIKZmlsdGVyOiAiZXZ0Lk1ldGEubG9nX3R5cGUgPT0gJ2FwcHNlYy1jaGFsbGVuZ2UnICYmIGV2dC5NZXRhLmNoYWxsZW5nZV9ldmVudCA9PSAncmVqZWN0ZWQnIgpncm91cGJ5OiBldnQuTWV0YS5zb3VyY2VfaXAKYmxhY2tob2xlOiAxbQpsYWJlbHM6CiAgc2VydmljZTogaHR0cAogIGNvbmZpZGVuY2U6IDEKICBzcG9vZmFibGU6IDAKICBjbGFzc2lmaWNhdGlvbjoKICAgIC0gYXR0YWNrLlQxMDcxCiAgbGFiZWw6ICJCb3QgZGV0ZWN0ZWQgYnkgQ3Jvd2RTZWMgQXBwU2VjIGNoYWxsZW5nZSIKICBiZWhhdmlvcjogImh0dHA6Ym90IgogIHJlbWVkaWF0aW9uOiBmYWxzZQo=", + "description": "A known bot was detected and rejected by the AppSec challenge (fast bot detection)", + "labels": { + "behavior": "http:bot", + "classification": [ + "attack.T1071" + ], + "confidence": 1, + "label": "Bot detected by CrowdSec AppSec challenge", + "remediation": false, + "service": "http", + "spoofable": 0 + }, + "path": "scenarios/crowdsecurity/appsec-bot-detected.yaml", + "version": "0.1", + "versions": { + "0.1": { + "deprecated": false, + "digest": "7a2061fa15c50f587158de5bd474b5a99e1f4a0b32e75ab5c112019e2d843461" + } + } + }, + "crowdsecurity/appsec-challenge-request-with-no-submission": { + "author": "crowdsecurity", + "content": "dHlwZTogY291bnRlcgpmb3JtYXQ6IDMuMAojZGVidWc6IHRydWUKbmFtZTogY3Jvd2RzZWN1cml0eS9hcHBzZWMtY2hhbGxlbmdlLXJlcXVlc3Qtd2l0aC1uby1zdWJtaXNzaW9uCmRlc2NyaXB0aW9uOiAiQ2xpZW50IG1hZGUgdG9vIG1hbnkgcmVxdWVzdCB0byBjaGFsbGVuZ2UgcGFnZSIKZmlsdGVyOiAiZXZ0Lk1ldGEubG9nX3R5cGUgPT0gJ2FwcHNlYy1jaGFsbGVuZ2UnICYmIChldnQuTWV0YS5jaGFsbGVuZ2VfZXZlbnQgPT0gJ3JlcXVlc3RlZCcgfHwgZXZ0Lk1ldGEuY2hhbGxlbmdlX2V2ZW50ID09ICdzdWJtaXR0ZWQnKSIKY2FuY2VsX29uOiAiZXZ0Lk1ldGEubG9nX3R5cGUgPT0gJ2FwcHNlYy1jaGFsbGVuZ2UnICYmIGV2dC5NZXRhLmNoYWxsZW5nZV9ldmVudCA9PSAnc3VibWl0dGVkJyIKZHVyYXRpb246IDYwcwpjYXBhY2l0eTogLTEKY2FjaGVfc2l6ZTogMQpncm91cGJ5OiBldnQuTWV0YS5zb3VyY2VfaXAKYmxhY2tob2xlOiAxMHMKbGFiZWxzOgogIHNlcnZpY2U6IGh0dHAKICBjb25maWRlbmNlOiAwCiAgc3Bvb2ZhYmxlOiAwCiAgY2xhc3NpZmljYXRpb246CiAgICAtIGF0dGFjay5UMTExMAogIGxhYmVsOiAiQmxvY2tlZCBieSBDcm93ZFNlYyBBcHBTZWMiCiAgYmVoYXZpb3I6ICJodHRwOmV4cGxvaXQiCg==", + "description": "Client made too many request to challenge page", + "labels": { + "behavior": "http:exploit", + "classification": [ + "attack.T1110" + ], + "confidence": 0, + "label": "Blocked by CrowdSec AppSec", + "service": "http", + "spoofable": 0 + }, + "path": "scenarios/crowdsecurity/appsec-challenge-request-with-no-submission.yaml", + "version": "0.1", + "versions": { + "0.1": { + "deprecated": false, + "digest": "69653e163e67a8a145056f7fe7f965a9ee802bf819038cad62790e3e18e0f6bd" + } + } + }, + "crowdsecurity/appsec-challenge-too-many-request": { + "author": "crowdsecurity", + "content": "dHlwZTogbGVha3kKZm9ybWF0OiAzLjAKI2RlYnVnOiB0cnVlCm5hbWU6IGNyb3dkc2VjdXJpdHkvYXBwc2VjLWNoYWxsZW5nZS10b28tbWFueS1yZXF1ZXN0cwpkZXNjcmlwdGlvbjogIkNsaWVudCBtYWRlIHRvbyBtYW55IHJlcXVlc3QgdG8gY2hhbGxlbmdlIHBhZ2UiCmZpbHRlcjogImV2dC5NZXRhLmxvZ190eXBlID09ICdhcHBzZWMtY2hhbGxlbmdlJyAmJiBldnQuTWV0YS5jaGFsbGVuZ2VfZXZlbnQgPT0gJ3JlcXVlc3RlZCciCmxlYWtzcGVlZDogIjYwcyIKY2FwYWNpdHk6IDUKZ3JvdXBieTogZXZ0Lk1ldGEuc291cmNlX2lwCmJsYWNraG9sZTogMW0KbGFiZWxzOgogIHNlcnZpY2U6IGh0dHAKICBjb25maWRlbmNlOiAwCiAgc3Bvb2ZhYmxlOiAwCiAgY2xhc3NpZmljYXRpb246CiAgICAtIGF0dGFjay5UMTExMAogIGxhYmVsOiAiQmxvY2tlZCBieSBDcm93ZFNlYyBBcHBTZWMiCiAgYmVoYXZpb3I6ICJodHRwOmV4cGxvaXQiCiAgcmVtZWRpYXRpb246IHRydWUK", + "description": "Client made too many request to challenge page", + "labels": { + "behavior": "http:exploit", + "classification": [ + "attack.T1110" + ], + "confidence": 0, + "label": "Blocked by CrowdSec AppSec", + "remediation": true, + "service": "http", + "spoofable": 0 + }, + "path": "scenarios/crowdsecurity/appsec-challenge-too-many-request.yaml", + "version": "0.1", + "versions": { + "0.1": { + "deprecated": false, + "digest": "c3b1fc73a9a5a59c109d3866929053d373f3cfef297e05114a202e2417b51d43" + } + } + }, + "crowdsecurity/appsec-challenge-too-many-submit": { + "author": "crowdsecurity", + "content": "dHlwZTogbGVha3kKZm9ybWF0OiAzLjAKI2RlYnVnOiB0cnVlCm5hbWU6IGNyb3dkc2VjdXJpdHkvYXBwc2VjLWNoYWxsZW5nZS10b28tbWFueS1zdWJtaXNzaW9ucwpkZXNjcmlwdGlvbjogIkNsaWVudCBtYWRlIHRvbyBtYW55IHN1Ym1pc3Npb25zIGZvciBjaGFsbGVuZ2UiCmZpbHRlcjogImV2dC5NZXRhLmxvZ190eXBlID09ICdhcHBzZWMtY2hhbGxlbmdlJyAmJiBldnQuTWV0YS5jaGFsbGVuZ2VfZXZlbnQgPT0gJ3N1Ym1pdHRlZCciCmxlYWtzcGVlZDogIjYwcyIKY2FwYWNpdHk6IDUKZ3JvdXBieTogZXZ0Lk1ldGEuc291cmNlX2lwCmJsYWNraG9sZTogMW0KbGFiZWxzOgogIHNlcnZpY2U6IGh0dHAKICBjb25maWRlbmNlOiAwCiAgc3Bvb2ZhYmxlOiAwCiAgY2xhc3NpZmljYXRpb246CiAgICAtIGF0dGFjay5UMTExMAogIGxhYmVsOiAiQmxvY2tlZCBieSBDcm93ZFNlYyBBcHBTZWMiCiAgYmVoYXZpb3I6ICJodHRwOmV4cGxvaXQiCiAgcmVtZWRpYXRpb246IHRydWUK", + "description": "Client made too many submissions for challenge", + "labels": { + "behavior": "http:exploit", + "classification": [ + "attack.T1110" + ], + "confidence": 0, + "label": "Blocked by CrowdSec AppSec", + "remediation": true, + "service": "http", + "spoofable": 0 + }, + "path": "scenarios/crowdsecurity/appsec-challenge-too-many-submit.yaml", + "version": "0.1", + "versions": { + "0.1": { + "deprecated": false, + "digest": "676043228fa24655c9d0d1bb340372edf0d3e5d9f4cc53a5dd0f58a525afcb4c" + } + } + }, "crowdsecurity/appsec-generic-test": { "author": "crowdsecurity", "content": "dHlwZTogdHJpZ2dlcgpmb3JtYXQ6IDMuMApuYW1lOiBjcm93ZHNlY3VyaXR5L2FwcHNlYy1nZW5lcmljLXRlc3QKZGVzY3JpcHRpb246ICJDcm93ZHNlYyBHZW5lcmljIFRlc3QgU2NlbmFyaW8gZm9yIEFwcFNlYzogZ2VuZXJhdGUgYW4gYWxlcnQgZm9yIGFwcHNlYyBvdXQgb2YgYmFuZCBydWxlIGZvciB0ZXN0aW5nIgpmaWx0ZXI6ICJldnQuTWV0YS5sb2dfdHlwZSA9PSAnYXBwc2VjLWluZm8nICYmIGV2dC5NZXRhLnJ1bGVfbmFtZSA9PSAnY3Jvd2RzZWN1cml0eS9hcHBzZWMtZ2VuZXJpYy10ZXN0JyIKZ3JvdXBieTogZXZ0Lk1ldGEuc291cmNlX2lwCmJsYWNraG9sZTogMW0KbGFiZWxzOgogIGNvbmZpZGVuY2U6IDAKICBzcG9vZmFibGU6IDMKICBiZWhhdmlvcjogImh0dHA6dGVzdCIKICBsYWJlbDogIkNyb3dkc2VjIEdlbmVyaWMgVGVzdCBTY2VuYXJpbyBmb3IgQXBwU2VjIgogIHNlcnZpY2U6IGh0dHAKICByZW1lZGlhdGlvbjogZmFsc2UK", From dc8dac3a2dfea6044f221f819fec8a78428fbd80 Mon Sep 17 00:00:00 2001 From: Thibault Koechlin Date: Mon, 15 Jun 2026 17:43:40 +0200 Subject: [PATCH 07/36] rename to make CI happy --- ...-many-request.yaml => appsec-challenge-too-many-requests.yaml} | 0 ...any-submit.yaml => appsec-challenge-too-many-submissions.yaml} | 0 2 files changed, 0 insertions(+), 0 deletions(-) rename scenarios/crowdsecurity/{appsec-challenge-too-many-request.yaml => appsec-challenge-too-many-requests.yaml} (100%) rename scenarios/crowdsecurity/{appsec-challenge-too-many-submit.yaml => appsec-challenge-too-many-submissions.yaml} (100%) diff --git a/scenarios/crowdsecurity/appsec-challenge-too-many-request.yaml b/scenarios/crowdsecurity/appsec-challenge-too-many-requests.yaml similarity index 100% rename from scenarios/crowdsecurity/appsec-challenge-too-many-request.yaml rename to scenarios/crowdsecurity/appsec-challenge-too-many-requests.yaml diff --git a/scenarios/crowdsecurity/appsec-challenge-too-many-submit.yaml b/scenarios/crowdsecurity/appsec-challenge-too-many-submissions.yaml similarity index 100% rename from scenarios/crowdsecurity/appsec-challenge-too-many-submit.yaml rename to scenarios/crowdsecurity/appsec-challenge-too-many-submissions.yaml From 85db8a91019ea1586f03355d14f91e889629200a Mon Sep 17 00:00:00 2001 From: GitHub Action Date: Mon, 15 Jun 2026 15:44:14 +0000 Subject: [PATCH 08/36] Update index --- .index.json | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/.index.json b/.index.json index 5c064c2cef6..8aa8e4c663e 100644 --- a/.index.json +++ b/.index.json @@ -19635,7 +19635,7 @@ } } }, - "crowdsecurity/appsec-challenge-too-many-request": { + "crowdsecurity/appsec-challenge-too-many-requests": { "author": "crowdsecurity", "content": "dHlwZTogbGVha3kKZm9ybWF0OiAzLjAKI2RlYnVnOiB0cnVlCm5hbWU6IGNyb3dkc2VjdXJpdHkvYXBwc2VjLWNoYWxsZW5nZS10b28tbWFueS1yZXF1ZXN0cwpkZXNjcmlwdGlvbjogIkNsaWVudCBtYWRlIHRvbyBtYW55IHJlcXVlc3QgdG8gY2hhbGxlbmdlIHBhZ2UiCmZpbHRlcjogImV2dC5NZXRhLmxvZ190eXBlID09ICdhcHBzZWMtY2hhbGxlbmdlJyAmJiBldnQuTWV0YS5jaGFsbGVuZ2VfZXZlbnQgPT0gJ3JlcXVlc3RlZCciCmxlYWtzcGVlZDogIjYwcyIKY2FwYWNpdHk6IDUKZ3JvdXBieTogZXZ0Lk1ldGEuc291cmNlX2lwCmJsYWNraG9sZTogMW0KbGFiZWxzOgogIHNlcnZpY2U6IGh0dHAKICBjb25maWRlbmNlOiAwCiAgc3Bvb2ZhYmxlOiAwCiAgY2xhc3NpZmljYXRpb246CiAgICAtIGF0dGFjay5UMTExMAogIGxhYmVsOiAiQmxvY2tlZCBieSBDcm93ZFNlYyBBcHBTZWMiCiAgYmVoYXZpb3I6ICJodHRwOmV4cGxvaXQiCiAgcmVtZWRpYXRpb246IHRydWUK", "description": "Client made too many request to challenge page", @@ -19650,7 +19650,7 @@ "service": "http", "spoofable": 0 }, - "path": "scenarios/crowdsecurity/appsec-challenge-too-many-request.yaml", + "path": "scenarios/crowdsecurity/appsec-challenge-too-many-requests.yaml", "version": "0.1", "versions": { "0.1": { @@ -19659,7 +19659,7 @@ } } }, - "crowdsecurity/appsec-challenge-too-many-submit": { + "crowdsecurity/appsec-challenge-too-many-submissions": { "author": "crowdsecurity", "content": "dHlwZTogbGVha3kKZm9ybWF0OiAzLjAKI2RlYnVnOiB0cnVlCm5hbWU6IGNyb3dkc2VjdXJpdHkvYXBwc2VjLWNoYWxsZW5nZS10b28tbWFueS1zdWJtaXNzaW9ucwpkZXNjcmlwdGlvbjogIkNsaWVudCBtYWRlIHRvbyBtYW55IHN1Ym1pc3Npb25zIGZvciBjaGFsbGVuZ2UiCmZpbHRlcjogImV2dC5NZXRhLmxvZ190eXBlID09ICdhcHBzZWMtY2hhbGxlbmdlJyAmJiBldnQuTWV0YS5jaGFsbGVuZ2VfZXZlbnQgPT0gJ3N1Ym1pdHRlZCciCmxlYWtzcGVlZDogIjYwcyIKY2FwYWNpdHk6IDUKZ3JvdXBieTogZXZ0Lk1ldGEuc291cmNlX2lwCmJsYWNraG9sZTogMW0KbGFiZWxzOgogIHNlcnZpY2U6IGh0dHAKICBjb25maWRlbmNlOiAwCiAgc3Bvb2ZhYmxlOiAwCiAgY2xhc3NpZmljYXRpb246CiAgICAtIGF0dGFjay5UMTExMAogIGxhYmVsOiAiQmxvY2tlZCBieSBDcm93ZFNlYyBBcHBTZWMiCiAgYmVoYXZpb3I6ICJodHRwOmV4cGxvaXQiCiAgcmVtZWRpYXRpb246IHRydWUK", "description": "Client made too many submissions for challenge", @@ -19674,7 +19674,7 @@ "service": "http", "spoofable": 0 }, - "path": "scenarios/crowdsecurity/appsec-challenge-too-many-submit.yaml", + "path": "scenarios/crowdsecurity/appsec-challenge-too-many-submissions.yaml", "version": "0.1", "versions": { "0.1": { From e1b67968c10c876617d97afbc253c052c953adb1 Mon Sep 17 00:00:00 2001 From: Thibault Koechlin Date: Tue, 16 Jun 2026 12:01:37 +0200 Subject: [PATCH 09/36] rely on existing methods instead --- contexts/crowdsecurity/appsec_bot_detection.yaml | 15 +++++---------- .../crowdsecurity/appsec-bot-detection-logs.yaml | 14 ++++---------- 2 files changed, 9 insertions(+), 20 deletions(-) diff --git a/contexts/crowdsecurity/appsec_bot_detection.yaml b/contexts/crowdsecurity/appsec_bot_detection.yaml index bbe99f516fd..21e33510619 100644 --- a/contexts/crowdsecurity/appsec_bot_detection.yaml +++ b/contexts/crowdsecurity/appsec_bot_detection.yaml @@ -1,6 +1,8 @@ # User-friendly context for AppSec bot-detection / challenge events. -# Each detected_signals line emits a readable signal name only when its flag is set, -# so the console shows a compact list of what tripped the fast bot detection. +# detected_signals uses the fingerprint helper BotSignals(), which returns the +# names of the fast-detection signals that fired; the alert-context engine +# renders the []string as a list. The nil guard covers "requested" events that +# carry no fingerprint. context: fingerprint_id: - evt.Meta.fsid @@ -13,11 +15,4 @@ context: challenge_event: - evt.Meta.challenge_event detected_signals: - - "evt.Unmarshaled.fingerprint.Bot.Webdriver ? 'webdriver' : ''" - - "evt.Unmarshaled.fingerprint.Bot.Selenium ? 'selenium' : ''" - - "evt.Unmarshaled.fingerprint.Bot.CDP ? 'chrome-devtools-protocol' : ''" - - "evt.Unmarshaled.fingerprint.Bot.Playwright ? 'playwright' : ''" - - "evt.Unmarshaled.fingerprint.Bot.BotUserAgent ? 'bot-user-agent' : ''" - - "evt.Unmarshaled.fingerprint.Bot.MissingChromeObject ? 'headless-chrome' : ''" - - "evt.Unmarshaled.fingerprint.Bot.PlatformMismatch ? 'platform-mismatch' : ''" - - "evt.Unmarshaled.fingerprint.Bot.GPUMismatch ? 'gpu-mismatch' : ''" + - 'evt.Unmarshaled.fingerprint != nil ? evt.Unmarshaled.fingerprint.BotSignals() : ""' diff --git a/parsers/s01-parse/crowdsecurity/appsec-bot-detection-logs.yaml b/parsers/s01-parse/crowdsecurity/appsec-bot-detection-logs.yaml index 8595c6ea565..80180bc72d6 100644 --- a/parsers/s01-parse/crowdsecurity/appsec-bot-detection-logs.yaml +++ b/parsers/s01-parse/crowdsecurity/appsec-bot-detection-logs.yaml @@ -29,14 +29,8 @@ statics: expression: evt.Parsed.fingerprint_bot - meta: http_user_agent expression: evt.Parsed.user_agent - # raw navigator.platform, kept for precise matching - - meta: platform - expression: evt.Parsed.platform - # user-friendly OS label derived from the raw platform string + # Friendly OS straight from the fingerprint helper (high-entropy client-hint + # platform, falling back to navigator.platform). The nil guard covers + # "requested" challenge events, which carry no fingerprint. - meta: os - expression: | - evt.Parsed.platform contains "Win" ? "Windows" : - (evt.Parsed.platform contains "Mac" ? "macOS" : - (evt.Parsed.platform contains "Linux" ? "Linux" : - (evt.Parsed.platform contains "iPhone" || evt.Parsed.platform contains "iPad" ? "iOS" : - (evt.Parsed.platform contains "Android" ? "Android" : evt.Parsed.platform)))) + expression: 'evt.Unmarshaled.fingerprint != nil ? evt.Unmarshaled.fingerprint.Platform() : ""' From 7a3a818fc76faeccf7457c436b6bb91e740a8294 Mon Sep 17 00:00:00 2001 From: GitHub Action Date: Tue, 16 Jun 2026 10:02:05 +0000 Subject: [PATCH 10/36] Update index --- .index.json | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-) diff --git a/.index.json b/.index.json index 8aa8e4c663e..3c28894773a 100644 --- a/.index.json +++ b/.index.json @@ -13024,14 +13024,18 @@ }, "crowdsecurity/appsec_bot_detection": { "author": "crowdsecurity", - "content": "IyBVc2VyLWZyaWVuZGx5IGNvbnRleHQgZm9yIEFwcFNlYyBib3QtZGV0ZWN0aW9uIC8gY2hhbGxlbmdlIGV2ZW50cy4KIyBFYWNoIGRldGVjdGVkX3NpZ25hbHMgbGluZSBlbWl0cyBhIHJlYWRhYmxlIHNpZ25hbCBuYW1lIG9ubHkgd2hlbiBpdHMgZmxhZyBpcyBzZXQsCiMgc28gdGhlIGNvbnNvbGUgc2hvd3MgYSBjb21wYWN0IGxpc3Qgb2Ygd2hhdCB0cmlwcGVkIHRoZSBmYXN0IGJvdCBkZXRlY3Rpb24uCmNvbnRleHQ6CiAgZmluZ2VycHJpbnRfaWQ6CiAgICAtIGV2dC5NZXRhLmZzaWQKICBvcGVyYXRpbmdfc3lzdGVtOgogICAgLSBldnQuTWV0YS5vcwogIHVzZXJfYWdlbnQ6CiAgICAtIGV2dC5NZXRhLmh0dHBfdXNlcl9hZ2VudAogIGJvdF9kZXRlY3RlZDoKICAgIC0gZXZ0Lk1ldGEuZmluZ2VycHJpbnRfYm90CiAgY2hhbGxlbmdlX2V2ZW50OgogICAgLSBldnQuTWV0YS5jaGFsbGVuZ2VfZXZlbnQKICBkZXRlY3RlZF9zaWduYWxzOgogICAgLSAiZXZ0LlVubWFyc2hhbGVkLmZpbmdlcnByaW50LkJvdC5XZWJkcml2ZXIgPyAnd2ViZHJpdmVyJyA6ICcnIgogICAgLSAiZXZ0LlVubWFyc2hhbGVkLmZpbmdlcnByaW50LkJvdC5TZWxlbml1bSA/ICdzZWxlbml1bScgOiAnJyIKICAgIC0gImV2dC5Vbm1hcnNoYWxlZC5maW5nZXJwcmludC5Cb3QuQ0RQID8gJ2Nocm9tZS1kZXZ0b29scy1wcm90b2NvbCcgOiAnJyIKICAgIC0gImV2dC5Vbm1hcnNoYWxlZC5maW5nZXJwcmludC5Cb3QuUGxheXdyaWdodCA/ICdwbGF5d3JpZ2h0JyA6ICcnIgogICAgLSAiZXZ0LlVubWFyc2hhbGVkLmZpbmdlcnByaW50LkJvdC5Cb3RVc2VyQWdlbnQgPyAnYm90LXVzZXItYWdlbnQnIDogJyciCiAgICAtICJldnQuVW5tYXJzaGFsZWQuZmluZ2VycHJpbnQuQm90Lk1pc3NpbmdDaHJvbWVPYmplY3QgPyAnaGVhZGxlc3MtY2hyb21lJyA6ICcnIgogICAgLSAiZXZ0LlVubWFyc2hhbGVkLmZpbmdlcnByaW50LkJvdC5QbGF0Zm9ybU1pc21hdGNoID8gJ3BsYXRmb3JtLW1pc21hdGNoJyA6ICcnIgogICAgLSAiZXZ0LlVubWFyc2hhbGVkLmZpbmdlcnByaW50LkJvdC5HUFVNaXNtYXRjaCA/ICdncHUtbWlzbWF0Y2gnIDogJyciCg==", + "content": "IyBVc2VyLWZyaWVuZGx5IGNvbnRleHQgZm9yIEFwcFNlYyBib3QtZGV0ZWN0aW9uIC8gY2hhbGxlbmdlIGV2ZW50cy4KIyBkZXRlY3RlZF9zaWduYWxzIHVzZXMgdGhlIGZpbmdlcnByaW50IGhlbHBlciBCb3RTaWduYWxzKCksIHdoaWNoIHJldHVybnMgdGhlCiMgbmFtZXMgb2YgdGhlIGZhc3QtZGV0ZWN0aW9uIHNpZ25hbHMgdGhhdCBmaXJlZDsgdGhlIGFsZXJ0LWNvbnRleHQgZW5naW5lCiMgcmVuZGVycyB0aGUgW11zdHJpbmcgYXMgYSBsaXN0LiBUaGUgbmlsIGd1YXJkIGNvdmVycyAicmVxdWVzdGVkIiBldmVudHMgdGhhdAojIGNhcnJ5IG5vIGZpbmdlcnByaW50Lgpjb250ZXh0OgogIGZpbmdlcnByaW50X2lkOgogICAgLSBldnQuTWV0YS5mc2lkCiAgb3BlcmF0aW5nX3N5c3RlbToKICAgIC0gZXZ0Lk1ldGEub3MKICB1c2VyX2FnZW50OgogICAgLSBldnQuTWV0YS5odHRwX3VzZXJfYWdlbnQKICBib3RfZGV0ZWN0ZWQ6CiAgICAtIGV2dC5NZXRhLmZpbmdlcnByaW50X2JvdAogIGNoYWxsZW5nZV9ldmVudDoKICAgIC0gZXZ0Lk1ldGEuY2hhbGxlbmdlX2V2ZW50CiAgZGV0ZWN0ZWRfc2lnbmFsczoKICAgIC0gJ2V2dC5Vbm1hcnNoYWxlZC5maW5nZXJwcmludCAhPSBuaWwgPyBldnQuVW5tYXJzaGFsZWQuZmluZ2VycHJpbnQuQm90U2lnbmFscygpIDogIiInCg==", "labels": null, "path": "contexts/crowdsecurity/appsec_bot_detection.yaml", - "version": "0.1", + "version": "0.2", "versions": { "0.1": { "deprecated": false, "digest": "7d81f58a9af6a9898b60b3c201bbaec671e757a804d47fde2cd33b8230315af4" + }, + "0.2": { + "deprecated": false, + "digest": "15eaa25aaa8095fcc5dc9bae535d18ba3f53be6f17a5a6a9fd8e146248ebc53c" } } }, @@ -14144,16 +14148,20 @@ }, "crowdsecurity/appsec-bot-detection-logs": { "author": "crowdsecurity", - "content": "b25zdWNjZXNzOiBuZXh0X3N0YWdlCmZvcm1hdDogMy4wCiNkZWJ1ZzogdHJ1ZQpmaWx0ZXI6ICJldnQuUGFyc2VkLnByb2dyYW0gPT0gJ2FwcHNlYycgJiYgZXZ0LlBhcnNlZC5zb3VyY2UgPT0gJ2Nyb3dkc2VjLWFwcHNlYy1jaGFsbGVuZ2UnIgpuYW1lOiBjcm93ZHNlY3VyaXR5L2FwcHNlYy1ib3QtZGV0ZWN0aW9uLWxvZ3MKZGVzY3JpcHRpb246ICJQYXJzZSBBcHBTZWMgYm90LWRldGVjdGlvbiAvIGNoYWxsZW5nZSBldmVudHMiCnN0YXRpY3M6CiAgLSBtZXRhOiBzZXJ2aWNlCiAgICB2YWx1ZTogYXBwc2VjCiAgLSBtZXRhOiBsb2dfdHlwZQogICAgdmFsdWU6IGFwcHNlYy1jaGFsbGVuZ2UKICAtIG1ldGE6IHNvdXJjZV9pcAogICAgZXhwcmVzc2lvbjogImV2dC5QYXJzZWQuc291cmNlX2lwIgogIC0gbWV0YTogdGFyZ2V0X2hvc3QKICAgIGV4cHJlc3Npb246ICJldnQuUGFyc2VkLnRhcmdldF9ob3N0IgogIC0gbWV0YTogcmVxdWVzdF91dWlkCiAgICBleHByZXNzaW9uOiAiZXZ0LlBhcnNlZC5yZXFfdXVpZCIKICAtIG1ldGE6IHRhcmdldF91cmkKICAgIGV4cHJlc3Npb246ICJldnQuUGFyc2VkLnRhcmdldF91cmkiCiAgLSBtZXRhOiBjaGFsbGVuZ2VfZXZlbnQKICAgIGV4cHJlc3Npb246IGV2dC5QYXJzZWQuY2hhbGxlbmdlX2V2ZW50CiAgLSBtZXRhOiBjaGFsbGVuZ2VfZGlmZmljdWx0eQogICAgZXhwcmVzc2lvbjogZXZ0LlBhcnNlZC5jaGFsbGVuZ2VfZGlmZmljdWx0eQogIC0gbWV0YTogY2hhbGxlbmdlX2ZhaWxfcmVhc29uCiAgICBleHByZXNzaW9uOiBldnQuUGFyc2VkLmNoYWxsZW5nZV9mYWlsX3JlYXNvbgogIC0gbWV0YTogZnNpZAogICAgZXhwcmVzc2lvbjogZXZ0LlBhcnNlZC5mc2lkCiAgLSBtZXRhOiBmaW5nZXJwcmludF9ib3QKICAgIGV4cHJlc3Npb246IGV2dC5QYXJzZWQuZmluZ2VycHJpbnRfYm90CiAgLSBtZXRhOiBodHRwX3VzZXJfYWdlbnQKICAgIGV4cHJlc3Npb246IGV2dC5QYXJzZWQudXNlcl9hZ2VudAogICMgcmF3IG5hdmlnYXRvci5wbGF0Zm9ybSwga2VwdCBmb3IgcHJlY2lzZSBtYXRjaGluZwogIC0gbWV0YTogcGxhdGZvcm0KICAgIGV4cHJlc3Npb246IGV2dC5QYXJzZWQucGxhdGZvcm0KICAjIHVzZXItZnJpZW5kbHkgT1MgbGFiZWwgZGVyaXZlZCBmcm9tIHRoZSByYXcgcGxhdGZvcm0gc3RyaW5nCiAgLSBtZXRhOiBvcwogICAgZXhwcmVzc2lvbjogfAogICAgICBldnQuUGFyc2VkLnBsYXRmb3JtIGNvbnRhaW5zICJXaW4iID8gIldpbmRvd3MiIDoKICAgICAgKGV2dC5QYXJzZWQucGxhdGZvcm0gY29udGFpbnMgIk1hYyIgPyAibWFjT1MiIDoKICAgICAgKGV2dC5QYXJzZWQucGxhdGZvcm0gY29udGFpbnMgIkxpbnV4IiA/ICJMaW51eCIgOgogICAgICAoZXZ0LlBhcnNlZC5wbGF0Zm9ybSBjb250YWlucyAiaVBob25lIiB8fCBldnQuUGFyc2VkLnBsYXRmb3JtIGNvbnRhaW5zICJpUGFkIiA/ICJpT1MiIDoKICAgICAgKGV2dC5QYXJzZWQucGxhdGZvcm0gY29udGFpbnMgIkFuZHJvaWQiID8gIkFuZHJvaWQiIDogZXZ0LlBhcnNlZC5wbGF0Zm9ybSkpKSkK", + "content": "b25zdWNjZXNzOiBuZXh0X3N0YWdlCmZvcm1hdDogMy4wCiNkZWJ1ZzogdHJ1ZQpmaWx0ZXI6ICJldnQuUGFyc2VkLnByb2dyYW0gPT0gJ2FwcHNlYycgJiYgZXZ0LlBhcnNlZC5zb3VyY2UgPT0gJ2Nyb3dkc2VjLWFwcHNlYy1jaGFsbGVuZ2UnIgpuYW1lOiBjcm93ZHNlY3VyaXR5L2FwcHNlYy1ib3QtZGV0ZWN0aW9uLWxvZ3MKZGVzY3JpcHRpb246ICJQYXJzZSBBcHBTZWMgYm90LWRldGVjdGlvbiAvIGNoYWxsZW5nZSBldmVudHMiCnN0YXRpY3M6CiAgLSBtZXRhOiBzZXJ2aWNlCiAgICB2YWx1ZTogYXBwc2VjCiAgLSBtZXRhOiBsb2dfdHlwZQogICAgdmFsdWU6IGFwcHNlYy1jaGFsbGVuZ2UKICAtIG1ldGE6IHNvdXJjZV9pcAogICAgZXhwcmVzc2lvbjogImV2dC5QYXJzZWQuc291cmNlX2lwIgogIC0gbWV0YTogdGFyZ2V0X2hvc3QKICAgIGV4cHJlc3Npb246ICJldnQuUGFyc2VkLnRhcmdldF9ob3N0IgogIC0gbWV0YTogcmVxdWVzdF91dWlkCiAgICBleHByZXNzaW9uOiAiZXZ0LlBhcnNlZC5yZXFfdXVpZCIKICAtIG1ldGE6IHRhcmdldF91cmkKICAgIGV4cHJlc3Npb246ICJldnQuUGFyc2VkLnRhcmdldF91cmkiCiAgLSBtZXRhOiBjaGFsbGVuZ2VfZXZlbnQKICAgIGV4cHJlc3Npb246IGV2dC5QYXJzZWQuY2hhbGxlbmdlX2V2ZW50CiAgLSBtZXRhOiBjaGFsbGVuZ2VfZGlmZmljdWx0eQogICAgZXhwcmVzc2lvbjogZXZ0LlBhcnNlZC5jaGFsbGVuZ2VfZGlmZmljdWx0eQogIC0gbWV0YTogY2hhbGxlbmdlX2ZhaWxfcmVhc29uCiAgICBleHByZXNzaW9uOiBldnQuUGFyc2VkLmNoYWxsZW5nZV9mYWlsX3JlYXNvbgogIC0gbWV0YTogZnNpZAogICAgZXhwcmVzc2lvbjogZXZ0LlBhcnNlZC5mc2lkCiAgLSBtZXRhOiBmaW5nZXJwcmludF9ib3QKICAgIGV4cHJlc3Npb246IGV2dC5QYXJzZWQuZmluZ2VycHJpbnRfYm90CiAgLSBtZXRhOiBodHRwX3VzZXJfYWdlbnQKICAgIGV4cHJlc3Npb246IGV2dC5QYXJzZWQudXNlcl9hZ2VudAogICMgRnJpZW5kbHkgT1Mgc3RyYWlnaHQgZnJvbSB0aGUgZmluZ2VycHJpbnQgaGVscGVyIChoaWdoLWVudHJvcHkgY2xpZW50LWhpbnQKICAjIHBsYXRmb3JtLCBmYWxsaW5nIGJhY2sgdG8gbmF2aWdhdG9yLnBsYXRmb3JtKS4gVGhlIG5pbCBndWFyZCBjb3ZlcnMKICAjICJyZXF1ZXN0ZWQiIGNoYWxsZW5nZSBldmVudHMsIHdoaWNoIGNhcnJ5IG5vIGZpbmdlcnByaW50LgogIC0gbWV0YTogb3MKICAgIGV4cHJlc3Npb246ICdldnQuVW5tYXJzaGFsZWQuZmluZ2VycHJpbnQgIT0gbmlsID8gZXZ0LlVubWFyc2hhbGVkLmZpbmdlcnByaW50LlBsYXRmb3JtKCkgOiAiIicK", "description": "Parse AppSec bot-detection / challenge events", "labels": null, "path": "parsers/s01-parse/crowdsecurity/appsec-bot-detection-logs.yaml", "stage": "s01-parse", - "version": "0.1", + "version": "0.2", "versions": { "0.1": { "deprecated": false, "digest": "a492d46b716f7d703eaa9a5a2a16996c1c2e9f017b4e7f25aacbeb2a66d16f73" + }, + "0.2": { + "deprecated": false, + "digest": "47b2621471cd10525443c3ed0e1e29720f00c3e943c2315d1504b887f3c66bc9" } } }, From dcd5f0561b0e449f7890b05b306383bda1d15a96 Mon Sep 17 00:00:00 2001 From: Thibault Koechlin Date: Thu, 18 Jun 2026 09:40:34 +0200 Subject: [PATCH 11/36] reflect helper change --- .../crowdsecurity/challenge-exclude-crawler-files.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/appsec-configs/crowdsecurity/challenge-exclude-crawler-files.yaml b/appsec-configs/crowdsecurity/challenge-exclude-crawler-files.yaml index f166f120346..a629e437361 100644 --- a/appsec-configs/crowdsecurity/challenge-exclude-crawler-files.yaml +++ b/appsec-configs/crowdsecurity/challenge-exclude-crawler-files.yaml @@ -1,5 +1,5 @@ name: crowdsecurity/challenge-exclude-crawler-files -# Let well-known crawler files fly through without a challenge. SetLegitimateBot() is +# Let well-known crawler files fly through without a challenge. ExemptFromChallenge() is # strictly per-request (never persisted to a cookie or across requests), so this cannot # be abused to whitelist a session for other paths. inband: @@ -8,4 +8,4 @@ inband: req.URL.Path in ['/robots.txt', '/ads.txt', '/app-ads.txt', '/sitemap.xml'] || req.URL.Path startsWith '/.well-known/' apply: - - SetLegitimateBot() + - ExemptFromChallenge() From 5fe9fdd45dd8d46d0f31bf9feaa8f04945cff6e1 Mon Sep 17 00:00:00 2001 From: Thibault Koechlin Date: Thu, 18 Jun 2026 09:40:47 +0200 Subject: [PATCH 12/36] reflect helper change --- appsec-configs/crowdsecurity/simple-bot-challenge.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/appsec-configs/crowdsecurity/simple-bot-challenge.yaml b/appsec-configs/crowdsecurity/simple-bot-challenge.yaml index 259d32bdf00..fa6a22c649e 100644 --- a/appsec-configs/crowdsecurity/simple-bot-challenge.yaml +++ b/appsec-configs/crowdsecurity/simple-bot-challenge.yaml @@ -2,7 +2,7 @@ name: crowdsecurity/simple-bot-challenge inband: post_eval: # Skip the challenge for verified good bots (forward-confirmed rDNS) and for requests a - # well-known-path exclusion config flagged via SetLegitimateBot(). The flag is per-request only. + # well-known-path exclusion config flagged via ExemptFromChallenge(). The flag is per-request only. - filter: "!IsLegitimateBot(req.RemoteAddr, req.UserAgent(), req.URL.Path)" apply: - SendChallenge() From 54eb693bad71a819802f7525ed1f9c5b508c7b56 Mon Sep 17 00:00:00 2001 From: Thibault Koechlin Date: Fri, 19 Jun 2026 15:19:47 +0200 Subject: [PATCH 13/36] add the appsec-rules tracking data files --- collections/crowdsecurity/appsec-bot-challenge.yaml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/collections/crowdsecurity/appsec-bot-challenge.yaml b/collections/crowdsecurity/appsec-bot-challenge.yaml index 058352dd4c5..13af9ec5be6 100644 --- a/collections/crowdsecurity/appsec-bot-challenge.yaml +++ b/collections/crowdsecurity/appsec-bot-challenge.yaml @@ -7,6 +7,8 @@ appsec-configs: - crowdsecurity/challenge-exclude-crawler-files - crowdsecurity/challenge-exclude-feeds - crowdsecurity/challenge-exclude-webhooks +appsec-rules: + - crowdsecurity/legit-bots scenarios: - crowdsecurity/appsec-bot-detected - crowdsecurity/appsec-challenge-too-many-requests From 10943ab2dc3c7bc56fa99dd3d3bc28d2a0055364 Mon Sep 17 00:00:00 2001 From: GitHub Action Date: Fri, 19 Jun 2026 13:20:06 +0000 Subject: [PATCH 14/36] Update index --- .index.json | 27 +++++++++++++++++++++------ 1 file changed, 21 insertions(+), 6 deletions(-) diff --git a/.index.json b/.index.json index 3c28894773a..49146df15ad 100644 --- a/.index.json +++ b/.index.json @@ -27,14 +27,18 @@ }, "crowdsecurity/challenge-exclude-crawler-files": { "author": "crowdsecurity", - "content": "bmFtZTogY3Jvd2RzZWN1cml0eS9jaGFsbGVuZ2UtZXhjbHVkZS1jcmF3bGVyLWZpbGVzCiMgTGV0IHdlbGwta25vd24gY3Jhd2xlciBmaWxlcyBmbHkgdGhyb3VnaCB3aXRob3V0IGEgY2hhbGxlbmdlLiBTZXRMZWdpdGltYXRlQm90KCkgaXMKIyBzdHJpY3RseSBwZXItcmVxdWVzdCAobmV2ZXIgcGVyc2lzdGVkIHRvIGEgY29va2llIG9yIGFjcm9zcyByZXF1ZXN0cyksIHNvIHRoaXMgY2Fubm90CiMgYmUgYWJ1c2VkIHRvIHdoaXRlbGlzdCBhIHNlc3Npb24gZm9yIG90aGVyIHBhdGhzLgppbmJhbmQ6CiAgcHJlX2V2YWw6CiAgICAtIGZpbHRlcjogPi0KICAgICAgICByZXEuVVJMLlBhdGggaW4gWycvcm9ib3RzLnR4dCcsICcvYWRzLnR4dCcsICcvYXBwLWFkcy50eHQnLCAnL3NpdGVtYXAueG1sJ10gfHwKICAgICAgICByZXEuVVJMLlBhdGggc3RhcnRzV2l0aCAnLy53ZWxsLWtub3duLycKICAgICAgYXBwbHk6CiAgICAgICAgLSBTZXRMZWdpdGltYXRlQm90KCkK", + "content": "bmFtZTogY3Jvd2RzZWN1cml0eS9jaGFsbGVuZ2UtZXhjbHVkZS1jcmF3bGVyLWZpbGVzCiMgTGV0IHdlbGwta25vd24gY3Jhd2xlciBmaWxlcyBmbHkgdGhyb3VnaCB3aXRob3V0IGEgY2hhbGxlbmdlLiBFeGVtcHRGcm9tQ2hhbGxlbmdlKCkgaXMKIyBzdHJpY3RseSBwZXItcmVxdWVzdCAobmV2ZXIgcGVyc2lzdGVkIHRvIGEgY29va2llIG9yIGFjcm9zcyByZXF1ZXN0cyksIHNvIHRoaXMgY2Fubm90CiMgYmUgYWJ1c2VkIHRvIHdoaXRlbGlzdCBhIHNlc3Npb24gZm9yIG90aGVyIHBhdGhzLgppbmJhbmQ6CiAgcHJlX2V2YWw6CiAgICAtIGZpbHRlcjogPi0KICAgICAgICByZXEuVVJMLlBhdGggaW4gWycvcm9ib3RzLnR4dCcsICcvYWRzLnR4dCcsICcvYXBwLWFkcy50eHQnLCAnL3NpdGVtYXAueG1sJ10gfHwKICAgICAgICByZXEuVVJMLlBhdGggc3RhcnRzV2l0aCAnLy53ZWxsLWtub3duLycKICAgICAgYXBwbHk6CiAgICAgICAgLSBFeGVtcHRGcm9tQ2hhbGxlbmdlKCkK", "labels": null, "path": "appsec-configs/crowdsecurity/challenge-exclude-crawler-files.yaml", - "version": "0.1", + "version": "0.2", "versions": { "0.1": { "deprecated": false, "digest": "f00a72b94fd2f59257b70b0433a7d2e273d70a0ae1b3ac96c5e745e72d30c769" + }, + "0.2": { + "deprecated": false, + "digest": "c1834bcf1447bc74f0dc47f58af65cbb9a2a180092286a75111b0f8d941874e5" } } }, @@ -133,14 +137,18 @@ }, "crowdsecurity/simple-bot-challenge": { "author": "crowdsecurity", - "content": "bmFtZTogY3Jvd2RzZWN1cml0eS9zaW1wbGUtYm90LWNoYWxsZW5nZQppbmJhbmQ6CiAgcG9zdF9ldmFsOgogICAgIyBTa2lwIHRoZSBjaGFsbGVuZ2UgZm9yIHZlcmlmaWVkIGdvb2QgYm90cyAoZm9yd2FyZC1jb25maXJtZWQgckROUykgYW5kIGZvciByZXF1ZXN0cyBhCiAgICAjIHdlbGwta25vd24tcGF0aCBleGNsdXNpb24gY29uZmlnIGZsYWdnZWQgdmlhIFNldExlZ2l0aW1hdGVCb3QoKS4gVGhlIGZsYWcgaXMgcGVyLXJlcXVlc3Qgb25seS4KICAgIC0gZmlsdGVyOiAiIUlzTGVnaXRpbWF0ZUJvdChyZXEuUmVtb3RlQWRkciwgcmVxLlVzZXJBZ2VudCgpLCByZXEuVVJMLlBhdGgpIgogICAgICBhcHBseToKICAgICAgICAtIFNlbmRDaGFsbGVuZ2UoKQogIG9uX2NoYWxsZW5nZV9zdWJtaXQ6CiAgICAjIFJlamVjdCBzdWJtaXNzaW9ucyB3aG9zZSBmaW5nZXJwcmludCBmYXN0LWRldGVjdCBmbGFncyBhIGtub3duIGJvdC4gVGhlIHJlc3VsdGluZyAicmVqZWN0ZWQiCiAgICAjIGV2ZW50IGZlZWRzIGNyb3dkc2VjdXJpdHkvYXBwc2VjLWJvdC1kZXRlY3RlZCAoYWxlcnQgb25seSwgbm8gYWN0aXZlIGJhbikuCiAgICAtIGZpbHRlcjogImZpbmdlcnByaW50LklzQm90KCkiCiAgICAgIGFwcGx5OgogICAgICAgIC0gUmVqZWN0U3VibWlzc2lvbigia25vd24gYm90IChmYXN0IGJvdCBkZXRlY3Rpb24pIikK", + "content": "bmFtZTogY3Jvd2RzZWN1cml0eS9zaW1wbGUtYm90LWNoYWxsZW5nZQppbmJhbmQ6CiAgcG9zdF9ldmFsOgogICAgIyBTa2lwIHRoZSBjaGFsbGVuZ2UgZm9yIHZlcmlmaWVkIGdvb2QgYm90cyAoZm9yd2FyZC1jb25maXJtZWQgckROUykgYW5kIGZvciByZXF1ZXN0cyBhCiAgICAjIHdlbGwta25vd24tcGF0aCBleGNsdXNpb24gY29uZmlnIGZsYWdnZWQgdmlhIEV4ZW1wdEZyb21DaGFsbGVuZ2UoKS4gVGhlIGZsYWcgaXMgcGVyLXJlcXVlc3Qgb25seS4KICAgIC0gZmlsdGVyOiAiIUlzTGVnaXRpbWF0ZUJvdChyZXEuUmVtb3RlQWRkciwgcmVxLlVzZXJBZ2VudCgpLCByZXEuVVJMLlBhdGgpIgogICAgICBhcHBseToKICAgICAgICAtIFNlbmRDaGFsbGVuZ2UoKQogIG9uX2NoYWxsZW5nZV9zdWJtaXQ6CiAgICAjIFJlamVjdCBzdWJtaXNzaW9ucyB3aG9zZSBmaW5nZXJwcmludCBmYXN0LWRldGVjdCBmbGFncyBhIGtub3duIGJvdC4gVGhlIHJlc3VsdGluZyAicmVqZWN0ZWQiCiAgICAjIGV2ZW50IGZlZWRzIGNyb3dkc2VjdXJpdHkvYXBwc2VjLWJvdC1kZXRlY3RlZCAoYWxlcnQgb25seSwgbm8gYWN0aXZlIGJhbikuCiAgICAtIGZpbHRlcjogImZpbmdlcnByaW50LklzQm90KCkiCiAgICAgIGFwcGx5OgogICAgICAgIC0gUmVqZWN0U3VibWlzc2lvbigia25vd24gYm90IChmYXN0IGJvdCBkZXRlY3Rpb24pIikK", "labels": null, "path": "appsec-configs/crowdsecurity/simple-bot-challenge.yaml", - "version": "0.1", + "version": "0.2", "versions": { "0.1": { "deprecated": false, "digest": "2881d29f726d947446981a828b16d6a6c32ae37bce272c51f05486ce865a2bfc" + }, + "0.2": { + "deprecated": false, + "digest": "044193fe0e4a13447e86f9e57b1717ab95ba21b1d94d2c8b5b30d1723201f386" } } }, @@ -7685,8 +7693,11 @@ "crowdsecurity/challenge-exclude-feeds", "crowdsecurity/challenge-exclude-webhooks" ], + "appsec-rules": [ + "crowdsecurity/legit-bots" + ], "author": "crowdsecurity", - "content": "bmFtZTogY3Jvd2RzZWN1cml0eS9hcHBzZWMtYm90LWNoYWxsZW5nZQpwYXJzZXJzOgogIC0gY3Jvd2RzZWN1cml0eS9hcHBzZWMtbG9ncwogIC0gY3Jvd2RzZWN1cml0eS9hcHBzZWMtYm90LWRldGVjdGlvbi1sb2dzCmFwcHNlYy1jb25maWdzOgogIC0gY3Jvd2RzZWN1cml0eS9zaW1wbGUtYm90LWNoYWxsZW5nZQogIC0gY3Jvd2RzZWN1cml0eS9jaGFsbGVuZ2UtZXhjbHVkZS1jcmF3bGVyLWZpbGVzCiAgLSBjcm93ZHNlY3VyaXR5L2NoYWxsZW5nZS1leGNsdWRlLWZlZWRzCiAgLSBjcm93ZHNlY3VyaXR5L2NoYWxsZW5nZS1leGNsdWRlLXdlYmhvb2tzCnNjZW5hcmlvczoKICAtIGNyb3dkc2VjdXJpdHkvYXBwc2VjLWJvdC1kZXRlY3RlZAogIC0gY3Jvd2RzZWN1cml0eS9hcHBzZWMtY2hhbGxlbmdlLXRvby1tYW55LXJlcXVlc3RzCiAgLSBjcm93ZHNlY3VyaXR5L2FwcHNlYy1jaGFsbGVuZ2UtdG9vLW1hbnktc3VibWlzc2lvbnMKICAtIGNyb3dkc2VjdXJpdHkvYXBwc2VjLWNoYWxsZW5nZS1yZXF1ZXN0LXdpdGgtbm8tc3VibWlzc2lvbgpjb250ZXh0czoKICAtIGNyb3dkc2VjdXJpdHkvYXBwc2VjX2Jhc2UKICAtIGNyb3dkc2VjdXJpdHkvYXBwc2VjX2JvdF9kZXRlY3Rpb24KZGVzY3JpcHRpb246ICJBcHBTZWMgYm90IGRldGVjdGlvbjogY2hhbGxlbmdlIG1vZGUgd2l0aCBmYXN0LWRldGVjdCBib3QgcmVqZWN0aW9uIGFuZCB3ZWxsLWtub3duLXBhdGggZXhjbHVzaW9ucyIKbGFiZWxzOgogIGxhYmVsOiAiV0FGIC0gQm90IENoYWxsZW5nZSIKYXV0aG9yOiBjcm93ZHNlY3VyaXR5CnRhZ3M6CiAgLSB3YWYKICAtIGFwcHNlYwogIC0gaHR0cAogIC0gYm90Cg==", + "content": "bmFtZTogY3Jvd2RzZWN1cml0eS9hcHBzZWMtYm90LWNoYWxsZW5nZQpwYXJzZXJzOgogIC0gY3Jvd2RzZWN1cml0eS9hcHBzZWMtbG9ncwogIC0gY3Jvd2RzZWN1cml0eS9hcHBzZWMtYm90LWRldGVjdGlvbi1sb2dzCmFwcHNlYy1jb25maWdzOgogIC0gY3Jvd2RzZWN1cml0eS9zaW1wbGUtYm90LWNoYWxsZW5nZQogIC0gY3Jvd2RzZWN1cml0eS9jaGFsbGVuZ2UtZXhjbHVkZS1jcmF3bGVyLWZpbGVzCiAgLSBjcm93ZHNlY3VyaXR5L2NoYWxsZW5nZS1leGNsdWRlLWZlZWRzCiAgLSBjcm93ZHNlY3VyaXR5L2NoYWxsZW5nZS1leGNsdWRlLXdlYmhvb2tzCmFwcHNlYy1ydWxlczoKICAtIGNyb3dkc2VjdXJpdHkvbGVnaXQtYm90cwpzY2VuYXJpb3M6CiAgLSBjcm93ZHNlY3VyaXR5L2FwcHNlYy1ib3QtZGV0ZWN0ZWQKICAtIGNyb3dkc2VjdXJpdHkvYXBwc2VjLWNoYWxsZW5nZS10b28tbWFueS1yZXF1ZXN0cwogIC0gY3Jvd2RzZWN1cml0eS9hcHBzZWMtY2hhbGxlbmdlLXRvby1tYW55LXN1Ym1pc3Npb25zCiAgLSBjcm93ZHNlY3VyaXR5L2FwcHNlYy1jaGFsbGVuZ2UtcmVxdWVzdC13aXRoLW5vLXN1Ym1pc3Npb24KY29udGV4dHM6CiAgLSBjcm93ZHNlY3VyaXR5L2FwcHNlY19iYXNlCiAgLSBjcm93ZHNlY3VyaXR5L2FwcHNlY19ib3RfZGV0ZWN0aW9uCmRlc2NyaXB0aW9uOiAiQXBwU2VjIGJvdCBkZXRlY3Rpb246IGNoYWxsZW5nZSBtb2RlIHdpdGggZmFzdC1kZXRlY3QgYm90IHJlamVjdGlvbiBhbmQgd2VsbC1rbm93bi1wYXRoIGV4Y2x1c2lvbnMiCmxhYmVsczoKICBsYWJlbDogIldBRiAtIEJvdCBDaGFsbGVuZ2UiCmF1dGhvcjogY3Jvd2RzZWN1cml0eQp0YWdzOgogIC0gd2FmCiAgLSBhcHBzZWMKICAtIGh0dHAKICAtIGJvdAo=", "contexts": [ "crowdsecurity/appsec_base", "crowdsecurity/appsec_bot_detection" @@ -7707,11 +7718,15 @@ "crowdsecurity/appsec-challenge-too-many-submissions", "crowdsecurity/appsec-challenge-request-with-no-submission" ], - "version": "0.1", + "version": "0.2", "versions": { "0.1": { "deprecated": false, "digest": "84aa2d191df44e0bb6e0a6dc07df80054ae8872326a0f563de92746fa81cf93b" + }, + "0.2": { + "deprecated": false, + "digest": "79f6198d3cd338927517ed13fec5966041c52fffbb4d0f04a1ba733672ac80b1" } } }, From 36b3baf5b9e66abe45af200d0f9fe8a259c6a72b Mon Sep 17 00:00:00 2001 From: Thibault Koechlin Date: Mon, 22 Jun 2026 14:12:00 +0200 Subject: [PATCH 15/36] add appsec-rule to fetch bot desc json files --- appsec-rules/crowdsecurity/legit-bots.yaml | 22 ++++++++++++++++++++++ 1 file changed, 22 insertions(+) create mode 100644 appsec-rules/crowdsecurity/legit-bots.yaml diff --git a/appsec-rules/crowdsecurity/legit-bots.yaml b/appsec-rules/crowdsecurity/legit-bots.yaml new file mode 100644 index 00000000000..076231da1fd --- /dev/null +++ b/appsec-rules/crowdsecurity/legit-bots.yaml @@ -0,0 +1,22 @@ +name: crowdsecurity/legit-bots + +# This appsec-rule only declares the legitimate-bot datafiles so crowdsec downloads them +# into /legit_bots/. They are consumed by the engine's IsLegitimateBot() helper +# (see crowdsecurity/simple-bot-challenge), not by seclang rules. + +data: + - source_url: https://hub-data.crowdsec.net/whitelists/benign_bots/legit_bots/googlebot.json + dest_file: legit_bots/googlebot.json + type: bots + - source_url: https://hub-data.crowdsec.net/whitelists/benign_bots/legit_bots/bingbot.json + dest_file: legit_bots/bingbot.json + type: bots + - source_url: https://hub-data.crowdsec.net/whitelists/benign_bots/legit_bots/applebot.json + dest_file: legit_bots/applebot.json + type: bots + - source_url: https://hub-data.crowdsec.net/whitelists/benign_bots/legit_bots/amazonbot.json + dest_file: legit_bots/amazonbot.json + type: bots + - source_url: https://hub-data.crowdsec.net/whitelists/benign_bots/legit_bots/gptbot.json + dest_file: legit_bots/gptbot.json + type: bots From 210838b41dece82142261b3d540ce35e266d7817 Mon Sep 17 00:00:00 2001 From: GitHub Action Date: Mon, 22 Jun 2026 12:15:25 +0000 Subject: [PATCH 16/36] Update index --- .index.json | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/.index.json b/.index.json index 49146df15ad..d8f1767459b 100644 --- a/.index.json +++ b/.index.json @@ -501,6 +501,19 @@ } } }, + "crowdsecurity/legit-bots": { + "author": "crowdsecurity", + "content": "bmFtZTogY3Jvd2RzZWN1cml0eS9sZWdpdC1ib3RzCgojIFRoaXMgYXBwc2VjLXJ1bGUgb25seSBkZWNsYXJlcyB0aGUgbGVnaXRpbWF0ZS1ib3QgZGF0YWZpbGVzIHNvIGNyb3dkc2VjIGRvd25sb2FkcyB0aGVtCiMgaW50byA8ZGF0YWRpcj4vbGVnaXRfYm90cy8uIFRoZXkgYXJlIGNvbnN1bWVkIGJ5IHRoZSBlbmdpbmUncyBJc0xlZ2l0aW1hdGVCb3QoKSBoZWxwZXIKIyAoc2VlIGNyb3dkc2VjdXJpdHkvc2ltcGxlLWJvdC1jaGFsbGVuZ2UpLCBub3QgYnkgc2VjbGFuZyBydWxlcy4KCmRhdGE6CiAgLSBzb3VyY2VfdXJsOiBodHRwczovL2h1Yi1kYXRhLmNyb3dkc2VjLm5ldC93aGl0ZWxpc3RzL2Jlbmlnbl9ib3RzL2xlZ2l0X2JvdHMvZ29vZ2xlYm90Lmpzb24KICAgIGRlc3RfZmlsZTogbGVnaXRfYm90cy9nb29nbGVib3QuanNvbgogICAgdHlwZTogYm90cwogIC0gc291cmNlX3VybDogaHR0cHM6Ly9odWItZGF0YS5jcm93ZHNlYy5uZXQvd2hpdGVsaXN0cy9iZW5pZ25fYm90cy9sZWdpdF9ib3RzL2Jpbmdib3QuanNvbgogICAgZGVzdF9maWxlOiBsZWdpdF9ib3RzL2Jpbmdib3QuanNvbgogICAgdHlwZTogYm90cwogIC0gc291cmNlX3VybDogaHR0cHM6Ly9odWItZGF0YS5jcm93ZHNlYy5uZXQvd2hpdGVsaXN0cy9iZW5pZ25fYm90cy9sZWdpdF9ib3RzL2FwcGxlYm90Lmpzb24KICAgIGRlc3RfZmlsZTogbGVnaXRfYm90cy9hcHBsZWJvdC5qc29uCiAgICB0eXBlOiBib3RzCiAgLSBzb3VyY2VfdXJsOiBodHRwczovL2h1Yi1kYXRhLmNyb3dkc2VjLm5ldC93aGl0ZWxpc3RzL2Jlbmlnbl9ib3RzL2xlZ2l0X2JvdHMvYW1hem9uYm90Lmpzb24KICAgIGRlc3RfZmlsZTogbGVnaXRfYm90cy9hbWF6b25ib3QuanNvbgogICAgdHlwZTogYm90cwogIC0gc291cmNlX3VybDogaHR0cHM6Ly9odWItZGF0YS5jcm93ZHNlYy5uZXQvd2hpdGVsaXN0cy9iZW5pZ25fYm90cy9sZWdpdF9ib3RzL2dwdGJvdC5qc29uCiAgICBkZXN0X2ZpbGU6IGxlZ2l0X2JvdHMvZ3B0Ym90Lmpzb24KICAgIHR5cGU6IGJvdHMK", + "labels": null, + "path": "appsec-rules/crowdsecurity/legit-bots.yaml", + "version": "0.1", + "versions": { + "0.1": { + "deprecated": false, + "digest": "a292ff161dec6142e11d600f39f82a1dacdd499f1ec1ae2f47bb208016da9908" + } + } + }, "crowdsecurity/vpatch-CVE-2002-1131": { "author": "crowdsecurity", "content": "IyMgYXV0b2dlbmVyYXRlZCBvbiAyMDI1LTA0LTIzIDEyOjU2OjQwCm5hbWU6IGNyb3dkc2VjdXJpdHkvdnBhdGNoLUNWRS0yMDAyLTExMzEKZGVzY3JpcHRpb246ICdEZXRlY3RzIFhTUyBhdHRlbXB0cyBpbiBTcXVpcnJlbE1haWwgMS4yLjYvMS4yLjcgdmlhIHVuc2FuaXRpemVkIGlucHV0IGluIGFkZHJlc3Nib29rLCBvcHRpb25zLCBzZWFyY2gsIGFuZCBoZWxwIG1vZHVsZXMuJwpydWxlczoKICAtIGFuZDoKICAgICAgLSB6b25lczoKICAgICAgICAgIC0gVVJJCiAgICAgICAgdHJhbnNmb3JtOgogICAgICAgICAgLSBsb3dlcmNhc2UKICAgICAgICAgIC0gdXJsZGVjb2RlCiAgICAgICAgbWF0Y2g6CiAgICAgICAgICB0eXBlOiBjb250YWlucwogICAgICAgICAgdmFsdWU6IC9zcmMvYWRkcmVzc2Jvb2sucGhwCiAgICAgIC0gem9uZXM6CiAgICAgICAgICAtIEFSR1NfTkFNRVMKICAgICAgICB0cmFuc2Zvcm06CiAgICAgICAgICAtIGxvd2VyY2FzZQogICAgICAgICAgLSB1cmxkZWNvZGUKICAgICAgICBtYXRjaDoKICAgICAgICAgIHR5cGU6IGNvbnRhaW5zCiAgICAgICAgICB2YWx1ZTogPAogIC0gYW5kOgogICAgICAtIHpvbmVzOgogICAgICAgICAgLSBVUkkKICAgICAgICB0cmFuc2Zvcm06CiAgICAgICAgICAtIGxvd2VyY2FzZQogICAgICAgICAgLSB1cmxkZWNvZGUKICAgICAgICBtYXRjaDoKICAgICAgICAgIHR5cGU6IGNvbnRhaW5zCiAgICAgICAgICB2YWx1ZTogL3NyYy9vcHRpb25zLnBocAogICAgICAtIHpvbmVzOgogICAgICAgICAgLSBBUkdTCiAgICAgICAgdmFyaWFibGVzOgogICAgICAgICAgLSBvcHRwYWdlCiAgICAgICAgdHJhbnNmb3JtOgogICAgICAgICAgLSBsb3dlcmNhc2UKICAgICAgICAgIC0gdXJsZGVjb2RlCiAgICAgICAgbWF0Y2g6CiAgICAgICAgICB0eXBlOiBjb250YWlucwogICAgICAgICAgdmFsdWU6IDwKICAtIGFuZDoKICAgICAgLSB6b25lczoKICAgICAgICAgIC0gVVJJCiAgICAgICAgdHJhbnNmb3JtOgogICAgICAgICAgLSBsb3dlcmNhc2UKICAgICAgICAgIC0gdXJsZGVjb2RlCiAgICAgICAgbWF0Y2g6CiAgICAgICAgICB0eXBlOiBjb250YWlucwogICAgICAgICAgdmFsdWU6IC9zcmMvc2VhcmNoLnBocAogICAgICAtIHpvbmVzOgogICAgICAgICAgLSBBUkdTCiAgICAgICAgdmFyaWFibGVzOgogICAgICAgICAgLSBtYWlsYm94CiAgICAgICAgICAtIHdoZXJlCiAgICAgICAgdHJhbnNmb3JtOgogICAgICAgICAgLSBsb3dlcmNhc2UKICAgICAgICAgIC0gdXJsZGVjb2RlCiAgICAgICAgbWF0Y2g6CiAgICAgICAgICB0eXBlOiBjb250YWlucwogICAgICAgICAgdmFsdWU6IDwKICAtIGFuZDoKICAgICAgLSB6b25lczoKICAgICAgICAgIC0gVVJJCiAgICAgICAgdHJhbnNmb3JtOgogICAgICAgICAgLSBsb3dlcmNhc2UKICAgICAgICAgIC0gdXJsZGVjb2RlCiAgICAgICAgbWF0Y2g6CiAgICAgICAgICB0eXBlOiBjb250YWlucwogICAgICAgICAgdmFsdWU6IC9zcmMvaGVscC5waHAKICAgICAgLSB6b25lczoKICAgICAgICAgIC0gQVJHUwogICAgICAgIHZhcmlhYmxlczoKICAgICAgICAgIC0gY2hhcHRlcgogICAgICAgIHRyYW5zZm9ybToKICAgICAgICAgIC0gbG93ZXJjYXNlCiAgICAgICAgICAtIHVybGRlY29kZQogICAgICAgIG1hdGNoOgogICAgICAgICAgdHlwZTogY29udGFpbnMKICAgICAgICAgIHZhbHVlOiA8CgpsYWJlbHM6CiAgdHlwZTogZXhwbG9pdAogIHNlcnZpY2U6IGh0dHAKICBjb25maWRlbmNlOiAzCiAgc3Bvb2ZhYmxlOiAwCiAgYmVoYXZpb3I6ICdodHRwOmV4cGxvaXQnCiAgbGFiZWw6ICdTcXVpcnJlbE1haWwgLSBYU1MnCiAgY2xhc3NpZmljYXRpb246CiAgICAtIGN2ZS5DVkUtMjAwMi0xMTMxCiAgICAtIGF0dGFjay5UMTA1OQogICAgLSBjd2UuQ1dFLTgwCg==", From 27eee026b7fab907092ab2bb0e1a286de656495b Mon Sep 17 00:00:00 2001 From: Thibault Koechlin Date: Wed, 1 Jul 2026 08:36:02 +0200 Subject: [PATCH 17/36] fix the helpers names --- ...ec-bot-challenge-exclude-crawler-files.yaml | 9 +++++++++ ...=> appsec-bot-challenge-exclude-feeds.yaml} | 7 +++---- ...appsec-bot-challenge-exclude-webhooks.yaml} | 7 +++---- ...e.yaml => appsec-bot-challenge-simple.yaml} | 2 +- .../challenge-exclude-crawler-files.yaml | 11 ----------- .../crowdsecurity/appsec-bot-challenge.md | 17 ++++++++++------- .../crowdsecurity/appsec-bot-challenge.yaml | 18 +++++++++--------- ...-challenge-request-with-no-submission.yaml} | 6 +++--- ...ppsec-bot-challenge-too-many-requests.yaml} | 7 ++++--- ...ec-bot-challenge-too-many-submissions.yaml} | 4 ++-- 10 files changed, 44 insertions(+), 44 deletions(-) create mode 100644 appsec-configs/crowdsecurity/appsec-bot-challenge-exclude-crawler-files.yaml rename appsec-configs/crowdsecurity/{challenge-exclude-feeds.yaml => appsec-bot-challenge-exclude-feeds.yaml} (59%) rename appsec-configs/crowdsecurity/{challenge-exclude-webhooks.yaml => appsec-bot-challenge-exclude-webhooks.yaml} (52%) rename appsec-configs/crowdsecurity/{simple-bot-challenge.yaml => appsec-bot-challenge-simple.yaml} (93%) delete mode 100644 appsec-configs/crowdsecurity/challenge-exclude-crawler-files.yaml rename scenarios/crowdsecurity/{appsec-challenge-request-with-no-submission.yaml => appsec-bot-challenge-request-with-no-submission.yaml} (75%) rename scenarios/crowdsecurity/{appsec-challenge-too-many-requests.yaml => appsec-bot-challenge-too-many-requests.yaml} (68%) rename scenarios/crowdsecurity/{appsec-challenge-too-many-submissions.yaml => appsec-bot-challenge-too-many-submissions.yaml} (84%) diff --git a/appsec-configs/crowdsecurity/appsec-bot-challenge-exclude-crawler-files.yaml b/appsec-configs/crowdsecurity/appsec-bot-challenge-exclude-crawler-files.yaml new file mode 100644 index 00000000000..0e72a9e1987 --- /dev/null +++ b/appsec-configs/crowdsecurity/appsec-bot-challenge-exclude-crawler-files.yaml @@ -0,0 +1,9 @@ +name: crowdsecurity/appsec-bot-challenge-exclude-crawler-files +# Let well-known crawler files fly through without a challenge. +inband: + pre_eval: + - filter: >- + req.URL.Path in ['/robots.txt', '/ads.txt', '/app-ads.txt', '/sitemap.xml'] || + req.URL.Path startsWith '/.well-known/' + apply: + - ExemptFromChallenge() diff --git a/appsec-configs/crowdsecurity/challenge-exclude-feeds.yaml b/appsec-configs/crowdsecurity/appsec-bot-challenge-exclude-feeds.yaml similarity index 59% rename from appsec-configs/crowdsecurity/challenge-exclude-feeds.yaml rename to appsec-configs/crowdsecurity/appsec-bot-challenge-exclude-feeds.yaml index 178c865b323..660f44d6712 100644 --- a/appsec-configs/crowdsecurity/challenge-exclude-feeds.yaml +++ b/appsec-configs/crowdsecurity/appsec-bot-challenge-exclude-feeds.yaml @@ -1,10 +1,9 @@ -name: crowdsecurity/challenge-exclude-feeds -# Let syndication feed endpoints fly through without a challenge. SetLegitimateBot() is -# strictly per-request (never persisted to a cookie or across requests). +name: crowdsecurity/appsec-bot-challenge-exclude-feeds +# Let syndication feed endpoints fly through without a challenge. inband: pre_eval: - filter: >- req.URL.Path in ['/feed', '/rss', '/atom.xml'] || req.URL.Path startsWith '/feed/' || req.URL.Path startsWith '/rss/' apply: - - SetLegitimateBot() + - ExemptFromChallenge() diff --git a/appsec-configs/crowdsecurity/challenge-exclude-webhooks.yaml b/appsec-configs/crowdsecurity/appsec-bot-challenge-exclude-webhooks.yaml similarity index 52% rename from appsec-configs/crowdsecurity/challenge-exclude-webhooks.yaml rename to appsec-configs/crowdsecurity/appsec-bot-challenge-exclude-webhooks.yaml index 3e625628f5c..ef35866c529 100644 --- a/appsec-configs/crowdsecurity/challenge-exclude-webhooks.yaml +++ b/appsec-configs/crowdsecurity/appsec-bot-challenge-exclude-webhooks.yaml @@ -1,8 +1,7 @@ -name: crowdsecurity/challenge-exclude-webhooks -# Let third-party webhook callbacks fly through without a challenge. SetLegitimateBot() is -# strictly per-request (never persisted to a cookie or across requests). +name: crowdsecurity/appsec-bot-challenge-exclude-webhooks +# Let third-party webhook callbacks fly through without a challenge. inband: pre_eval: - filter: "req.URL.Path in ['/webhooks/stripe', '/webhooks/github', '/webhooks/sendgrid']" apply: - - SetLegitimateBot() + - ExemptFromChallenge() diff --git a/appsec-configs/crowdsecurity/simple-bot-challenge.yaml b/appsec-configs/crowdsecurity/appsec-bot-challenge-simple.yaml similarity index 93% rename from appsec-configs/crowdsecurity/simple-bot-challenge.yaml rename to appsec-configs/crowdsecurity/appsec-bot-challenge-simple.yaml index fa6a22c649e..18cb86e18db 100644 --- a/appsec-configs/crowdsecurity/simple-bot-challenge.yaml +++ b/appsec-configs/crowdsecurity/appsec-bot-challenge-simple.yaml @@ -1,4 +1,4 @@ -name: crowdsecurity/simple-bot-challenge +name: crowdsecurity/appsec-bot-challenge-simple inband: post_eval: # Skip the challenge for verified good bots (forward-confirmed rDNS) and for requests a diff --git a/appsec-configs/crowdsecurity/challenge-exclude-crawler-files.yaml b/appsec-configs/crowdsecurity/challenge-exclude-crawler-files.yaml deleted file mode 100644 index a629e437361..00000000000 --- a/appsec-configs/crowdsecurity/challenge-exclude-crawler-files.yaml +++ /dev/null @@ -1,11 +0,0 @@ -name: crowdsecurity/challenge-exclude-crawler-files -# Let well-known crawler files fly through without a challenge. ExemptFromChallenge() is -# strictly per-request (never persisted to a cookie or across requests), so this cannot -# be abused to whitelist a session for other paths. -inband: - pre_eval: - - filter: >- - req.URL.Path in ['/robots.txt', '/ads.txt', '/app-ads.txt', '/sitemap.xml'] || - req.URL.Path startsWith '/.well-known/' - apply: - - ExemptFromChallenge() diff --git a/collections/crowdsecurity/appsec-bot-challenge.md b/collections/crowdsecurity/appsec-bot-challenge.md index 5b52cc0acf5..47f210ed198 100644 --- a/collections/crowdsecurity/appsec-bot-challenge.md +++ b/collections/crowdsecurity/appsec-bot-challenge.md @@ -6,10 +6,13 @@ fast bot detection are rejected. What it ships: - - `crowdsecurity/simple-bot-challenge`: challenges incoming requests, skips verified good bots + - `crowdsecurity/appsec-bot-challenge-simple`: challenges incoming requests, skips verified good bots (forward-confirmed rDNS), and rejects challenge submissions whose fingerprint trips the fast bot detection. - - Well-known-path exclusion configs (`challenge-exclude-crawler-files`, `-feeds`, `-webhooks`) that + - `crowdsecurity/appsec-bot-legit-bots`: ships the verified-good-bot datafiles (googlebot, bingbot, + applebot, amazonbot, gptbot) that back the forward-confirmed rDNS exclusion above, so legitimate + crawlers skip the challenge. + - Well-known-path exclusion configs (`appsec-bot-challenge-exclude-crawler-files`, `-feeds`, `-webhooks`) that let machine-facing endpoints (`/robots.txt`, `/.well-known/*`, feeds, webhooks) through without a challenge. The exclusion is strictly per-request and is never persisted to a cookie or across requests, so it cannot be abused to whitelist a session for other paths. @@ -19,15 +22,15 @@ What it ships: ## Enabling bot challenge -Add the `crowdsecurity/simple-bot-challenge` appsec-config to your WAF acquisition, plus any of the +Add the `crowdsecurity/appsec-bot-challenge-simple` appsec-config to your WAF acquisition, plus any of the well-known-path exclusion configs you need: ```yaml appsec_configs: - - crowdsecurity/simple-bot-challenge - - crowdsecurity/challenge-exclude-crawler-files - - crowdsecurity/challenge-exclude-feeds - - crowdsecurity/challenge-exclude-webhooks + - crowdsecurity/appsec-bot-challenge-simple + - crowdsecurity/appsec-bot-challenge-exclude-crawler-files + - crowdsecurity/appsec-bot-challenge-exclude-feeds + - crowdsecurity/appsec-bot-challenge-exclude-webhooks labels: type: appsec listen_addr: 127.0.0.1:7422 diff --git a/collections/crowdsecurity/appsec-bot-challenge.yaml b/collections/crowdsecurity/appsec-bot-challenge.yaml index 13af9ec5be6..f2a7a26d187 100644 --- a/collections/crowdsecurity/appsec-bot-challenge.yaml +++ b/collections/crowdsecurity/appsec-bot-challenge.yaml @@ -3,20 +3,20 @@ parsers: - crowdsecurity/appsec-logs - crowdsecurity/appsec-bot-detection-logs appsec-configs: - - crowdsecurity/simple-bot-challenge - - crowdsecurity/challenge-exclude-crawler-files - - crowdsecurity/challenge-exclude-feeds - - crowdsecurity/challenge-exclude-webhooks + - crowdsecurity/appsec-bot-challenge-simple + - crowdsecurity/appsec-bot-challenge-exclude-crawler-files + - crowdsecurity/appsec-bot-challenge-exclude-feeds + - crowdsecurity/appsec-bot-challenge-exclude-webhooks appsec-rules: - - crowdsecurity/legit-bots + - crowdsecurity/appsec-bot-legit-bots scenarios: - crowdsecurity/appsec-bot-detected - - crowdsecurity/appsec-challenge-too-many-requests - - crowdsecurity/appsec-challenge-too-many-submissions - - crowdsecurity/appsec-challenge-request-with-no-submission + - crowdsecurity/appsec-bot-challenge-too-many-requests + - crowdsecurity/appsec-bot-challenge-too-many-submissions + - crowdsecurity/appsec-bot-challenge-request-with-no-submission contexts: - crowdsecurity/appsec_base - - crowdsecurity/appsec_bot_detection + - crowdsecurity/appsec-bot-detection description: "AppSec bot detection: challenge mode with fast-detect bot rejection and well-known-path exclusions" labels: label: "WAF - Bot Challenge" diff --git a/scenarios/crowdsecurity/appsec-challenge-request-with-no-submission.yaml b/scenarios/crowdsecurity/appsec-bot-challenge-request-with-no-submission.yaml similarity index 75% rename from scenarios/crowdsecurity/appsec-challenge-request-with-no-submission.yaml rename to scenarios/crowdsecurity/appsec-bot-challenge-request-with-no-submission.yaml index c1c0a11eb0f..0e4b52e46b7 100644 --- a/scenarios/crowdsecurity/appsec-challenge-request-with-no-submission.yaml +++ b/scenarios/crowdsecurity/appsec-bot-challenge-request-with-no-submission.yaml @@ -1,11 +1,11 @@ type: counter format: 3.0 #debug: true -name: crowdsecurity/appsec-challenge-request-with-no-submission -description: "Client made too many request to challenge page" +name: crowdsecurity/appsec-bot-challenge-request-with-no-submission +description: "Client was served the challenge page but never submitted it" filter: "evt.Meta.log_type == 'appsec-challenge' && (evt.Meta.challenge_event == 'requested' || evt.Meta.challenge_event == 'submitted')" cancel_on: "evt.Meta.log_type == 'appsec-challenge' && evt.Meta.challenge_event == 'submitted'" -duration: 60s +duration: 120s capacity: -1 cache_size: 1 groupby: evt.Meta.source_ip diff --git a/scenarios/crowdsecurity/appsec-challenge-too-many-requests.yaml b/scenarios/crowdsecurity/appsec-bot-challenge-too-many-requests.yaml similarity index 68% rename from scenarios/crowdsecurity/appsec-challenge-too-many-requests.yaml rename to scenarios/crowdsecurity/appsec-bot-challenge-too-many-requests.yaml index 795bc607045..9585f8374a6 100644 --- a/scenarios/crowdsecurity/appsec-challenge-too-many-requests.yaml +++ b/scenarios/crowdsecurity/appsec-bot-challenge-too-many-requests.yaml @@ -1,11 +1,12 @@ type: leaky format: 3.0 #debug: true -name: crowdsecurity/appsec-challenge-too-many-requests +name: crowdsecurity/appsec-bot-challenge-too-many-requests description: "Client made too many request to challenge page" filter: "evt.Meta.log_type == 'appsec-challenge' && evt.Meta.challenge_event == 'requested'" -leakspeed: "60s" -capacity: 5 +cancel_on: "evt.Meta.log_type == 'appsec-challenge' && evt.Meta.challenge_event == 'submitted'" +leakspeed: "20s" +capacity: 10 groupby: evt.Meta.source_ip blackhole: 1m labels: diff --git a/scenarios/crowdsecurity/appsec-challenge-too-many-submissions.yaml b/scenarios/crowdsecurity/appsec-bot-challenge-too-many-submissions.yaml similarity index 84% rename from scenarios/crowdsecurity/appsec-challenge-too-many-submissions.yaml rename to scenarios/crowdsecurity/appsec-bot-challenge-too-many-submissions.yaml index 47ab5fe1c96..7d8a9162d1c 100644 --- a/scenarios/crowdsecurity/appsec-challenge-too-many-submissions.yaml +++ b/scenarios/crowdsecurity/appsec-bot-challenge-too-many-submissions.yaml @@ -1,10 +1,10 @@ type: leaky format: 3.0 #debug: true -name: crowdsecurity/appsec-challenge-too-many-submissions +name: crowdsecurity/appsec-bot-challenge-too-many-submissions description: "Client made too many submissions for challenge" filter: "evt.Meta.log_type == 'appsec-challenge' && evt.Meta.challenge_event == 'submitted'" -leakspeed: "60s" +leakspeed: "20s" capacity: 5 groupby: evt.Meta.source_ip blackhole: 1m From fd47f2412b152554b07a1af76571ed42edfb9ea5 Mon Sep 17 00:00:00 2001 From: Thibault Koechlin Date: Wed, 1 Jul 2026 08:36:24 +0200 Subject: [PATCH 18/36] rename --- .../{legit-bots.yaml => appsec-bot-legit-bots.yaml} | 4 ++-- .../{appsec_bot_detection.yaml => appsec-bot-detection.yaml} | 0 2 files changed, 2 insertions(+), 2 deletions(-) rename appsec-rules/crowdsecurity/{legit-bots.yaml => appsec-bot-legit-bots.yaml} (88%) rename contexts/crowdsecurity/{appsec_bot_detection.yaml => appsec-bot-detection.yaml} (100%) diff --git a/appsec-rules/crowdsecurity/legit-bots.yaml b/appsec-rules/crowdsecurity/appsec-bot-legit-bots.yaml similarity index 88% rename from appsec-rules/crowdsecurity/legit-bots.yaml rename to appsec-rules/crowdsecurity/appsec-bot-legit-bots.yaml index 076231da1fd..e681e2fe6c3 100644 --- a/appsec-rules/crowdsecurity/legit-bots.yaml +++ b/appsec-rules/crowdsecurity/appsec-bot-legit-bots.yaml @@ -1,8 +1,8 @@ -name: crowdsecurity/legit-bots +name: crowdsecurity/appsec-bot-legit-bots # This appsec-rule only declares the legitimate-bot datafiles so crowdsec downloads them # into /legit_bots/. They are consumed by the engine's IsLegitimateBot() helper -# (see crowdsecurity/simple-bot-challenge), not by seclang rules. +# (see crowdsecurity/appsec-bot-challenge-simple), not by seclang rules. data: - source_url: https://hub-data.crowdsec.net/whitelists/benign_bots/legit_bots/googlebot.json diff --git a/contexts/crowdsecurity/appsec_bot_detection.yaml b/contexts/crowdsecurity/appsec-bot-detection.yaml similarity index 100% rename from contexts/crowdsecurity/appsec_bot_detection.yaml rename to contexts/crowdsecurity/appsec-bot-detection.yaml From 18fa69b60e8c8cc312453fd10c5b657bd49b9582 Mon Sep 17 00:00:00 2001 From: Thibault Koechlin Date: Wed, 1 Jul 2026 08:37:34 +0200 Subject: [PATCH 19/36] avoiid this --- .gitignore | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.gitignore b/.gitignore index 8672b1d77ff..7cebde538f2 100644 --- a/.gitignore +++ b/.gitignore @@ -31,3 +31,6 @@ workspace.code-workspace waf-check/dataset/* waf-check/output/* waf-check/waf-check + +## local dev tooling (e.g. nektos/act for running CI locally) +bin/ From 00260c9206ba94da6f6b313170c42e033315a7cf Mon Sep 17 00:00:00 2001 From: GitHub Action Date: Wed, 1 Jul 2026 06:38:03 +0000 Subject: [PATCH 20/36] Update index --- .index.json | 236 +++++++++++++++++++++++++--------------------------- 1 file changed, 114 insertions(+), 122 deletions(-) diff --git a/.index.json b/.index.json index 36f043c48a8..f278d1c2dcc 100644 --- a/.index.json +++ b/.index.json @@ -1,70 +1,79 @@ { "appsec-configs": { - "crowdsecurity/appsec-default": { + "crowdsecurity/appsec-bot-challenge-exclude-crawler-files": { "author": "crowdsecurity", - "content": "bmFtZTogY3Jvd2RzZWN1cml0eS9hcHBzZWMtZGVmYXVsdApkZWZhdWx0X3JlbWVkaWF0aW9uOiBiYW4KaW5iYW5kX3J1bGVzOgogLSBjcm93ZHNlY3VyaXR5L2Jhc2UtY29uZmlnIAogLSBjcm93ZHNlY3VyaXR5L3ZwYXRjaC0qCiAtIGNyb3dkc2VjdXJpdHkvZ2VuZXJpYy0qCm91dG9mYmFuZF9ydWxlczoKIC0gY3Jvd2RzZWN1cml0eS9leHBlcmltZW50YWwtKgogLSBjcm93ZHNlY3VyaXR5L2FwcHNlYy1nZW5lcmljLXRlc3QK", + "content": "bmFtZTogY3Jvd2RzZWN1cml0eS9hcHBzZWMtYm90LWNoYWxsZW5nZS1leGNsdWRlLWNyYXdsZXItZmlsZXMKIyBMZXQgd2VsbC1rbm93biBjcmF3bGVyIGZpbGVzIGZseSB0aHJvdWdoIHdpdGhvdXQgYSBjaGFsbGVuZ2UuCmluYmFuZDoKICBwcmVfZXZhbDoKICAgIC0gZmlsdGVyOiA+LQogICAgICAgIHJlcS5VUkwuUGF0aCBpbiBbJy9yb2JvdHMudHh0JywgJy9hZHMudHh0JywgJy9hcHAtYWRzLnR4dCcsICcvc2l0ZW1hcC54bWwnXSB8fAogICAgICAgIHJlcS5VUkwuUGF0aCBzdGFydHNXaXRoICcvLndlbGwta25vd24vJwogICAgICBhcHBseToKICAgICAgICAtIEV4ZW1wdEZyb21DaGFsbGVuZ2UoKQo=", "labels": null, - "path": "appsec-configs/crowdsecurity/appsec-default.yaml", - "version": "0.4", + "path": "appsec-configs/crowdsecurity/appsec-bot-challenge-exclude-crawler-files.yaml", + "version": "0.1", "versions": { "0.1": { "deprecated": false, - "digest": "2b821a2cbcfdd7fdfd8ada95c00a4c6fdf8ce8a3efb55b1e3cd8eacc0ed418b6" - }, - "0.2": { - "deprecated": false, - "digest": "485710fec31feb36bfdd5a572a5174fd13a0e22ba812dfb78d92e1bfaea79a8d" - }, - "0.3": { - "deprecated": false, - "digest": "e3112166af61843dda46e1740e1151b5cfe9002517328d935c912fc94ef01a3a" - }, - "0.4": { - "deprecated": false, - "digest": "68e34ef8b7c8aaadca4233a7213f2fce706daf1b670fc1f544c03b0c8b2e7b87" + "digest": "2d8dd3c683f82b3437b6ec718287409a3cd165d3dfc37e3a6fc486931bdf1897" } } }, - "crowdsecurity/challenge-exclude-crawler-files": { + "crowdsecurity/appsec-bot-challenge-exclude-feeds": { "author": "crowdsecurity", - "content": "bmFtZTogY3Jvd2RzZWN1cml0eS9jaGFsbGVuZ2UtZXhjbHVkZS1jcmF3bGVyLWZpbGVzCiMgTGV0IHdlbGwta25vd24gY3Jhd2xlciBmaWxlcyBmbHkgdGhyb3VnaCB3aXRob3V0IGEgY2hhbGxlbmdlLiBFeGVtcHRGcm9tQ2hhbGxlbmdlKCkgaXMKIyBzdHJpY3RseSBwZXItcmVxdWVzdCAobmV2ZXIgcGVyc2lzdGVkIHRvIGEgY29va2llIG9yIGFjcm9zcyByZXF1ZXN0cyksIHNvIHRoaXMgY2Fubm90CiMgYmUgYWJ1c2VkIHRvIHdoaXRlbGlzdCBhIHNlc3Npb24gZm9yIG90aGVyIHBhdGhzLgppbmJhbmQ6CiAgcHJlX2V2YWw6CiAgICAtIGZpbHRlcjogPi0KICAgICAgICByZXEuVVJMLlBhdGggaW4gWycvcm9ib3RzLnR4dCcsICcvYWRzLnR4dCcsICcvYXBwLWFkcy50eHQnLCAnL3NpdGVtYXAueG1sJ10gfHwKICAgICAgICByZXEuVVJMLlBhdGggc3RhcnRzV2l0aCAnLy53ZWxsLWtub3duLycKICAgICAgYXBwbHk6CiAgICAgICAgLSBFeGVtcHRGcm9tQ2hhbGxlbmdlKCkK", + "content": "bmFtZTogY3Jvd2RzZWN1cml0eS9hcHBzZWMtYm90LWNoYWxsZW5nZS1leGNsdWRlLWZlZWRzCiMgTGV0IHN5bmRpY2F0aW9uIGZlZWQgZW5kcG9pbnRzIGZseSB0aHJvdWdoIHdpdGhvdXQgYSBjaGFsbGVuZ2UuCmluYmFuZDoKICBwcmVfZXZhbDoKICAgIC0gZmlsdGVyOiA+LQogICAgICAgIHJlcS5VUkwuUGF0aCBpbiBbJy9mZWVkJywgJy9yc3MnLCAnL2F0b20ueG1sJ10gfHwKICAgICAgICByZXEuVVJMLlBhdGggc3RhcnRzV2l0aCAnL2ZlZWQvJyB8fCByZXEuVVJMLlBhdGggc3RhcnRzV2l0aCAnL3Jzcy8nCiAgICAgIGFwcGx5OgogICAgICAgIC0gRXhlbXB0RnJvbUNoYWxsZW5nZSgpCg==", "labels": null, - "path": "appsec-configs/crowdsecurity/challenge-exclude-crawler-files.yaml", - "version": "0.2", + "path": "appsec-configs/crowdsecurity/appsec-bot-challenge-exclude-feeds.yaml", + "version": "0.1", "versions": { "0.1": { "deprecated": false, - "digest": "f00a72b94fd2f59257b70b0433a7d2e273d70a0ae1b3ac96c5e745e72d30c769" - }, - "0.2": { - "deprecated": false, - "digest": "c1834bcf1447bc74f0dc47f58af65cbb9a2a180092286a75111b0f8d941874e5" + "digest": "cf80e755440ec3d017a5f6565bc95902a0d413c03727c6e62aa7870ba8df5be1" } } }, - "crowdsecurity/challenge-exclude-feeds": { + "crowdsecurity/appsec-bot-challenge-exclude-webhooks": { "author": "crowdsecurity", - "content": "bmFtZTogY3Jvd2RzZWN1cml0eS9jaGFsbGVuZ2UtZXhjbHVkZS1mZWVkcwojIExldCBzeW5kaWNhdGlvbiBmZWVkIGVuZHBvaW50cyBmbHkgdGhyb3VnaCB3aXRob3V0IGEgY2hhbGxlbmdlLiBTZXRMZWdpdGltYXRlQm90KCkgaXMKIyBzdHJpY3RseSBwZXItcmVxdWVzdCAobmV2ZXIgcGVyc2lzdGVkIHRvIGEgY29va2llIG9yIGFjcm9zcyByZXF1ZXN0cykuCmluYmFuZDoKICBwcmVfZXZhbDoKICAgIC0gZmlsdGVyOiA+LQogICAgICAgIHJlcS5VUkwuUGF0aCBpbiBbJy9mZWVkJywgJy9yc3MnLCAnL2F0b20ueG1sJ10gfHwKICAgICAgICByZXEuVVJMLlBhdGggc3RhcnRzV2l0aCAnL2ZlZWQvJyB8fCByZXEuVVJMLlBhdGggc3RhcnRzV2l0aCAnL3Jzcy8nCiAgICAgIGFwcGx5OgogICAgICAgIC0gU2V0TGVnaXRpbWF0ZUJvdCgpCg==", + "content": "bmFtZTogY3Jvd2RzZWN1cml0eS9hcHBzZWMtYm90LWNoYWxsZW5nZS1leGNsdWRlLXdlYmhvb2tzCiMgTGV0IHRoaXJkLXBhcnR5IHdlYmhvb2sgY2FsbGJhY2tzIGZseSB0aHJvdWdoIHdpdGhvdXQgYSBjaGFsbGVuZ2UuCmluYmFuZDoKICBwcmVfZXZhbDoKICAgIC0gZmlsdGVyOiAicmVxLlVSTC5QYXRoIGluIFsnL3dlYmhvb2tzL3N0cmlwZScsICcvd2ViaG9va3MvZ2l0aHViJywgJy93ZWJob29rcy9zZW5kZ3JpZCddIgogICAgICBhcHBseToKICAgICAgICAtIEV4ZW1wdEZyb21DaGFsbGVuZ2UoKQo=", "labels": null, - "path": "appsec-configs/crowdsecurity/challenge-exclude-feeds.yaml", + "path": "appsec-configs/crowdsecurity/appsec-bot-challenge-exclude-webhooks.yaml", "version": "0.1", "versions": { "0.1": { "deprecated": false, - "digest": "61f7604c4bc05209a21e8a35192310b4129539404c4e52d806e4c185919d8dd4" + "digest": "ce0eb972b99d443f980cc91f1a0cad8e7f71eeafbbf069b68632baded4f03c25" } } }, - "crowdsecurity/challenge-exclude-webhooks": { + "crowdsecurity/appsec-bot-challenge-simple": { "author": "crowdsecurity", - "content": "bmFtZTogY3Jvd2RzZWN1cml0eS9jaGFsbGVuZ2UtZXhjbHVkZS13ZWJob29rcwojIExldCB0aGlyZC1wYXJ0eSB3ZWJob29rIGNhbGxiYWNrcyBmbHkgdGhyb3VnaCB3aXRob3V0IGEgY2hhbGxlbmdlLiBTZXRMZWdpdGltYXRlQm90KCkgaXMKIyBzdHJpY3RseSBwZXItcmVxdWVzdCAobmV2ZXIgcGVyc2lzdGVkIHRvIGEgY29va2llIG9yIGFjcm9zcyByZXF1ZXN0cykuCmluYmFuZDoKICBwcmVfZXZhbDoKICAgIC0gZmlsdGVyOiAicmVxLlVSTC5QYXRoIGluIFsnL3dlYmhvb2tzL3N0cmlwZScsICcvd2ViaG9va3MvZ2l0aHViJywgJy93ZWJob29rcy9zZW5kZ3JpZCddIgogICAgICBhcHBseToKICAgICAgICAtIFNldExlZ2l0aW1hdGVCb3QoKQo=", + "content": "bmFtZTogY3Jvd2RzZWN1cml0eS9hcHBzZWMtYm90LWNoYWxsZW5nZS1zaW1wbGUKaW5iYW5kOgogIHBvc3RfZXZhbDoKICAgICMgU2tpcCB0aGUgY2hhbGxlbmdlIGZvciB2ZXJpZmllZCBnb29kIGJvdHMgKGZvcndhcmQtY29uZmlybWVkIHJETlMpIGFuZCBmb3IgcmVxdWVzdHMgYQogICAgIyB3ZWxsLWtub3duLXBhdGggZXhjbHVzaW9uIGNvbmZpZyBmbGFnZ2VkIHZpYSBFeGVtcHRGcm9tQ2hhbGxlbmdlKCkuIFRoZSBmbGFnIGlzIHBlci1yZXF1ZXN0IG9ubHkuCiAgICAtIGZpbHRlcjogIiFJc0xlZ2l0aW1hdGVCb3QocmVxLlJlbW90ZUFkZHIsIHJlcS5Vc2VyQWdlbnQoKSwgcmVxLlVSTC5QYXRoKSIKICAgICAgYXBwbHk6CiAgICAgICAgLSBTZW5kQ2hhbGxlbmdlKCkKICBvbl9jaGFsbGVuZ2Vfc3VibWl0OgogICAgIyBSZWplY3Qgc3VibWlzc2lvbnMgd2hvc2UgZmluZ2VycHJpbnQgZmFzdC1kZXRlY3QgZmxhZ3MgYSBrbm93biBib3QuIFRoZSByZXN1bHRpbmcgInJlamVjdGVkIgogICAgIyBldmVudCBmZWVkcyBjcm93ZHNlY3VyaXR5L2FwcHNlYy1ib3QtZGV0ZWN0ZWQgKGFsZXJ0IG9ubHksIG5vIGFjdGl2ZSBiYW4pLgogICAgLSBmaWx0ZXI6ICJmaW5nZXJwcmludC5Jc0JvdCgpIgogICAgICBhcHBseToKICAgICAgICAtIFJlamVjdFN1Ym1pc3Npb24oImtub3duIGJvdCAoZmFzdCBib3QgZGV0ZWN0aW9uKSIpCg==", "labels": null, - "path": "appsec-configs/crowdsecurity/challenge-exclude-webhooks.yaml", + "path": "appsec-configs/crowdsecurity/appsec-bot-challenge-simple.yaml", "version": "0.1", "versions": { "0.1": { "deprecated": false, - "digest": "7bdaa8a3d6a6f4564d12b782c10c3c7975c9230af4f843660794ad1952a1587b" + "digest": "cd0e642e5fec65d59189e06c31b20c4b44f2d1009230ee3280e06a9ef451db09" + } + } + }, + "crowdsecurity/appsec-default": { + "author": "crowdsecurity", + "content": "bmFtZTogY3Jvd2RzZWN1cml0eS9hcHBzZWMtZGVmYXVsdApkZWZhdWx0X3JlbWVkaWF0aW9uOiBiYW4KaW5iYW5kX3J1bGVzOgogLSBjcm93ZHNlY3VyaXR5L2Jhc2UtY29uZmlnIAogLSBjcm93ZHNlY3VyaXR5L3ZwYXRjaC0qCiAtIGNyb3dkc2VjdXJpdHkvZ2VuZXJpYy0qCm91dG9mYmFuZF9ydWxlczoKIC0gY3Jvd2RzZWN1cml0eS9leHBlcmltZW50YWwtKgogLSBjcm93ZHNlY3VyaXR5L2FwcHNlYy1nZW5lcmljLXRlc3QK", + "labels": null, + "path": "appsec-configs/crowdsecurity/appsec-default.yaml", + "version": "0.4", + "versions": { + "0.1": { + "deprecated": false, + "digest": "2b821a2cbcfdd7fdfd8ada95c00a4c6fdf8ce8a3efb55b1e3cd8eacc0ed418b6" + }, + "0.2": { + "deprecated": false, + "digest": "485710fec31feb36bfdd5a572a5174fd13a0e22ba812dfb78d92e1bfaea79a8d" + }, + "0.3": { + "deprecated": false, + "digest": "e3112166af61843dda46e1740e1151b5cfe9002517328d935c912fc94ef01a3a" + }, + "0.4": { + "deprecated": false, + "digest": "68e34ef8b7c8aaadca4233a7213f2fce706daf1b670fc1f544c03b0c8b2e7b87" } } }, @@ -135,23 +144,6 @@ } } }, - "crowdsecurity/simple-bot-challenge": { - "author": "crowdsecurity", - "content": "bmFtZTogY3Jvd2RzZWN1cml0eS9zaW1wbGUtYm90LWNoYWxsZW5nZQppbmJhbmQ6CiAgcG9zdF9ldmFsOgogICAgIyBTa2lwIHRoZSBjaGFsbGVuZ2UgZm9yIHZlcmlmaWVkIGdvb2QgYm90cyAoZm9yd2FyZC1jb25maXJtZWQgckROUykgYW5kIGZvciByZXF1ZXN0cyBhCiAgICAjIHdlbGwta25vd24tcGF0aCBleGNsdXNpb24gY29uZmlnIGZsYWdnZWQgdmlhIEV4ZW1wdEZyb21DaGFsbGVuZ2UoKS4gVGhlIGZsYWcgaXMgcGVyLXJlcXVlc3Qgb25seS4KICAgIC0gZmlsdGVyOiAiIUlzTGVnaXRpbWF0ZUJvdChyZXEuUmVtb3RlQWRkciwgcmVxLlVzZXJBZ2VudCgpLCByZXEuVVJMLlBhdGgpIgogICAgICBhcHBseToKICAgICAgICAtIFNlbmRDaGFsbGVuZ2UoKQogIG9uX2NoYWxsZW5nZV9zdWJtaXQ6CiAgICAjIFJlamVjdCBzdWJtaXNzaW9ucyB3aG9zZSBmaW5nZXJwcmludCBmYXN0LWRldGVjdCBmbGFncyBhIGtub3duIGJvdC4gVGhlIHJlc3VsdGluZyAicmVqZWN0ZWQiCiAgICAjIGV2ZW50IGZlZWRzIGNyb3dkc2VjdXJpdHkvYXBwc2VjLWJvdC1kZXRlY3RlZCAoYWxlcnQgb25seSwgbm8gYWN0aXZlIGJhbikuCiAgICAtIGZpbHRlcjogImZpbmdlcnByaW50LklzQm90KCkiCiAgICAgIGFwcGx5OgogICAgICAgIC0gUmVqZWN0U3VibWlzc2lvbigia25vd24gYm90IChmYXN0IGJvdCBkZXRlY3Rpb24pIikK", - "labels": null, - "path": "appsec-configs/crowdsecurity/simple-bot-challenge.yaml", - "version": "0.2", - "versions": { - "0.1": { - "deprecated": false, - "digest": "2881d29f726d947446981a828b16d6a6c32ae37bce272c51f05486ce865a2bfc" - }, - "0.2": { - "deprecated": false, - "digest": "044193fe0e4a13447e86f9e57b1717ab95ba21b1d94d2c8b5b30d1723201f386" - } - } - }, "crowdsecurity/virtual-patching": { "author": "crowdsecurity", "content": "bmFtZTogY3Jvd2RzZWN1cml0eS92aXJ0dWFsLXBhdGNoaW5nCmRlZmF1bHRfcmVtZWRpYXRpb246IGJhbgppbmJhbmRfcnVsZXM6CiAtIGNyb3dkc2VjdXJpdHkvYmFzZS1jb25maWcgCiAtIGNyb3dkc2VjdXJpdHkvdnBhdGNoLSoK", @@ -179,6 +171,19 @@ } }, "appsec-rules": { + "crowdsecurity/appsec-bot-legit-bots": { + "author": "crowdsecurity", + "content": "bmFtZTogY3Jvd2RzZWN1cml0eS9hcHBzZWMtYm90LWxlZ2l0LWJvdHMKCiMgVGhpcyBhcHBzZWMtcnVsZSBvbmx5IGRlY2xhcmVzIHRoZSBsZWdpdGltYXRlLWJvdCBkYXRhZmlsZXMgc28gY3Jvd2RzZWMgZG93bmxvYWRzIHRoZW0KIyBpbnRvIDxkYXRhZGlyPi9sZWdpdF9ib3RzLy4gVGhleSBhcmUgY29uc3VtZWQgYnkgdGhlIGVuZ2luZSdzIElzTGVnaXRpbWF0ZUJvdCgpIGhlbHBlcgojIChzZWUgY3Jvd2RzZWN1cml0eS9hcHBzZWMtYm90LWNoYWxsZW5nZS1zaW1wbGUpLCBub3QgYnkgc2VjbGFuZyBydWxlcy4KCmRhdGE6CiAgLSBzb3VyY2VfdXJsOiBodHRwczovL2h1Yi1kYXRhLmNyb3dkc2VjLm5ldC93aGl0ZWxpc3RzL2Jlbmlnbl9ib3RzL2xlZ2l0X2JvdHMvZ29vZ2xlYm90Lmpzb24KICAgIGRlc3RfZmlsZTogbGVnaXRfYm90cy9nb29nbGVib3QuanNvbgogICAgdHlwZTogYm90cwogIC0gc291cmNlX3VybDogaHR0cHM6Ly9odWItZGF0YS5jcm93ZHNlYy5uZXQvd2hpdGVsaXN0cy9iZW5pZ25fYm90cy9sZWdpdF9ib3RzL2Jpbmdib3QuanNvbgogICAgZGVzdF9maWxlOiBsZWdpdF9ib3RzL2Jpbmdib3QuanNvbgogICAgdHlwZTogYm90cwogIC0gc291cmNlX3VybDogaHR0cHM6Ly9odWItZGF0YS5jcm93ZHNlYy5uZXQvd2hpdGVsaXN0cy9iZW5pZ25fYm90cy9sZWdpdF9ib3RzL2FwcGxlYm90Lmpzb24KICAgIGRlc3RfZmlsZTogbGVnaXRfYm90cy9hcHBsZWJvdC5qc29uCiAgICB0eXBlOiBib3RzCiAgLSBzb3VyY2VfdXJsOiBodHRwczovL2h1Yi1kYXRhLmNyb3dkc2VjLm5ldC93aGl0ZWxpc3RzL2Jlbmlnbl9ib3RzL2xlZ2l0X2JvdHMvYW1hem9uYm90Lmpzb24KICAgIGRlc3RfZmlsZTogbGVnaXRfYm90cy9hbWF6b25ib3QuanNvbgogICAgdHlwZTogYm90cwogIC0gc291cmNlX3VybDogaHR0cHM6Ly9odWItZGF0YS5jcm93ZHNlYy5uZXQvd2hpdGVsaXN0cy9iZW5pZ25fYm90cy9sZWdpdF9ib3RzL2dwdGJvdC5qc29uCiAgICBkZXN0X2ZpbGU6IGxlZ2l0X2JvdHMvZ3B0Ym90Lmpzb24KICAgIHR5cGU6IGJvdHMK", + "labels": null, + "path": "appsec-rules/crowdsecurity/appsec-bot-legit-bots.yaml", + "version": "0.1", + "versions": { + "0.1": { + "deprecated": false, + "digest": "d14aaf40e01d877ff1b70336a3cc4e0ca0716bc3b62a4d1750ff8f7459661b90" + } + } + }, "crowdsecurity/appsec-generic-test": { "author": "crowdsecurity", "content": "bmFtZTogY3Jvd2RzZWN1cml0eS9hcHBzZWMtZ2VuZXJpYy10ZXN0CmRlc2NyaXB0aW9uOiAiQXBwU2VjIEdlbmVyaWMgVGVzdDogdHJpZ2dlciBvbiBHRVQgL2Nyb3dkc2VjLXRlc3QtTnRrdGxKSFY0VGZCU0szd3ZsaGlPQm5sYCIKcnVsZXM6CiAgLSBhbmQ6CiAgICAgICMgMSkgTWF0Y2ggdGhlIEhUVFAgdmVyYgogICAgICAtIHpvbmVzOgogICAgICAgICAgLSBNRVRIT0QKICAgICAgICBtYXRjaDoKICAgICAgICAgIHR5cGU6IHJlZ2V4CiAgICAgICAgICB2YWx1ZTogKEdFVHxIRUFEKQogICAgICAjIDIpIE1hdGNoIGV4YWN0bHkgdGhlIHRlc3QgcGF0aAogICAgICAtIHpvbmVzOgogICAgICAgICAgLSBVUkkKICAgICAgICBtYXRjaDoKICAgICAgICAgIHR5cGU6IGVxdWFscwogICAgICAgICAgdmFsdWU6IC9jcm93ZHNlYy10ZXN0LU50a3RsSkhWNFRmQlNLM3d2bGhpT0JubApsYWJlbHM6CiAgc2VydmljZTogaHR0cAogIHR5cGU6IHRlc3QKICBjb25maWRlbmNlOiAwCiAgc3Bvb2ZhYmxlOiAzCiAgYmVoYXZpb3I6ICJodHRwOnRlc3QiCiAgbGFiZWw6ICJBcHBTZWMgR2VuZXJpYyBUZXN0IgogIGNsYXNzaWZpY2F0aW9uOgogICAgLSBhdHRhY2suVDExOTAK", @@ -515,19 +520,6 @@ } } }, - "crowdsecurity/legit-bots": { - "author": "crowdsecurity", - "content": "bmFtZTogY3Jvd2RzZWN1cml0eS9sZWdpdC1ib3RzCgojIFRoaXMgYXBwc2VjLXJ1bGUgb25seSBkZWNsYXJlcyB0aGUgbGVnaXRpbWF0ZS1ib3QgZGF0YWZpbGVzIHNvIGNyb3dkc2VjIGRvd25sb2FkcyB0aGVtCiMgaW50byA8ZGF0YWRpcj4vbGVnaXRfYm90cy8uIFRoZXkgYXJlIGNvbnN1bWVkIGJ5IHRoZSBlbmdpbmUncyBJc0xlZ2l0aW1hdGVCb3QoKSBoZWxwZXIKIyAoc2VlIGNyb3dkc2VjdXJpdHkvc2ltcGxlLWJvdC1jaGFsbGVuZ2UpLCBub3QgYnkgc2VjbGFuZyBydWxlcy4KCmRhdGE6CiAgLSBzb3VyY2VfdXJsOiBodHRwczovL2h1Yi1kYXRhLmNyb3dkc2VjLm5ldC93aGl0ZWxpc3RzL2Jlbmlnbl9ib3RzL2xlZ2l0X2JvdHMvZ29vZ2xlYm90Lmpzb24KICAgIGRlc3RfZmlsZTogbGVnaXRfYm90cy9nb29nbGVib3QuanNvbgogICAgdHlwZTogYm90cwogIC0gc291cmNlX3VybDogaHR0cHM6Ly9odWItZGF0YS5jcm93ZHNlYy5uZXQvd2hpdGVsaXN0cy9iZW5pZ25fYm90cy9sZWdpdF9ib3RzL2Jpbmdib3QuanNvbgogICAgZGVzdF9maWxlOiBsZWdpdF9ib3RzL2Jpbmdib3QuanNvbgogICAgdHlwZTogYm90cwogIC0gc291cmNlX3VybDogaHR0cHM6Ly9odWItZGF0YS5jcm93ZHNlYy5uZXQvd2hpdGVsaXN0cy9iZW5pZ25fYm90cy9sZWdpdF9ib3RzL2FwcGxlYm90Lmpzb24KICAgIGRlc3RfZmlsZTogbGVnaXRfYm90cy9hcHBsZWJvdC5qc29uCiAgICB0eXBlOiBib3RzCiAgLSBzb3VyY2VfdXJsOiBodHRwczovL2h1Yi1kYXRhLmNyb3dkc2VjLm5ldC93aGl0ZWxpc3RzL2Jlbmlnbl9ib3RzL2xlZ2l0X2JvdHMvYW1hem9uYm90Lmpzb24KICAgIGRlc3RfZmlsZTogbGVnaXRfYm90cy9hbWF6b25ib3QuanNvbgogICAgdHlwZTogYm90cwogIC0gc291cmNlX3VybDogaHR0cHM6Ly9odWItZGF0YS5jcm93ZHNlYy5uZXQvd2hpdGVsaXN0cy9iZW5pZ25fYm90cy9sZWdpdF9ib3RzL2dwdGJvdC5qc29uCiAgICBkZXN0X2ZpbGU6IGxlZ2l0X2JvdHMvZ3B0Ym90Lmpzb24KICAgIHR5cGU6IGJvdHMK", - "labels": null, - "path": "appsec-rules/crowdsecurity/legit-bots.yaml", - "version": "0.1", - "versions": { - "0.1": { - "deprecated": false, - "digest": "a292ff161dec6142e11d600f39f82a1dacdd499f1ec1ae2f47bb208016da9908" - } - } - }, "crowdsecurity/vpatch-CVE-2002-1131": { "author": "crowdsecurity", "content": "IyMgYXV0b2dlbmVyYXRlZCBvbiAyMDI1LTA0LTIzIDEyOjU2OjQwCm5hbWU6IGNyb3dkc2VjdXJpdHkvdnBhdGNoLUNWRS0yMDAyLTExMzEKZGVzY3JpcHRpb246ICdEZXRlY3RzIFhTUyBhdHRlbXB0cyBpbiBTcXVpcnJlbE1haWwgMS4yLjYvMS4yLjcgdmlhIHVuc2FuaXRpemVkIGlucHV0IGluIGFkZHJlc3Nib29rLCBvcHRpb25zLCBzZWFyY2gsIGFuZCBoZWxwIG1vZHVsZXMuJwpydWxlczoKICAtIGFuZDoKICAgICAgLSB6b25lczoKICAgICAgICAgIC0gVVJJCiAgICAgICAgdHJhbnNmb3JtOgogICAgICAgICAgLSBsb3dlcmNhc2UKICAgICAgICAgIC0gdXJsZGVjb2RlCiAgICAgICAgbWF0Y2g6CiAgICAgICAgICB0eXBlOiBjb250YWlucwogICAgICAgICAgdmFsdWU6IC9zcmMvYWRkcmVzc2Jvb2sucGhwCiAgICAgIC0gem9uZXM6CiAgICAgICAgICAtIEFSR1NfTkFNRVMKICAgICAgICB0cmFuc2Zvcm06CiAgICAgICAgICAtIGxvd2VyY2FzZQogICAgICAgICAgLSB1cmxkZWNvZGUKICAgICAgICBtYXRjaDoKICAgICAgICAgIHR5cGU6IGNvbnRhaW5zCiAgICAgICAgICB2YWx1ZTogPAogIC0gYW5kOgogICAgICAtIHpvbmVzOgogICAgICAgICAgLSBVUkkKICAgICAgICB0cmFuc2Zvcm06CiAgICAgICAgICAtIGxvd2VyY2FzZQogICAgICAgICAgLSB1cmxkZWNvZGUKICAgICAgICBtYXRjaDoKICAgICAgICAgIHR5cGU6IGNvbnRhaW5zCiAgICAgICAgICB2YWx1ZTogL3NyYy9vcHRpb25zLnBocAogICAgICAtIHpvbmVzOgogICAgICAgICAgLSBBUkdTCiAgICAgICAgdmFyaWFibGVzOgogICAgICAgICAgLSBvcHRwYWdlCiAgICAgICAgdHJhbnNmb3JtOgogICAgICAgICAgLSBsb3dlcmNhc2UKICAgICAgICAgIC0gdXJsZGVjb2RlCiAgICAgICAgbWF0Y2g6CiAgICAgICAgICB0eXBlOiBjb250YWlucwogICAgICAgICAgdmFsdWU6IDwKICAtIGFuZDoKICAgICAgLSB6b25lczoKICAgICAgICAgIC0gVVJJCiAgICAgICAgdHJhbnNmb3JtOgogICAgICAgICAgLSBsb3dlcmNhc2UKICAgICAgICAgIC0gdXJsZGVjb2RlCiAgICAgICAgbWF0Y2g6CiAgICAgICAgICB0eXBlOiBjb250YWlucwogICAgICAgICAgdmFsdWU6IC9zcmMvc2VhcmNoLnBocAogICAgICAtIHpvbmVzOgogICAgICAgICAgLSBBUkdTCiAgICAgICAgdmFyaWFibGVzOgogICAgICAgICAgLSBtYWlsYm94CiAgICAgICAgICAtIHdoZXJlCiAgICAgICAgdHJhbnNmb3JtOgogICAgICAgICAgLSBsb3dlcmNhc2UKICAgICAgICAgIC0gdXJsZGVjb2RlCiAgICAgICAgbWF0Y2g6CiAgICAgICAgICB0eXBlOiBjb250YWlucwogICAgICAgICAgdmFsdWU6IDwKICAtIGFuZDoKICAgICAgLSB6b25lczoKICAgICAgICAgIC0gVVJJCiAgICAgICAgdHJhbnNmb3JtOgogICAgICAgICAgLSBsb3dlcmNhc2UKICAgICAgICAgIC0gdXJsZGVjb2RlCiAgICAgICAgbWF0Y2g6CiAgICAgICAgICB0eXBlOiBjb250YWlucwogICAgICAgICAgdmFsdWU6IC9zcmMvaGVscC5waHAKICAgICAgLSB6b25lczoKICAgICAgICAgIC0gQVJHUwogICAgICAgIHZhcmlhYmxlczoKICAgICAgICAgIC0gY2hhcHRlcgogICAgICAgIHRyYW5zZm9ybToKICAgICAgICAgIC0gbG93ZXJjYXNlCiAgICAgICAgICAtIHVybGRlY29kZQogICAgICAgIG1hdGNoOgogICAgICAgICAgdHlwZTogY29udGFpbnMKICAgICAgICAgIHZhbHVlOiA8CgpsYWJlbHM6CiAgdHlwZTogZXhwbG9pdAogIHNlcnZpY2U6IGh0dHAKICBjb25maWRlbmNlOiAzCiAgc3Bvb2ZhYmxlOiAwCiAgYmVoYXZpb3I6ICdodHRwOmV4cGxvaXQnCiAgbGFiZWw6ICdTcXVpcnJlbE1haWwgLSBYU1MnCiAgY2xhc3NpZmljYXRpb246CiAgICAtIGN2ZS5DVkUtMjAwMi0xMTMxCiAgICAtIGF0dGFjay5UMTA1OQogICAgLSBjd2UuQ1dFLTgwCg==", @@ -7819,25 +7811,25 @@ }, "crowdsecurity/appsec-bot-challenge": { "appsec-configs": [ - "crowdsecurity/simple-bot-challenge", - "crowdsecurity/challenge-exclude-crawler-files", - "crowdsecurity/challenge-exclude-feeds", - "crowdsecurity/challenge-exclude-webhooks" + "crowdsecurity/appsec-bot-challenge-simple", + "crowdsecurity/appsec-bot-challenge-exclude-crawler-files", + "crowdsecurity/appsec-bot-challenge-exclude-feeds", + "crowdsecurity/appsec-bot-challenge-exclude-webhooks" ], "appsec-rules": [ - "crowdsecurity/legit-bots" + "crowdsecurity/appsec-bot-legit-bots" ], "author": "crowdsecurity", - "content": "bmFtZTogY3Jvd2RzZWN1cml0eS9hcHBzZWMtYm90LWNoYWxsZW5nZQpwYXJzZXJzOgogIC0gY3Jvd2RzZWN1cml0eS9hcHBzZWMtbG9ncwogIC0gY3Jvd2RzZWN1cml0eS9hcHBzZWMtYm90LWRldGVjdGlvbi1sb2dzCmFwcHNlYy1jb25maWdzOgogIC0gY3Jvd2RzZWN1cml0eS9zaW1wbGUtYm90LWNoYWxsZW5nZQogIC0gY3Jvd2RzZWN1cml0eS9jaGFsbGVuZ2UtZXhjbHVkZS1jcmF3bGVyLWZpbGVzCiAgLSBjcm93ZHNlY3VyaXR5L2NoYWxsZW5nZS1leGNsdWRlLWZlZWRzCiAgLSBjcm93ZHNlY3VyaXR5L2NoYWxsZW5nZS1leGNsdWRlLXdlYmhvb2tzCmFwcHNlYy1ydWxlczoKICAtIGNyb3dkc2VjdXJpdHkvbGVnaXQtYm90cwpzY2VuYXJpb3M6CiAgLSBjcm93ZHNlY3VyaXR5L2FwcHNlYy1ib3QtZGV0ZWN0ZWQKICAtIGNyb3dkc2VjdXJpdHkvYXBwc2VjLWNoYWxsZW5nZS10b28tbWFueS1yZXF1ZXN0cwogIC0gY3Jvd2RzZWN1cml0eS9hcHBzZWMtY2hhbGxlbmdlLXRvby1tYW55LXN1Ym1pc3Npb25zCiAgLSBjcm93ZHNlY3VyaXR5L2FwcHNlYy1jaGFsbGVuZ2UtcmVxdWVzdC13aXRoLW5vLXN1Ym1pc3Npb24KY29udGV4dHM6CiAgLSBjcm93ZHNlY3VyaXR5L2FwcHNlY19iYXNlCiAgLSBjcm93ZHNlY3VyaXR5L2FwcHNlY19ib3RfZGV0ZWN0aW9uCmRlc2NyaXB0aW9uOiAiQXBwU2VjIGJvdCBkZXRlY3Rpb246IGNoYWxsZW5nZSBtb2RlIHdpdGggZmFzdC1kZXRlY3QgYm90IHJlamVjdGlvbiBhbmQgd2VsbC1rbm93bi1wYXRoIGV4Y2x1c2lvbnMiCmxhYmVsczoKICBsYWJlbDogIldBRiAtIEJvdCBDaGFsbGVuZ2UiCmF1dGhvcjogY3Jvd2RzZWN1cml0eQp0YWdzOgogIC0gd2FmCiAgLSBhcHBzZWMKICAtIGh0dHAKICAtIGJvdAo=", + "content": "bmFtZTogY3Jvd2RzZWN1cml0eS9hcHBzZWMtYm90LWNoYWxsZW5nZQpwYXJzZXJzOgogIC0gY3Jvd2RzZWN1cml0eS9hcHBzZWMtbG9ncwogIC0gY3Jvd2RzZWN1cml0eS9hcHBzZWMtYm90LWRldGVjdGlvbi1sb2dzCmFwcHNlYy1jb25maWdzOgogIC0gY3Jvd2RzZWN1cml0eS9hcHBzZWMtYm90LWNoYWxsZW5nZS1zaW1wbGUKICAtIGNyb3dkc2VjdXJpdHkvYXBwc2VjLWJvdC1jaGFsbGVuZ2UtZXhjbHVkZS1jcmF3bGVyLWZpbGVzCiAgLSBjcm93ZHNlY3VyaXR5L2FwcHNlYy1ib3QtY2hhbGxlbmdlLWV4Y2x1ZGUtZmVlZHMKICAtIGNyb3dkc2VjdXJpdHkvYXBwc2VjLWJvdC1jaGFsbGVuZ2UtZXhjbHVkZS13ZWJob29rcwphcHBzZWMtcnVsZXM6CiAgLSBjcm93ZHNlY3VyaXR5L2FwcHNlYy1ib3QtbGVnaXQtYm90cwpzY2VuYXJpb3M6CiAgLSBjcm93ZHNlY3VyaXR5L2FwcHNlYy1ib3QtZGV0ZWN0ZWQKICAtIGNyb3dkc2VjdXJpdHkvYXBwc2VjLWJvdC1jaGFsbGVuZ2UtdG9vLW1hbnktcmVxdWVzdHMKICAtIGNyb3dkc2VjdXJpdHkvYXBwc2VjLWJvdC1jaGFsbGVuZ2UtdG9vLW1hbnktc3VibWlzc2lvbnMKICAtIGNyb3dkc2VjdXJpdHkvYXBwc2VjLWJvdC1jaGFsbGVuZ2UtcmVxdWVzdC13aXRoLW5vLXN1Ym1pc3Npb24KY29udGV4dHM6CiAgLSBjcm93ZHNlY3VyaXR5L2FwcHNlY19iYXNlCiAgLSBjcm93ZHNlY3VyaXR5L2FwcHNlYy1ib3QtZGV0ZWN0aW9uCmRlc2NyaXB0aW9uOiAiQXBwU2VjIGJvdCBkZXRlY3Rpb246IGNoYWxsZW5nZSBtb2RlIHdpdGggZmFzdC1kZXRlY3QgYm90IHJlamVjdGlvbiBhbmQgd2VsbC1rbm93bi1wYXRoIGV4Y2x1c2lvbnMiCmxhYmVsczoKICBsYWJlbDogIldBRiAtIEJvdCBDaGFsbGVuZ2UiCmF1dGhvcjogY3Jvd2RzZWN1cml0eQp0YWdzOgogIC0gd2FmCiAgLSBhcHBzZWMKICAtIGh0dHAKICAtIGJvdAo=", "contexts": [ "crowdsecurity/appsec_base", - "crowdsecurity/appsec_bot_detection" + "crowdsecurity/appsec-bot-detection" ], "description": "AppSec bot detection: challenge mode with fast-detect bot rejection and well-known-path exclusions", "labels": { "label": "WAF - Bot Challenge" }, - "long_description": "IyBBcHBTZWMgQm90IENoYWxsZW5nZQoKVGhpcyBjb2xsZWN0aW9uIGVuYWJsZXMgQ3Jvd2RTZWMgQXBwU2VjICoqY2hhbGxlbmdlIG1vZGUqKiBmb3IgYm90IGRldGVjdGlvbjogdmlzaXRvcnMgYXJlIHNlcnZlZCBhCmxpZ2h0d2VpZ2h0IHByb29mLW9mLXdvcmsgKyBicm93c2VyLWZpbmdlcnByaW50IGNoYWxsZW5nZSwgYW5kIGNsaWVudHMgZmxhZ2dlZCBhcyBrbm93biBib3RzIGJ5IHRoZQpmYXN0IGJvdCBkZXRlY3Rpb24gYXJlIHJlamVjdGVkLgoKV2hhdCBpdCBzaGlwczoKCiAtIGBjcm93ZHNlY3VyaXR5L3NpbXBsZS1ib3QtY2hhbGxlbmdlYDogY2hhbGxlbmdlcyBpbmNvbWluZyByZXF1ZXN0cywgc2tpcHMgdmVyaWZpZWQgZ29vZCBib3RzCiAgIChmb3J3YXJkLWNvbmZpcm1lZCByRE5TKSwgYW5kIHJlamVjdHMgY2hhbGxlbmdlIHN1Ym1pc3Npb25zIHdob3NlIGZpbmdlcnByaW50IHRyaXBzIHRoZSBmYXN0IGJvdAogICBkZXRlY3Rpb24uCiAtIFdlbGwta25vd24tcGF0aCBleGNsdXNpb24gY29uZmlncyAoYGNoYWxsZW5nZS1leGNsdWRlLWNyYXdsZXItZmlsZXNgLCBgLWZlZWRzYCwgYC13ZWJob29rc2ApIHRoYXQKICAgbGV0IG1hY2hpbmUtZmFjaW5nIGVuZHBvaW50cyAoYC9yb2JvdHMudHh0YCwgYC8ud2VsbC1rbm93bi8qYCwgZmVlZHMsIHdlYmhvb2tzKSB0aHJvdWdoIHdpdGhvdXQgYQogICBjaGFsbGVuZ2UuIFRoZSBleGNsdXNpb24gaXMgc3RyaWN0bHkgcGVyLXJlcXVlc3QgYW5kIGlzIG5ldmVyIHBlcnNpc3RlZCB0byBhIGNvb2tpZSBvciBhY3Jvc3MKICAgcmVxdWVzdHMsIHNvIGl0IGNhbm5vdCBiZSBhYnVzZWQgdG8gd2hpdGVsaXN0IGEgc2Vzc2lvbiBmb3Igb3RoZXIgcGF0aHMuCiAtIEEgZGVkaWNhdGVkIGJvdC1kZXRlY3Rpb24gcGFyc2VyIHRyYWNraW5nIHRoZSBmaW5nZXJwcmludCBzZXNzaW9uIGlkIChgZnNpZGApIGFuZCBPUy4KIC0gU2NlbmFyaW9zIHRoYXQgYWxlcnQgb24gZGV0ZWN0ZWQgYm90cyBhbmQgb24gY2hhbGxlbmdlIGFidXNlLgogLSBBIHVzZXItZnJpZW5kbHkgYWxlcnQgY29udGV4dCBleHBvc2luZyBgZnNpZGAsIE9TLCBhbmQgdGhlIGJvdCBzaWduYWxzIHRoYXQgZmlyZWQuCgojIyBFbmFibGluZyBib3QgY2hhbGxlbmdlCgpBZGQgdGhlIGBjcm93ZHNlY3VyaXR5L3NpbXBsZS1ib3QtY2hhbGxlbmdlYCBhcHBzZWMtY29uZmlnIHRvIHlvdXIgV0FGIGFjcXVpc2l0aW9uLCBwbHVzIGFueSBvZiB0aGUKd2VsbC1rbm93bi1wYXRoIGV4Y2x1c2lvbiBjb25maWdzIHlvdSBuZWVkOgoKYGBgeWFtbAphcHBzZWNfY29uZmlnczoKIC0gY3Jvd2RzZWN1cml0eS9zaW1wbGUtYm90LWNoYWxsZW5nZQogLSBjcm93ZHNlY3VyaXR5L2NoYWxsZW5nZS1leGNsdWRlLWNyYXdsZXItZmlsZXMKIC0gY3Jvd2RzZWN1cml0eS9jaGFsbGVuZ2UtZXhjbHVkZS1mZWVkcwogLSBjcm93ZHNlY3VyaXR5L2NoYWxsZW5nZS1leGNsdWRlLXdlYmhvb2tzCmxhYmVsczoKICB0eXBlOiBhcHBzZWMKbGlzdGVuX2FkZHI6IDEyNy4wLjAuMTo3NDIyCnNvdXJjZTogYXBwc2VjCmBgYAo=", + "long_description": "IyBBcHBTZWMgQm90IENoYWxsZW5nZQoKVGhpcyBjb2xsZWN0aW9uIGVuYWJsZXMgQ3Jvd2RTZWMgQXBwU2VjICoqY2hhbGxlbmdlIG1vZGUqKiBmb3IgYm90IGRldGVjdGlvbjogdmlzaXRvcnMgYXJlIHNlcnZlZCBhCmxpZ2h0d2VpZ2h0IHByb29mLW9mLXdvcmsgKyBicm93c2VyLWZpbmdlcnByaW50IGNoYWxsZW5nZSwgYW5kIGNsaWVudHMgZmxhZ2dlZCBhcyBrbm93biBib3RzIGJ5IHRoZQpmYXN0IGJvdCBkZXRlY3Rpb24gYXJlIHJlamVjdGVkLgoKV2hhdCBpdCBzaGlwczoKCiAtIGBjcm93ZHNlY3VyaXR5L2FwcHNlYy1ib3QtY2hhbGxlbmdlLXNpbXBsZWA6IGNoYWxsZW5nZXMgaW5jb21pbmcgcmVxdWVzdHMsIHNraXBzIHZlcmlmaWVkIGdvb2QgYm90cwogICAoZm9yd2FyZC1jb25maXJtZWQgckROUyksIGFuZCByZWplY3RzIGNoYWxsZW5nZSBzdWJtaXNzaW9ucyB3aG9zZSBmaW5nZXJwcmludCB0cmlwcyB0aGUgZmFzdCBib3QKICAgZGV0ZWN0aW9uLgogLSBgY3Jvd2RzZWN1cml0eS9hcHBzZWMtYm90LWxlZ2l0LWJvdHNgOiBzaGlwcyB0aGUgdmVyaWZpZWQtZ29vZC1ib3QgZGF0YWZpbGVzIChnb29nbGVib3QsIGJpbmdib3QsCiAgIGFwcGxlYm90LCBhbWF6b25ib3QsIGdwdGJvdCkgdGhhdCBiYWNrIHRoZSBmb3J3YXJkLWNvbmZpcm1lZCByRE5TIGV4Y2x1c2lvbiBhYm92ZSwgc28gbGVnaXRpbWF0ZQogICBjcmF3bGVycyBza2lwIHRoZSBjaGFsbGVuZ2UuCiAtIFdlbGwta25vd24tcGF0aCBleGNsdXNpb24gY29uZmlncyAoYGFwcHNlYy1ib3QtY2hhbGxlbmdlLWV4Y2x1ZGUtY3Jhd2xlci1maWxlc2AsIGAtZmVlZHNgLCBgLXdlYmhvb2tzYCkgdGhhdAogICBsZXQgbWFjaGluZS1mYWNpbmcgZW5kcG9pbnRzIChgL3JvYm90cy50eHRgLCBgLy53ZWxsLWtub3duLypgLCBmZWVkcywgd2ViaG9va3MpIHRocm91Z2ggd2l0aG91dCBhCiAgIGNoYWxsZW5nZS4gVGhlIGV4Y2x1c2lvbiBpcyBzdHJpY3RseSBwZXItcmVxdWVzdCBhbmQgaXMgbmV2ZXIgcGVyc2lzdGVkIHRvIGEgY29va2llIG9yIGFjcm9zcwogICByZXF1ZXN0cywgc28gaXQgY2Fubm90IGJlIGFidXNlZCB0byB3aGl0ZWxpc3QgYSBzZXNzaW9uIGZvciBvdGhlciBwYXRocy4KIC0gQSBkZWRpY2F0ZWQgYm90LWRldGVjdGlvbiBwYXJzZXIgdHJhY2tpbmcgdGhlIGZpbmdlcnByaW50IHNlc3Npb24gaWQgKGBmc2lkYCkgYW5kIE9TLgogLSBTY2VuYXJpb3MgdGhhdCBhbGVydCBvbiBkZXRlY3RlZCBib3RzIGFuZCBvbiBjaGFsbGVuZ2UgYWJ1c2UuCiAtIEEgdXNlci1mcmllbmRseSBhbGVydCBjb250ZXh0IGV4cG9zaW5nIGBmc2lkYCwgT1MsIGFuZCB0aGUgYm90IHNpZ25hbHMgdGhhdCBmaXJlZC4KCiMjIEVuYWJsaW5nIGJvdCBjaGFsbGVuZ2UKCkFkZCB0aGUgYGNyb3dkc2VjdXJpdHkvYXBwc2VjLWJvdC1jaGFsbGVuZ2Utc2ltcGxlYCBhcHBzZWMtY29uZmlnIHRvIHlvdXIgV0FGIGFjcXVpc2l0aW9uLCBwbHVzIGFueSBvZiB0aGUKd2VsbC1rbm93bi1wYXRoIGV4Y2x1c2lvbiBjb25maWdzIHlvdSBuZWVkOgoKYGBgeWFtbAphcHBzZWNfY29uZmlnczoKIC0gY3Jvd2RzZWN1cml0eS9hcHBzZWMtYm90LWNoYWxsZW5nZS1zaW1wbGUKIC0gY3Jvd2RzZWN1cml0eS9hcHBzZWMtYm90LWNoYWxsZW5nZS1leGNsdWRlLWNyYXdsZXItZmlsZXMKIC0gY3Jvd2RzZWN1cml0eS9hcHBzZWMtYm90LWNoYWxsZW5nZS1leGNsdWRlLWZlZWRzCiAtIGNyb3dkc2VjdXJpdHkvYXBwc2VjLWJvdC1jaGFsbGVuZ2UtZXhjbHVkZS13ZWJob29rcwpsYWJlbHM6CiAgdHlwZTogYXBwc2VjCmxpc3Rlbl9hZGRyOiAxMjcuMC4wLjE6NzQyMgpzb3VyY2U6IGFwcHNlYwpgYGAK", "parsers": [ "crowdsecurity/appsec-logs", "crowdsecurity/appsec-bot-detection-logs" @@ -7845,11 +7837,11 @@ "path": "collections/crowdsecurity/appsec-bot-challenge.yaml", "scenarios": [ "crowdsecurity/appsec-bot-detected", - "crowdsecurity/appsec-challenge-too-many-requests", - "crowdsecurity/appsec-challenge-too-many-submissions", - "crowdsecurity/appsec-challenge-request-with-no-submission" + "crowdsecurity/appsec-bot-challenge-too-many-requests", + "crowdsecurity/appsec-bot-challenge-too-many-submissions", + "crowdsecurity/appsec-bot-challenge-request-with-no-submission" ], - "version": "0.2", + "version": "0.3", "versions": { "0.1": { "deprecated": false, @@ -7858,6 +7850,10 @@ "0.2": { "deprecated": false, "digest": "79f6198d3cd338927517ed13fec5966041c52fffbb4d0f04a1ba733672ac80b1" + }, + "0.3": { + "deprecated": false, + "digest": "15a3e245424158241a8178dcb4df0f8e81906e69ca01894974924846aa365889" } } }, @@ -13135,6 +13131,19 @@ } }, "contexts": { + "crowdsecurity/appsec-bot-detection": { + "author": "crowdsecurity", + "content": "IyBVc2VyLWZyaWVuZGx5IGNvbnRleHQgZm9yIEFwcFNlYyBib3QtZGV0ZWN0aW9uIC8gY2hhbGxlbmdlIGV2ZW50cy4KIyBkZXRlY3RlZF9zaWduYWxzIHVzZXMgdGhlIGZpbmdlcnByaW50IGhlbHBlciBCb3RTaWduYWxzKCksIHdoaWNoIHJldHVybnMgdGhlCiMgbmFtZXMgb2YgdGhlIGZhc3QtZGV0ZWN0aW9uIHNpZ25hbHMgdGhhdCBmaXJlZDsgdGhlIGFsZXJ0LWNvbnRleHQgZW5naW5lCiMgcmVuZGVycyB0aGUgW11zdHJpbmcgYXMgYSBsaXN0LiBUaGUgbmlsIGd1YXJkIGNvdmVycyAicmVxdWVzdGVkIiBldmVudHMgdGhhdAojIGNhcnJ5IG5vIGZpbmdlcnByaW50Lgpjb250ZXh0OgogIGZpbmdlcnByaW50X2lkOgogICAgLSBldnQuTWV0YS5mc2lkCiAgb3BlcmF0aW5nX3N5c3RlbToKICAgIC0gZXZ0Lk1ldGEub3MKICB1c2VyX2FnZW50OgogICAgLSBldnQuTWV0YS5odHRwX3VzZXJfYWdlbnQKICBib3RfZGV0ZWN0ZWQ6CiAgICAtIGV2dC5NZXRhLmZpbmdlcnByaW50X2JvdAogIGNoYWxsZW5nZV9ldmVudDoKICAgIC0gZXZ0Lk1ldGEuY2hhbGxlbmdlX2V2ZW50CiAgZGV0ZWN0ZWRfc2lnbmFsczoKICAgIC0gJ2V2dC5Vbm1hcnNoYWxlZC5maW5nZXJwcmludCAhPSBuaWwgPyBldnQuVW5tYXJzaGFsZWQuZmluZ2VycHJpbnQuQm90U2lnbmFscygpIDogIiInCg==", + "labels": null, + "path": "contexts/crowdsecurity/appsec-bot-detection.yaml", + "version": "0.1", + "versions": { + "0.1": { + "deprecated": false, + "digest": "15eaa25aaa8095fcc5dc9bae535d18ba3f53be6f17a5a6a9fd8e146248ebc53c" + } + } + }, "crowdsecurity/appsec_base": { "author": "crowdsecurity", "content": "Y29udGV4dDoKICBydWxlczoKICAgIC0gZXZ0Lk1ldGEucnVsZV9uYW1lCiAgdGFyZ2V0X3VyaToKICAgIC0gZXZ0Lk1ldGEudGFyZ2V0X3VyaQogICAgLSAiKG1hdGNoLnVyaSAhPSBuaWwgJiYgbWF0Y2guaW50ZXJuYWwgIT0gdHJ1ZSkgPyBtYXRjaC51cmkgOiAnJyIKICBuYW1lOgogICAgLSAiKG1hdGNoLm5hbWUgIT0gbmlsICYmIG1hdGNoLmludGVybmFsICE9IHRydWUpID8gbWF0Y2gubmFtZSA6ICcnIgogIG1ldGhvZDoKICAgIC0gIihtYXRjaC5tZXRob2QgIT0gbmlsICYmIG1hdGNoLmludGVybmFsICE9IHRydWUpID8gbWF0Y2gubWV0aG9kIDogJyciCiAgbWF0Y2hlZF96b25lczoKICAgIC0gIihtYXRjaC5tYXRjaGVkX3pvbmVzICE9IG5pbCAmJiBtYXRjaC5pbnRlcm5hbCAhPSB0cnVlKSA/IG1hdGNoLm1hdGNoZWRfem9uZXMgOiAnJyIKICBtc2c6CiAgICAtICIobWF0Y2gubXNnICE9IG5pbCAmJiBtYXRjaC5pbnRlcm5hbCAhPSB0cnVlKSA/IG1hdGNoLm1zZyA6ICcnIgogIGphNGg6CiAgICAtICJyZXEuTWV0aG9kICE9ICcnID8gSkE0SChyZXEpIDonJyIKICB1c2VyX2FnZW50OgogICAgLSAicmVxLk1ldGhvZCAhPSAnJyA/IHJlcS5Vc2VyQWdlbnQoKSA6ICcnIgo=", @@ -13188,23 +13197,6 @@ } } }, - "crowdsecurity/appsec_bot_detection": { - "author": "crowdsecurity", - "content": "IyBVc2VyLWZyaWVuZGx5IGNvbnRleHQgZm9yIEFwcFNlYyBib3QtZGV0ZWN0aW9uIC8gY2hhbGxlbmdlIGV2ZW50cy4KIyBkZXRlY3RlZF9zaWduYWxzIHVzZXMgdGhlIGZpbmdlcnByaW50IGhlbHBlciBCb3RTaWduYWxzKCksIHdoaWNoIHJldHVybnMgdGhlCiMgbmFtZXMgb2YgdGhlIGZhc3QtZGV0ZWN0aW9uIHNpZ25hbHMgdGhhdCBmaXJlZDsgdGhlIGFsZXJ0LWNvbnRleHQgZW5naW5lCiMgcmVuZGVycyB0aGUgW11zdHJpbmcgYXMgYSBsaXN0LiBUaGUgbmlsIGd1YXJkIGNvdmVycyAicmVxdWVzdGVkIiBldmVudHMgdGhhdAojIGNhcnJ5IG5vIGZpbmdlcnByaW50Lgpjb250ZXh0OgogIGZpbmdlcnByaW50X2lkOgogICAgLSBldnQuTWV0YS5mc2lkCiAgb3BlcmF0aW5nX3N5c3RlbToKICAgIC0gZXZ0Lk1ldGEub3MKICB1c2VyX2FnZW50OgogICAgLSBldnQuTWV0YS5odHRwX3VzZXJfYWdlbnQKICBib3RfZGV0ZWN0ZWQ6CiAgICAtIGV2dC5NZXRhLmZpbmdlcnByaW50X2JvdAogIGNoYWxsZW5nZV9ldmVudDoKICAgIC0gZXZ0Lk1ldGEuY2hhbGxlbmdlX2V2ZW50CiAgZGV0ZWN0ZWRfc2lnbmFsczoKICAgIC0gJ2V2dC5Vbm1hcnNoYWxlZC5maW5nZXJwcmludCAhPSBuaWwgPyBldnQuVW5tYXJzaGFsZWQuZmluZ2VycHJpbnQuQm90U2lnbmFscygpIDogIiInCg==", - "labels": null, - "path": "contexts/crowdsecurity/appsec_bot_detection.yaml", - "version": "0.2", - "versions": { - "0.1": { - "deprecated": false, - "digest": "7d81f58a9af6a9898b60b3c201bbaec671e757a804d47fde2cd33b8230315af4" - }, - "0.2": { - "deprecated": false, - "digest": "15eaa25aaa8095fcc5dc9bae535d18ba3f53be6f17a5a6a9fd8e146248ebc53c" - } - } - }, "crowdsecurity/bf_base": { "author": "crowdsecurity", "content": "I2EgZ2VuZXJpYyBjb250ZXh0IGZvciBicnV0ZWZvcmNlIGJhc2VkIHNjZW5hcmlvcwpjb250ZXh0OgogIHRhcmdldF91c2VyOgogICAgLSBldnQuTWV0YS50YXJnZXRfdXNlcgo=", @@ -19854,33 +19846,32 @@ } } }, - "crowdsecurity/appsec-bot-detected": { + "crowdsecurity/appsec-bot-challenge-request-with-no-submission": { "author": "crowdsecurity", - "content": "dHlwZTogdHJpZ2dlcgpmb3JtYXQ6IDMuMAojZGVidWc6IHRydWUKbmFtZTogY3Jvd2RzZWN1cml0eS9hcHBzZWMtYm90LWRldGVjdGVkCmRlc2NyaXB0aW9uOiAiQSBrbm93biBib3Qgd2FzIGRldGVjdGVkIGFuZCByZWplY3RlZCBieSB0aGUgQXBwU2VjIGNoYWxsZW5nZSAoZmFzdCBib3QgZGV0ZWN0aW9uKSIKZmlsdGVyOiAiZXZ0Lk1ldGEubG9nX3R5cGUgPT0gJ2FwcHNlYy1jaGFsbGVuZ2UnICYmIGV2dC5NZXRhLmNoYWxsZW5nZV9ldmVudCA9PSAncmVqZWN0ZWQnIgpncm91cGJ5OiBldnQuTWV0YS5zb3VyY2VfaXAKYmxhY2tob2xlOiAxbQpsYWJlbHM6CiAgc2VydmljZTogaHR0cAogIGNvbmZpZGVuY2U6IDEKICBzcG9vZmFibGU6IDAKICBjbGFzc2lmaWNhdGlvbjoKICAgIC0gYXR0YWNrLlQxMDcxCiAgbGFiZWw6ICJCb3QgZGV0ZWN0ZWQgYnkgQ3Jvd2RTZWMgQXBwU2VjIGNoYWxsZW5nZSIKICBiZWhhdmlvcjogImh0dHA6Ym90IgogIHJlbWVkaWF0aW9uOiBmYWxzZQo=", - "description": "A known bot was detected and rejected by the AppSec challenge (fast bot detection)", + "content": "dHlwZTogY291bnRlcgpmb3JtYXQ6IDMuMAojZGVidWc6IHRydWUKbmFtZTogY3Jvd2RzZWN1cml0eS9hcHBzZWMtYm90LWNoYWxsZW5nZS1yZXF1ZXN0LXdpdGgtbm8tc3VibWlzc2lvbgpkZXNjcmlwdGlvbjogIkNsaWVudCB3YXMgc2VydmVkIHRoZSBjaGFsbGVuZ2UgcGFnZSBidXQgbmV2ZXIgc3VibWl0dGVkIGl0IgpmaWx0ZXI6ICJldnQuTWV0YS5sb2dfdHlwZSA9PSAnYXBwc2VjLWNoYWxsZW5nZScgJiYgKGV2dC5NZXRhLmNoYWxsZW5nZV9ldmVudCA9PSAncmVxdWVzdGVkJyB8fCBldnQuTWV0YS5jaGFsbGVuZ2VfZXZlbnQgPT0gJ3N1Ym1pdHRlZCcpIgpjYW5jZWxfb246ICJldnQuTWV0YS5sb2dfdHlwZSA9PSAnYXBwc2VjLWNoYWxsZW5nZScgJiYgZXZ0Lk1ldGEuY2hhbGxlbmdlX2V2ZW50ID09ICdzdWJtaXR0ZWQnIgpkdXJhdGlvbjogMTIwcwpjYXBhY2l0eTogLTEKY2FjaGVfc2l6ZTogMQpncm91cGJ5OiBldnQuTWV0YS5zb3VyY2VfaXAKYmxhY2tob2xlOiAxMHMKbGFiZWxzOgogIHNlcnZpY2U6IGh0dHAKICBjb25maWRlbmNlOiAwCiAgc3Bvb2ZhYmxlOiAwCiAgY2xhc3NpZmljYXRpb246CiAgICAtIGF0dGFjay5UMTExMAogIGxhYmVsOiAiQmxvY2tlZCBieSBDcm93ZFNlYyBBcHBTZWMiCiAgYmVoYXZpb3I6ICJodHRwOmV4cGxvaXQiCg==", + "description": "Client was served the challenge page but never submitted it", "labels": { - "behavior": "http:bot", + "behavior": "http:exploit", "classification": [ - "attack.T1071" + "attack.T1110" ], - "confidence": 1, - "label": "Bot detected by CrowdSec AppSec challenge", - "remediation": false, + "confidence": 0, + "label": "Blocked by CrowdSec AppSec", "service": "http", "spoofable": 0 }, - "path": "scenarios/crowdsecurity/appsec-bot-detected.yaml", + "path": "scenarios/crowdsecurity/appsec-bot-challenge-request-with-no-submission.yaml", "version": "0.1", "versions": { "0.1": { "deprecated": false, - "digest": "7a2061fa15c50f587158de5bd474b5a99e1f4a0b32e75ab5c112019e2d843461" + "digest": "fcdbbf901f8c60304169e33974a355a5d75384ef3c923059aa35efccdcc09352" } } }, - "crowdsecurity/appsec-challenge-request-with-no-submission": { + "crowdsecurity/appsec-bot-challenge-too-many-requests": { "author": "crowdsecurity", - "content": "dHlwZTogY291bnRlcgpmb3JtYXQ6IDMuMAojZGVidWc6IHRydWUKbmFtZTogY3Jvd2RzZWN1cml0eS9hcHBzZWMtY2hhbGxlbmdlLXJlcXVlc3Qtd2l0aC1uby1zdWJtaXNzaW9uCmRlc2NyaXB0aW9uOiAiQ2xpZW50IG1hZGUgdG9vIG1hbnkgcmVxdWVzdCB0byBjaGFsbGVuZ2UgcGFnZSIKZmlsdGVyOiAiZXZ0Lk1ldGEubG9nX3R5cGUgPT0gJ2FwcHNlYy1jaGFsbGVuZ2UnICYmIChldnQuTWV0YS5jaGFsbGVuZ2VfZXZlbnQgPT0gJ3JlcXVlc3RlZCcgfHwgZXZ0Lk1ldGEuY2hhbGxlbmdlX2V2ZW50ID09ICdzdWJtaXR0ZWQnKSIKY2FuY2VsX29uOiAiZXZ0Lk1ldGEubG9nX3R5cGUgPT0gJ2FwcHNlYy1jaGFsbGVuZ2UnICYmIGV2dC5NZXRhLmNoYWxsZW5nZV9ldmVudCA9PSAnc3VibWl0dGVkJyIKZHVyYXRpb246IDYwcwpjYXBhY2l0eTogLTEKY2FjaGVfc2l6ZTogMQpncm91cGJ5OiBldnQuTWV0YS5zb3VyY2VfaXAKYmxhY2tob2xlOiAxMHMKbGFiZWxzOgogIHNlcnZpY2U6IGh0dHAKICBjb25maWRlbmNlOiAwCiAgc3Bvb2ZhYmxlOiAwCiAgY2xhc3NpZmljYXRpb246CiAgICAtIGF0dGFjay5UMTExMAogIGxhYmVsOiAiQmxvY2tlZCBieSBDcm93ZFNlYyBBcHBTZWMiCiAgYmVoYXZpb3I6ICJodHRwOmV4cGxvaXQiCg==", + "content": "dHlwZTogbGVha3kKZm9ybWF0OiAzLjAKI2RlYnVnOiB0cnVlCm5hbWU6IGNyb3dkc2VjdXJpdHkvYXBwc2VjLWJvdC1jaGFsbGVuZ2UtdG9vLW1hbnktcmVxdWVzdHMKZGVzY3JpcHRpb246ICJDbGllbnQgbWFkZSB0b28gbWFueSByZXF1ZXN0IHRvIGNoYWxsZW5nZSBwYWdlIgpmaWx0ZXI6ICJldnQuTWV0YS5sb2dfdHlwZSA9PSAnYXBwc2VjLWNoYWxsZW5nZScgJiYgZXZ0Lk1ldGEuY2hhbGxlbmdlX2V2ZW50ID09ICdyZXF1ZXN0ZWQnIgpjYW5jZWxfb246ICJldnQuTWV0YS5sb2dfdHlwZSA9PSAnYXBwc2VjLWNoYWxsZW5nZScgJiYgZXZ0Lk1ldGEuY2hhbGxlbmdlX2V2ZW50ID09ICdzdWJtaXR0ZWQnIgpsZWFrc3BlZWQ6ICIyMHMiCmNhcGFjaXR5OiAxMApncm91cGJ5OiBldnQuTWV0YS5zb3VyY2VfaXAKYmxhY2tob2xlOiAxbQpsYWJlbHM6CiAgc2VydmljZTogaHR0cAogIGNvbmZpZGVuY2U6IDAKICBzcG9vZmFibGU6IDAKICBjbGFzc2lmaWNhdGlvbjoKICAgIC0gYXR0YWNrLlQxMTEwCiAgbGFiZWw6ICJCbG9ja2VkIGJ5IENyb3dkU2VjIEFwcFNlYyIKICBiZWhhdmlvcjogImh0dHA6ZXhwbG9pdCIKICByZW1lZGlhdGlvbjogdHJ1ZQo=", "description": "Client made too many request to challenge page", "labels": { "behavior": "http:exploit", @@ -19889,22 +19880,23 @@ ], "confidence": 0, "label": "Blocked by CrowdSec AppSec", + "remediation": true, "service": "http", "spoofable": 0 }, - "path": "scenarios/crowdsecurity/appsec-challenge-request-with-no-submission.yaml", + "path": "scenarios/crowdsecurity/appsec-bot-challenge-too-many-requests.yaml", "version": "0.1", "versions": { "0.1": { "deprecated": false, - "digest": "69653e163e67a8a145056f7fe7f965a9ee802bf819038cad62790e3e18e0f6bd" + "digest": "e6fb50970c3b54fa87862839b2a9a01190461730c918a860d34edfcd5b948225" } } }, - "crowdsecurity/appsec-challenge-too-many-requests": { + "crowdsecurity/appsec-bot-challenge-too-many-submissions": { "author": "crowdsecurity", - "content": "dHlwZTogbGVha3kKZm9ybWF0OiAzLjAKI2RlYnVnOiB0cnVlCm5hbWU6IGNyb3dkc2VjdXJpdHkvYXBwc2VjLWNoYWxsZW5nZS10b28tbWFueS1yZXF1ZXN0cwpkZXNjcmlwdGlvbjogIkNsaWVudCBtYWRlIHRvbyBtYW55IHJlcXVlc3QgdG8gY2hhbGxlbmdlIHBhZ2UiCmZpbHRlcjogImV2dC5NZXRhLmxvZ190eXBlID09ICdhcHBzZWMtY2hhbGxlbmdlJyAmJiBldnQuTWV0YS5jaGFsbGVuZ2VfZXZlbnQgPT0gJ3JlcXVlc3RlZCciCmxlYWtzcGVlZDogIjYwcyIKY2FwYWNpdHk6IDUKZ3JvdXBieTogZXZ0Lk1ldGEuc291cmNlX2lwCmJsYWNraG9sZTogMW0KbGFiZWxzOgogIHNlcnZpY2U6IGh0dHAKICBjb25maWRlbmNlOiAwCiAgc3Bvb2ZhYmxlOiAwCiAgY2xhc3NpZmljYXRpb246CiAgICAtIGF0dGFjay5UMTExMAogIGxhYmVsOiAiQmxvY2tlZCBieSBDcm93ZFNlYyBBcHBTZWMiCiAgYmVoYXZpb3I6ICJodHRwOmV4cGxvaXQiCiAgcmVtZWRpYXRpb246IHRydWUK", - "description": "Client made too many request to challenge page", + "content": "dHlwZTogbGVha3kKZm9ybWF0OiAzLjAKI2RlYnVnOiB0cnVlCm5hbWU6IGNyb3dkc2VjdXJpdHkvYXBwc2VjLWJvdC1jaGFsbGVuZ2UtdG9vLW1hbnktc3VibWlzc2lvbnMKZGVzY3JpcHRpb246ICJDbGllbnQgbWFkZSB0b28gbWFueSBzdWJtaXNzaW9ucyBmb3IgY2hhbGxlbmdlIgpmaWx0ZXI6ICJldnQuTWV0YS5sb2dfdHlwZSA9PSAnYXBwc2VjLWNoYWxsZW5nZScgJiYgZXZ0Lk1ldGEuY2hhbGxlbmdlX2V2ZW50ID09ICdzdWJtaXR0ZWQnIgpsZWFrc3BlZWQ6ICIyMHMiCmNhcGFjaXR5OiA1Cmdyb3VwYnk6IGV2dC5NZXRhLnNvdXJjZV9pcApibGFja2hvbGU6IDFtCmxhYmVsczoKICBzZXJ2aWNlOiBodHRwCiAgY29uZmlkZW5jZTogMAogIHNwb29mYWJsZTogMAogIGNsYXNzaWZpY2F0aW9uOgogICAgLSBhdHRhY2suVDExMTAKICBsYWJlbDogIkJsb2NrZWQgYnkgQ3Jvd2RTZWMgQXBwU2VjIgogIGJlaGF2aW9yOiAiaHR0cDpleHBsb2l0IgogIHJlbWVkaWF0aW9uOiB0cnVlCg==", + "description": "Client made too many submissions for challenge", "labels": { "behavior": "http:exploit", "classification": [ @@ -19916,36 +19908,36 @@ "service": "http", "spoofable": 0 }, - "path": "scenarios/crowdsecurity/appsec-challenge-too-many-requests.yaml", + "path": "scenarios/crowdsecurity/appsec-bot-challenge-too-many-submissions.yaml", "version": "0.1", "versions": { "0.1": { "deprecated": false, - "digest": "c3b1fc73a9a5a59c109d3866929053d373f3cfef297e05114a202e2417b51d43" + "digest": "5a8e13c7aa596388c65e04ac1ae9cc12a0129acdcaf62d8161f15a7cd424fdd9" } } }, - "crowdsecurity/appsec-challenge-too-many-submissions": { + "crowdsecurity/appsec-bot-detected": { "author": "crowdsecurity", - "content": "dHlwZTogbGVha3kKZm9ybWF0OiAzLjAKI2RlYnVnOiB0cnVlCm5hbWU6IGNyb3dkc2VjdXJpdHkvYXBwc2VjLWNoYWxsZW5nZS10b28tbWFueS1zdWJtaXNzaW9ucwpkZXNjcmlwdGlvbjogIkNsaWVudCBtYWRlIHRvbyBtYW55IHN1Ym1pc3Npb25zIGZvciBjaGFsbGVuZ2UiCmZpbHRlcjogImV2dC5NZXRhLmxvZ190eXBlID09ICdhcHBzZWMtY2hhbGxlbmdlJyAmJiBldnQuTWV0YS5jaGFsbGVuZ2VfZXZlbnQgPT0gJ3N1Ym1pdHRlZCciCmxlYWtzcGVlZDogIjYwcyIKY2FwYWNpdHk6IDUKZ3JvdXBieTogZXZ0Lk1ldGEuc291cmNlX2lwCmJsYWNraG9sZTogMW0KbGFiZWxzOgogIHNlcnZpY2U6IGh0dHAKICBjb25maWRlbmNlOiAwCiAgc3Bvb2ZhYmxlOiAwCiAgY2xhc3NpZmljYXRpb246CiAgICAtIGF0dGFjay5UMTExMAogIGxhYmVsOiAiQmxvY2tlZCBieSBDcm93ZFNlYyBBcHBTZWMiCiAgYmVoYXZpb3I6ICJodHRwOmV4cGxvaXQiCiAgcmVtZWRpYXRpb246IHRydWUK", - "description": "Client made too many submissions for challenge", + "content": "dHlwZTogdHJpZ2dlcgpmb3JtYXQ6IDMuMAojZGVidWc6IHRydWUKbmFtZTogY3Jvd2RzZWN1cml0eS9hcHBzZWMtYm90LWRldGVjdGVkCmRlc2NyaXB0aW9uOiAiQSBrbm93biBib3Qgd2FzIGRldGVjdGVkIGFuZCByZWplY3RlZCBieSB0aGUgQXBwU2VjIGNoYWxsZW5nZSAoZmFzdCBib3QgZGV0ZWN0aW9uKSIKZmlsdGVyOiAiZXZ0Lk1ldGEubG9nX3R5cGUgPT0gJ2FwcHNlYy1jaGFsbGVuZ2UnICYmIGV2dC5NZXRhLmNoYWxsZW5nZV9ldmVudCA9PSAncmVqZWN0ZWQnIgpncm91cGJ5OiBldnQuTWV0YS5zb3VyY2VfaXAKYmxhY2tob2xlOiAxbQpsYWJlbHM6CiAgc2VydmljZTogaHR0cAogIGNvbmZpZGVuY2U6IDEKICBzcG9vZmFibGU6IDAKICBjbGFzc2lmaWNhdGlvbjoKICAgIC0gYXR0YWNrLlQxMDcxCiAgbGFiZWw6ICJCb3QgZGV0ZWN0ZWQgYnkgQ3Jvd2RTZWMgQXBwU2VjIGNoYWxsZW5nZSIKICBiZWhhdmlvcjogImh0dHA6Ym90IgogIHJlbWVkaWF0aW9uOiBmYWxzZQo=", + "description": "A known bot was detected and rejected by the AppSec challenge (fast bot detection)", "labels": { - "behavior": "http:exploit", + "behavior": "http:bot", "classification": [ - "attack.T1110" + "attack.T1071" ], - "confidence": 0, - "label": "Blocked by CrowdSec AppSec", - "remediation": true, + "confidence": 1, + "label": "Bot detected by CrowdSec AppSec challenge", + "remediation": false, "service": "http", "spoofable": 0 }, - "path": "scenarios/crowdsecurity/appsec-challenge-too-many-submissions.yaml", + "path": "scenarios/crowdsecurity/appsec-bot-detected.yaml", "version": "0.1", "versions": { "0.1": { "deprecated": false, - "digest": "676043228fa24655c9d0d1bb340372edf0d3e5d9f4cc53a5dd0f58a525afcb4c" + "digest": "7a2061fa15c50f587158de5bd474b5a99e1f4a0b32e75ab5c112019e2d843461" } } }, From 545299ee15180fed9d9e2873875d7ad6fc5cc030 Mon Sep 17 00:00:00 2001 From: Thibault Koechlin Date: Wed, 1 Jul 2026 11:19:43 +0200 Subject: [PATCH 21/36] add more bots (search, ai, monitoring) + split into various appsec-rules --- ...c-bot-challenge-exclude-crawler-files.yaml | 2 +- .../appsec-bot-challenge-exclude-feeds.yaml | 4 +- .../appsec-bot-legit-ai-crawlers.yaml | 19 +++++++++ .../appsec-bot-legit-monitoring.yaml | 13 ++++++ .../appsec-bot-legit-search-engines.yaml | 40 +++++++++++++++++++ ...bots.yaml => appsec-bot-legit-social.yaml} | 24 +++++------ .../crowdsecurity/appsec-bot-challenge.md | 15 +++++-- .../crowdsecurity/appsec-bot-challenge.yaml | 5 ++- 8 files changed, 104 insertions(+), 18 deletions(-) create mode 100644 appsec-rules/crowdsecurity/appsec-bot-legit-ai-crawlers.yaml create mode 100644 appsec-rules/crowdsecurity/appsec-bot-legit-monitoring.yaml create mode 100644 appsec-rules/crowdsecurity/appsec-bot-legit-search-engines.yaml rename appsec-rules/crowdsecurity/{appsec-bot-legit-bots.yaml => appsec-bot-legit-social.yaml} (53%) diff --git a/appsec-configs/crowdsecurity/appsec-bot-challenge-exclude-crawler-files.yaml b/appsec-configs/crowdsecurity/appsec-bot-challenge-exclude-crawler-files.yaml index 0e72a9e1987..a39cbad74b3 100644 --- a/appsec-configs/crowdsecurity/appsec-bot-challenge-exclude-crawler-files.yaml +++ b/appsec-configs/crowdsecurity/appsec-bot-challenge-exclude-crawler-files.yaml @@ -3,7 +3,7 @@ name: crowdsecurity/appsec-bot-challenge-exclude-crawler-files inband: pre_eval: - filter: >- - req.URL.Path in ['/robots.txt', '/ads.txt', '/app-ads.txt', '/sitemap.xml'] || + req.URL.Path in ['/robots.txt', '/ads.txt', '/app-ads.txt', '/sitemap.xml', '/apple-app-site-association', '/security.txt', '/humans.txt'] || req.URL.Path startsWith '/.well-known/' apply: - ExemptFromChallenge() diff --git a/appsec-configs/crowdsecurity/appsec-bot-challenge-exclude-feeds.yaml b/appsec-configs/crowdsecurity/appsec-bot-challenge-exclude-feeds.yaml index 660f44d6712..2c1b83d3deb 100644 --- a/appsec-configs/crowdsecurity/appsec-bot-challenge-exclude-feeds.yaml +++ b/appsec-configs/crowdsecurity/appsec-bot-challenge-exclude-feeds.yaml @@ -2,8 +2,10 @@ name: crowdsecurity/appsec-bot-challenge-exclude-feeds # Let syndication feed endpoints fly through without a challenge. inband: pre_eval: + # Exact feed filenames are safe to exempt; the pre-existing '/feed/' and '/rss/' prefixes are kept + # but not broadened — a prefix exemption would turn a whole namespace into challenge-free surface. - filter: >- - req.URL.Path in ['/feed', '/rss', '/atom.xml'] || + req.URL.Path in ['/feed', '/rss', '/atom.xml', '/feed.xml', '/rss.xml', '/index.xml', '/feed.atom'] || req.URL.Path startsWith '/feed/' || req.URL.Path startsWith '/rss/' apply: - ExemptFromChallenge() diff --git a/appsec-rules/crowdsecurity/appsec-bot-legit-ai-crawlers.yaml b/appsec-rules/crowdsecurity/appsec-bot-legit-ai-crawlers.yaml new file mode 100644 index 00000000000..db08ccd9949 --- /dev/null +++ b/appsec-rules/crowdsecurity/appsec-bot-legit-ai-crawlers.yaml @@ -0,0 +1,19 @@ +name: crowdsecurity/appsec-bot-legit-ai-crawlers + +# Declares the legitimate AI-crawler datafiles so crowdsec downloads them into +# /legit_bots/. They are consumed by the engine's IsLegitimateBot() helper +# (see crowdsecurity/appsec-bot-challenge-simple), not by seclang rules. + +data: + - source_url: https://hub-data.crowdsec.net/whitelists/benign_bots/legit_bots/gptbot.json + dest_file: legit_bots/gptbot.json + type: bots + - source_url: https://hub-data.crowdsec.net/whitelists/benign_bots/legit_bots/openai-searchbot.json + dest_file: legit_bots/openai-searchbot.json + type: bots + - source_url: https://hub-data.crowdsec.net/whitelists/benign_bots/legit_bots/openai-chatgpt-user.json + dest_file: legit_bots/openai-chatgpt-user.json + type: bots + - source_url: https://hub-data.crowdsec.net/whitelists/benign_bots/legit_bots/perplexitybot.json + dest_file: legit_bots/perplexitybot.json + type: bots diff --git a/appsec-rules/crowdsecurity/appsec-bot-legit-monitoring.yaml b/appsec-rules/crowdsecurity/appsec-bot-legit-monitoring.yaml new file mode 100644 index 00000000000..583a0237aad --- /dev/null +++ b/appsec-rules/crowdsecurity/appsec-bot-legit-monitoring.yaml @@ -0,0 +1,13 @@ +name: crowdsecurity/appsec-bot-legit-monitoring + +# Declares the legitimate uptime/monitoring datafiles so crowdsec downloads them into +# /legit_bots/. They are consumed by the engine's IsLegitimateBot() helper +# (see crowdsecurity/appsec-bot-challenge-simple), not by seclang rules. + +data: + - source_url: https://hub-data.crowdsec.net/whitelists/benign_bots/legit_bots/uptimerobot.json + dest_file: legit_bots/uptimerobot.json + type: bots + - source_url: https://hub-data.crowdsec.net/whitelists/benign_bots/legit_bots/cookiebot.json + dest_file: legit_bots/cookiebot.json + type: bots diff --git a/appsec-rules/crowdsecurity/appsec-bot-legit-search-engines.yaml b/appsec-rules/crowdsecurity/appsec-bot-legit-search-engines.yaml new file mode 100644 index 00000000000..41cb577a3de --- /dev/null +++ b/appsec-rules/crowdsecurity/appsec-bot-legit-search-engines.yaml @@ -0,0 +1,40 @@ +name: crowdsecurity/appsec-bot-legit-search-engines + +# Declares the legitimate search-engine datafiles so crowdsec downloads them into +# /legit_bots/. They are consumed by the engine's IsLegitimateBot() helper +# (see crowdsecurity/appsec-bot-challenge-simple), not by seclang rules. + +data: + - source_url: https://hub-data.crowdsec.net/whitelists/benign_bots/legit_bots/googlebot.json + dest_file: legit_bots/googlebot.json + type: bots + - source_url: https://hub-data.crowdsec.net/whitelists/benign_bots/legit_bots/bingbot.json + dest_file: legit_bots/bingbot.json + type: bots + - source_url: https://hub-data.crowdsec.net/whitelists/benign_bots/legit_bots/applebot.json + dest_file: legit_bots/applebot.json + type: bots + - source_url: https://hub-data.crowdsec.net/whitelists/benign_bots/legit_bots/amazonbot.json + dest_file: legit_bots/amazonbot.json + type: bots + - source_url: https://hub-data.crowdsec.net/whitelists/benign_bots/legit_bots/yandex.json + dest_file: legit_bots/yandex.json + type: bots + - source_url: https://hub-data.crowdsec.net/whitelists/benign_bots/legit_bots/baidu.json + dest_file: legit_bots/baidu.json + type: bots + - source_url: https://hub-data.crowdsec.net/whitelists/benign_bots/legit_bots/yahoo.json + dest_file: legit_bots/yahoo.json + type: bots + - source_url: https://hub-data.crowdsec.net/whitelists/benign_bots/legit_bots/sogou.json + dest_file: legit_bots/sogou.json + type: bots + - source_url: https://hub-data.crowdsec.net/whitelists/benign_bots/legit_bots/qwant.json + dest_file: legit_bots/qwant.json + type: bots + - source_url: https://hub-data.crowdsec.net/whitelists/benign_bots/legit_bots/babbar.json + dest_file: legit_bots/babbar.json + type: bots + - source_url: https://hub-data.crowdsec.net/whitelists/benign_bots/legit_bots/duckduckbot.json + dest_file: legit_bots/duckduckbot.json + type: bots diff --git a/appsec-rules/crowdsecurity/appsec-bot-legit-bots.yaml b/appsec-rules/crowdsecurity/appsec-bot-legit-social.yaml similarity index 53% rename from appsec-rules/crowdsecurity/appsec-bot-legit-bots.yaml rename to appsec-rules/crowdsecurity/appsec-bot-legit-social.yaml index e681e2fe6c3..120c5812f10 100644 --- a/appsec-rules/crowdsecurity/appsec-bot-legit-bots.yaml +++ b/appsec-rules/crowdsecurity/appsec-bot-legit-social.yaml @@ -1,22 +1,22 @@ -name: crowdsecurity/appsec-bot-legit-bots +name: crowdsecurity/appsec-bot-legit-social -# This appsec-rule only declares the legitimate-bot datafiles so crowdsec downloads them +# Declares the legitimate social / link-preview unfurler datafiles so crowdsec downloads them # into /legit_bots/. They are consumed by the engine's IsLegitimateBot() helper # (see crowdsecurity/appsec-bot-challenge-simple), not by seclang rules. data: - - source_url: https://hub-data.crowdsec.net/whitelists/benign_bots/legit_bots/googlebot.json - dest_file: legit_bots/googlebot.json + - source_url: https://hub-data.crowdsec.net/whitelists/benign_bots/legit_bots/meta.json + dest_file: legit_bots/meta.json type: bots - - source_url: https://hub-data.crowdsec.net/whitelists/benign_bots/legit_bots/bingbot.json - dest_file: legit_bots/bingbot.json + - source_url: https://hub-data.crowdsec.net/whitelists/benign_bots/legit_bots/discord.json + dest_file: legit_bots/discord.json type: bots - - source_url: https://hub-data.crowdsec.net/whitelists/benign_bots/legit_bots/applebot.json - dest_file: legit_bots/applebot.json + - source_url: https://hub-data.crowdsec.net/whitelists/benign_bots/legit_bots/telegram.json + dest_file: legit_bots/telegram.json type: bots - - source_url: https://hub-data.crowdsec.net/whitelists/benign_bots/legit_bots/amazonbot.json - dest_file: legit_bots/amazonbot.json + - source_url: https://hub-data.crowdsec.net/whitelists/benign_bots/legit_bots/twitterbot.json + dest_file: legit_bots/twitterbot.json type: bots - - source_url: https://hub-data.crowdsec.net/whitelists/benign_bots/legit_bots/gptbot.json - dest_file: legit_bots/gptbot.json + - source_url: https://hub-data.crowdsec.net/whitelists/benign_bots/legit_bots/pinterest.json + dest_file: legit_bots/pinterest.json type: bots diff --git a/collections/crowdsecurity/appsec-bot-challenge.md b/collections/crowdsecurity/appsec-bot-challenge.md index 47f210ed198..710d4aaa7ae 100644 --- a/collections/crowdsecurity/appsec-bot-challenge.md +++ b/collections/crowdsecurity/appsec-bot-challenge.md @@ -9,9 +9,18 @@ What it ships: - `crowdsecurity/appsec-bot-challenge-simple`: challenges incoming requests, skips verified good bots (forward-confirmed rDNS), and rejects challenge submissions whose fingerprint trips the fast bot detection. - - `crowdsecurity/appsec-bot-legit-bots`: ships the verified-good-bot datafiles (googlebot, bingbot, - applebot, amazonbot, gptbot) that back the forward-confirmed rDNS exclusion above, so legitimate - crawlers skip the challenge. + - Verified-good-bot datafiles that back the exclusion above, split by family so you can enable only the + ones you need: + - `crowdsecurity/appsec-bot-legit-search-engines`: googlebot, bingbot, applebot, amazonbot, yandex, + baidu, yahoo, sogou, qwant, babbar, duckduckbot + - `crowdsecurity/appsec-bot-legit-ai-crawlers`: gptbot, openai-searchbot, openai-chatgpt-user, + perplexitybot + - `crowdsecurity/appsec-bot-legit-social`: meta, discord, telegram, twitterbot, pinterest + - `crowdsecurity/appsec-bot-legit-monitoring`: uptimerobot, cookiebot + + A bot is exempted **only** when it can be network-verified — forward-confirmed rDNS or a published IP + range. User-Agent-only bots (e.g. CommonCrawl/CCBot) are intentionally left challenged, since a + spoofed User-Agent must not bypass the challenge. - Well-known-path exclusion configs (`appsec-bot-challenge-exclude-crawler-files`, `-feeds`, `-webhooks`) that let machine-facing endpoints (`/robots.txt`, `/.well-known/*`, feeds, webhooks) through without a challenge. The exclusion is strictly per-request and is never persisted to a cookie or across diff --git a/collections/crowdsecurity/appsec-bot-challenge.yaml b/collections/crowdsecurity/appsec-bot-challenge.yaml index f2a7a26d187..2ce3a53876a 100644 --- a/collections/crowdsecurity/appsec-bot-challenge.yaml +++ b/collections/crowdsecurity/appsec-bot-challenge.yaml @@ -8,7 +8,10 @@ appsec-configs: - crowdsecurity/appsec-bot-challenge-exclude-feeds - crowdsecurity/appsec-bot-challenge-exclude-webhooks appsec-rules: - - crowdsecurity/appsec-bot-legit-bots + - crowdsecurity/appsec-bot-legit-search-engines + - crowdsecurity/appsec-bot-legit-ai-crawlers + - crowdsecurity/appsec-bot-legit-social + - crowdsecurity/appsec-bot-legit-monitoring scenarios: - crowdsecurity/appsec-bot-detected - crowdsecurity/appsec-bot-challenge-too-many-requests From 503a268e8065e99a2029744a8b941cdabb4d23c5 Mon Sep 17 00:00:00 2001 From: GitHub Action Date: Wed, 1 Jul 2026 09:26:26 +0000 Subject: [PATCH 22/36] Update index --- .index.json | 78 ++++++++++++++++++++++++++++++++++++++++++++--------- 1 file changed, 66 insertions(+), 12 deletions(-) diff --git a/.index.json b/.index.json index f278d1c2dcc..f44cfae97c1 100644 --- a/.index.json +++ b/.index.json @@ -2,27 +2,35 @@ "appsec-configs": { "crowdsecurity/appsec-bot-challenge-exclude-crawler-files": { "author": "crowdsecurity", - "content": "bmFtZTogY3Jvd2RzZWN1cml0eS9hcHBzZWMtYm90LWNoYWxsZW5nZS1leGNsdWRlLWNyYXdsZXItZmlsZXMKIyBMZXQgd2VsbC1rbm93biBjcmF3bGVyIGZpbGVzIGZseSB0aHJvdWdoIHdpdGhvdXQgYSBjaGFsbGVuZ2UuCmluYmFuZDoKICBwcmVfZXZhbDoKICAgIC0gZmlsdGVyOiA+LQogICAgICAgIHJlcS5VUkwuUGF0aCBpbiBbJy9yb2JvdHMudHh0JywgJy9hZHMudHh0JywgJy9hcHAtYWRzLnR4dCcsICcvc2l0ZW1hcC54bWwnXSB8fAogICAgICAgIHJlcS5VUkwuUGF0aCBzdGFydHNXaXRoICcvLndlbGwta25vd24vJwogICAgICBhcHBseToKICAgICAgICAtIEV4ZW1wdEZyb21DaGFsbGVuZ2UoKQo=", + "content": "bmFtZTogY3Jvd2RzZWN1cml0eS9hcHBzZWMtYm90LWNoYWxsZW5nZS1leGNsdWRlLWNyYXdsZXItZmlsZXMKIyBMZXQgd2VsbC1rbm93biBjcmF3bGVyIGZpbGVzIGZseSB0aHJvdWdoIHdpdGhvdXQgYSBjaGFsbGVuZ2UuCmluYmFuZDoKICBwcmVfZXZhbDoKICAgIC0gZmlsdGVyOiA+LQogICAgICAgIHJlcS5VUkwuUGF0aCBpbiBbJy9yb2JvdHMudHh0JywgJy9hZHMudHh0JywgJy9hcHAtYWRzLnR4dCcsICcvc2l0ZW1hcC54bWwnLCAnL2FwcGxlLWFwcC1zaXRlLWFzc29jaWF0aW9uJywgJy9zZWN1cml0eS50eHQnLCAnL2h1bWFucy50eHQnXSB8fAogICAgICAgIHJlcS5VUkwuUGF0aCBzdGFydHNXaXRoICcvLndlbGwta25vd24vJwogICAgICBhcHBseToKICAgICAgICAtIEV4ZW1wdEZyb21DaGFsbGVuZ2UoKQo=", "labels": null, "path": "appsec-configs/crowdsecurity/appsec-bot-challenge-exclude-crawler-files.yaml", - "version": "0.1", + "version": "0.2", "versions": { "0.1": { "deprecated": false, "digest": "2d8dd3c683f82b3437b6ec718287409a3cd165d3dfc37e3a6fc486931bdf1897" + }, + "0.2": { + "deprecated": false, + "digest": "55d2690765beb9e9c805dce648dc2e1ba5d9e13e0cb44541877d16cce092f836" } } }, "crowdsecurity/appsec-bot-challenge-exclude-feeds": { "author": "crowdsecurity", - "content": "bmFtZTogY3Jvd2RzZWN1cml0eS9hcHBzZWMtYm90LWNoYWxsZW5nZS1leGNsdWRlLWZlZWRzCiMgTGV0IHN5bmRpY2F0aW9uIGZlZWQgZW5kcG9pbnRzIGZseSB0aHJvdWdoIHdpdGhvdXQgYSBjaGFsbGVuZ2UuCmluYmFuZDoKICBwcmVfZXZhbDoKICAgIC0gZmlsdGVyOiA+LQogICAgICAgIHJlcS5VUkwuUGF0aCBpbiBbJy9mZWVkJywgJy9yc3MnLCAnL2F0b20ueG1sJ10gfHwKICAgICAgICByZXEuVVJMLlBhdGggc3RhcnRzV2l0aCAnL2ZlZWQvJyB8fCByZXEuVVJMLlBhdGggc3RhcnRzV2l0aCAnL3Jzcy8nCiAgICAgIGFwcGx5OgogICAgICAgIC0gRXhlbXB0RnJvbUNoYWxsZW5nZSgpCg==", + "content": "bmFtZTogY3Jvd2RzZWN1cml0eS9hcHBzZWMtYm90LWNoYWxsZW5nZS1leGNsdWRlLWZlZWRzCiMgTGV0IHN5bmRpY2F0aW9uIGZlZWQgZW5kcG9pbnRzIGZseSB0aHJvdWdoIHdpdGhvdXQgYSBjaGFsbGVuZ2UuCmluYmFuZDoKICBwcmVfZXZhbDoKICAgICMgRXhhY3QgZmVlZCBmaWxlbmFtZXMgYXJlIHNhZmUgdG8gZXhlbXB0OyB0aGUgcHJlLWV4aXN0aW5nICcvZmVlZC8nIGFuZCAnL3Jzcy8nIHByZWZpeGVzIGFyZSBrZXB0CiAgICAjIGJ1dCBub3QgYnJvYWRlbmVkIOKAlCBhIHByZWZpeCBleGVtcHRpb24gd291bGQgdHVybiBhIHdob2xlIG5hbWVzcGFjZSBpbnRvIGNoYWxsZW5nZS1mcmVlIHN1cmZhY2UuCiAgICAtIGZpbHRlcjogPi0KICAgICAgICByZXEuVVJMLlBhdGggaW4gWycvZmVlZCcsICcvcnNzJywgJy9hdG9tLnhtbCcsICcvZmVlZC54bWwnLCAnL3Jzcy54bWwnLCAnL2luZGV4LnhtbCcsICcvZmVlZC5hdG9tJ10gfHwKICAgICAgICByZXEuVVJMLlBhdGggc3RhcnRzV2l0aCAnL2ZlZWQvJyB8fCByZXEuVVJMLlBhdGggc3RhcnRzV2l0aCAnL3Jzcy8nCiAgICAgIGFwcGx5OgogICAgICAgIC0gRXhlbXB0RnJvbUNoYWxsZW5nZSgpCg==", "labels": null, "path": "appsec-configs/crowdsecurity/appsec-bot-challenge-exclude-feeds.yaml", - "version": "0.1", + "version": "0.2", "versions": { "0.1": { "deprecated": false, "digest": "cf80e755440ec3d017a5f6565bc95902a0d413c03727c6e62aa7870ba8df5be1" + }, + "0.2": { + "deprecated": false, + "digest": "f00fb52eefbc55a6468c0f016efcbd742139ddcdfeb93d7c7ab737fceb22f8b5" } } }, @@ -171,16 +179,55 @@ } }, "appsec-rules": { - "crowdsecurity/appsec-bot-legit-bots": { + "crowdsecurity/appsec-bot-legit-ai-crawlers": { + "author": "crowdsecurity", + "content": "bmFtZTogY3Jvd2RzZWN1cml0eS9hcHBzZWMtYm90LWxlZ2l0LWFpLWNyYXdsZXJzCgojIERlY2xhcmVzIHRoZSBsZWdpdGltYXRlIEFJLWNyYXdsZXIgZGF0YWZpbGVzIHNvIGNyb3dkc2VjIGRvd25sb2FkcyB0aGVtIGludG8KIyA8ZGF0YWRpcj4vbGVnaXRfYm90cy8uIFRoZXkgYXJlIGNvbnN1bWVkIGJ5IHRoZSBlbmdpbmUncyBJc0xlZ2l0aW1hdGVCb3QoKSBoZWxwZXIKIyAoc2VlIGNyb3dkc2VjdXJpdHkvYXBwc2VjLWJvdC1jaGFsbGVuZ2Utc2ltcGxlKSwgbm90IGJ5IHNlY2xhbmcgcnVsZXMuCgpkYXRhOgogIC0gc291cmNlX3VybDogaHR0cHM6Ly9odWItZGF0YS5jcm93ZHNlYy5uZXQvd2hpdGVsaXN0cy9iZW5pZ25fYm90cy9sZWdpdF9ib3RzL2dwdGJvdC5qc29uCiAgICBkZXN0X2ZpbGU6IGxlZ2l0X2JvdHMvZ3B0Ym90Lmpzb24KICAgIHR5cGU6IGJvdHMKICAtIHNvdXJjZV91cmw6IGh0dHBzOi8vaHViLWRhdGEuY3Jvd2RzZWMubmV0L3doaXRlbGlzdHMvYmVuaWduX2JvdHMvbGVnaXRfYm90cy9vcGVuYWktc2VhcmNoYm90Lmpzb24KICAgIGRlc3RfZmlsZTogbGVnaXRfYm90cy9vcGVuYWktc2VhcmNoYm90Lmpzb24KICAgIHR5cGU6IGJvdHMKICAtIHNvdXJjZV91cmw6IGh0dHBzOi8vaHViLWRhdGEuY3Jvd2RzZWMubmV0L3doaXRlbGlzdHMvYmVuaWduX2JvdHMvbGVnaXRfYm90cy9vcGVuYWktY2hhdGdwdC11c2VyLmpzb24KICAgIGRlc3RfZmlsZTogbGVnaXRfYm90cy9vcGVuYWktY2hhdGdwdC11c2VyLmpzb24KICAgIHR5cGU6IGJvdHMKICAtIHNvdXJjZV91cmw6IGh0dHBzOi8vaHViLWRhdGEuY3Jvd2RzZWMubmV0L3doaXRlbGlzdHMvYmVuaWduX2JvdHMvbGVnaXRfYm90cy9wZXJwbGV4aXR5Ym90Lmpzb24KICAgIGRlc3RfZmlsZTogbGVnaXRfYm90cy9wZXJwbGV4aXR5Ym90Lmpzb24KICAgIHR5cGU6IGJvdHMK", + "labels": null, + "path": "appsec-rules/crowdsecurity/appsec-bot-legit-ai-crawlers.yaml", + "version": "0.1", + "versions": { + "0.1": { + "deprecated": false, + "digest": "dee256dafa5c404651a5ae8e4b92931e145bca67ae6c6f2d991d371f96183c18" + } + } + }, + "crowdsecurity/appsec-bot-legit-monitoring": { + "author": "crowdsecurity", + "content": "bmFtZTogY3Jvd2RzZWN1cml0eS9hcHBzZWMtYm90LWxlZ2l0LW1vbml0b3JpbmcKCiMgRGVjbGFyZXMgdGhlIGxlZ2l0aW1hdGUgdXB0aW1lL21vbml0b3JpbmcgZGF0YWZpbGVzIHNvIGNyb3dkc2VjIGRvd25sb2FkcyB0aGVtIGludG8KIyA8ZGF0YWRpcj4vbGVnaXRfYm90cy8uIFRoZXkgYXJlIGNvbnN1bWVkIGJ5IHRoZSBlbmdpbmUncyBJc0xlZ2l0aW1hdGVCb3QoKSBoZWxwZXIKIyAoc2VlIGNyb3dkc2VjdXJpdHkvYXBwc2VjLWJvdC1jaGFsbGVuZ2Utc2ltcGxlKSwgbm90IGJ5IHNlY2xhbmcgcnVsZXMuCgpkYXRhOgogIC0gc291cmNlX3VybDogaHR0cHM6Ly9odWItZGF0YS5jcm93ZHNlYy5uZXQvd2hpdGVsaXN0cy9iZW5pZ25fYm90cy9sZWdpdF9ib3RzL3VwdGltZXJvYm90Lmpzb24KICAgIGRlc3RfZmlsZTogbGVnaXRfYm90cy91cHRpbWVyb2JvdC5qc29uCiAgICB0eXBlOiBib3RzCiAgLSBzb3VyY2VfdXJsOiBodHRwczovL2h1Yi1kYXRhLmNyb3dkc2VjLm5ldC93aGl0ZWxpc3RzL2Jlbmlnbl9ib3RzL2xlZ2l0X2JvdHMvY29va2llYm90Lmpzb24KICAgIGRlc3RfZmlsZTogbGVnaXRfYm90cy9jb29raWVib3QuanNvbgogICAgdHlwZTogYm90cwo=", + "labels": null, + "path": "appsec-rules/crowdsecurity/appsec-bot-legit-monitoring.yaml", + "version": "0.1", + "versions": { + "0.1": { + "deprecated": false, + "digest": "e08498be5b24f43ee79dba7bfa3810cc7424737ac0d4930470a34a53754f4b9b" + } + } + }, + "crowdsecurity/appsec-bot-legit-search-engines": { "author": "crowdsecurity", - "content": "bmFtZTogY3Jvd2RzZWN1cml0eS9hcHBzZWMtYm90LWxlZ2l0LWJvdHMKCiMgVGhpcyBhcHBzZWMtcnVsZSBvbmx5IGRlY2xhcmVzIHRoZSBsZWdpdGltYXRlLWJvdCBkYXRhZmlsZXMgc28gY3Jvd2RzZWMgZG93bmxvYWRzIHRoZW0KIyBpbnRvIDxkYXRhZGlyPi9sZWdpdF9ib3RzLy4gVGhleSBhcmUgY29uc3VtZWQgYnkgdGhlIGVuZ2luZSdzIElzTGVnaXRpbWF0ZUJvdCgpIGhlbHBlcgojIChzZWUgY3Jvd2RzZWN1cml0eS9hcHBzZWMtYm90LWNoYWxsZW5nZS1zaW1wbGUpLCBub3QgYnkgc2VjbGFuZyBydWxlcy4KCmRhdGE6CiAgLSBzb3VyY2VfdXJsOiBodHRwczovL2h1Yi1kYXRhLmNyb3dkc2VjLm5ldC93aGl0ZWxpc3RzL2Jlbmlnbl9ib3RzL2xlZ2l0X2JvdHMvZ29vZ2xlYm90Lmpzb24KICAgIGRlc3RfZmlsZTogbGVnaXRfYm90cy9nb29nbGVib3QuanNvbgogICAgdHlwZTogYm90cwogIC0gc291cmNlX3VybDogaHR0cHM6Ly9odWItZGF0YS5jcm93ZHNlYy5uZXQvd2hpdGVsaXN0cy9iZW5pZ25fYm90cy9sZWdpdF9ib3RzL2Jpbmdib3QuanNvbgogICAgZGVzdF9maWxlOiBsZWdpdF9ib3RzL2Jpbmdib3QuanNvbgogICAgdHlwZTogYm90cwogIC0gc291cmNlX3VybDogaHR0cHM6Ly9odWItZGF0YS5jcm93ZHNlYy5uZXQvd2hpdGVsaXN0cy9iZW5pZ25fYm90cy9sZWdpdF9ib3RzL2FwcGxlYm90Lmpzb24KICAgIGRlc3RfZmlsZTogbGVnaXRfYm90cy9hcHBsZWJvdC5qc29uCiAgICB0eXBlOiBib3RzCiAgLSBzb3VyY2VfdXJsOiBodHRwczovL2h1Yi1kYXRhLmNyb3dkc2VjLm5ldC93aGl0ZWxpc3RzL2Jlbmlnbl9ib3RzL2xlZ2l0X2JvdHMvYW1hem9uYm90Lmpzb24KICAgIGRlc3RfZmlsZTogbGVnaXRfYm90cy9hbWF6b25ib3QuanNvbgogICAgdHlwZTogYm90cwogIC0gc291cmNlX3VybDogaHR0cHM6Ly9odWItZGF0YS5jcm93ZHNlYy5uZXQvd2hpdGVsaXN0cy9iZW5pZ25fYm90cy9sZWdpdF9ib3RzL2dwdGJvdC5qc29uCiAgICBkZXN0X2ZpbGU6IGxlZ2l0X2JvdHMvZ3B0Ym90Lmpzb24KICAgIHR5cGU6IGJvdHMK", + "content": "bmFtZTogY3Jvd2RzZWN1cml0eS9hcHBzZWMtYm90LWxlZ2l0LXNlYXJjaC1lbmdpbmVzCgojIERlY2xhcmVzIHRoZSBsZWdpdGltYXRlIHNlYXJjaC1lbmdpbmUgZGF0YWZpbGVzIHNvIGNyb3dkc2VjIGRvd25sb2FkcyB0aGVtIGludG8KIyA8ZGF0YWRpcj4vbGVnaXRfYm90cy8uIFRoZXkgYXJlIGNvbnN1bWVkIGJ5IHRoZSBlbmdpbmUncyBJc0xlZ2l0aW1hdGVCb3QoKSBoZWxwZXIKIyAoc2VlIGNyb3dkc2VjdXJpdHkvYXBwc2VjLWJvdC1jaGFsbGVuZ2Utc2ltcGxlKSwgbm90IGJ5IHNlY2xhbmcgcnVsZXMuCgpkYXRhOgogIC0gc291cmNlX3VybDogaHR0cHM6Ly9odWItZGF0YS5jcm93ZHNlYy5uZXQvd2hpdGVsaXN0cy9iZW5pZ25fYm90cy9sZWdpdF9ib3RzL2dvb2dsZWJvdC5qc29uCiAgICBkZXN0X2ZpbGU6IGxlZ2l0X2JvdHMvZ29vZ2xlYm90Lmpzb24KICAgIHR5cGU6IGJvdHMKICAtIHNvdXJjZV91cmw6IGh0dHBzOi8vaHViLWRhdGEuY3Jvd2RzZWMubmV0L3doaXRlbGlzdHMvYmVuaWduX2JvdHMvbGVnaXRfYm90cy9iaW5nYm90Lmpzb24KICAgIGRlc3RfZmlsZTogbGVnaXRfYm90cy9iaW5nYm90Lmpzb24KICAgIHR5cGU6IGJvdHMKICAtIHNvdXJjZV91cmw6IGh0dHBzOi8vaHViLWRhdGEuY3Jvd2RzZWMubmV0L3doaXRlbGlzdHMvYmVuaWduX2JvdHMvbGVnaXRfYm90cy9hcHBsZWJvdC5qc29uCiAgICBkZXN0X2ZpbGU6IGxlZ2l0X2JvdHMvYXBwbGVib3QuanNvbgogICAgdHlwZTogYm90cwogIC0gc291cmNlX3VybDogaHR0cHM6Ly9odWItZGF0YS5jcm93ZHNlYy5uZXQvd2hpdGVsaXN0cy9iZW5pZ25fYm90cy9sZWdpdF9ib3RzL2FtYXpvbmJvdC5qc29uCiAgICBkZXN0X2ZpbGU6IGxlZ2l0X2JvdHMvYW1hem9uYm90Lmpzb24KICAgIHR5cGU6IGJvdHMKICAtIHNvdXJjZV91cmw6IGh0dHBzOi8vaHViLWRhdGEuY3Jvd2RzZWMubmV0L3doaXRlbGlzdHMvYmVuaWduX2JvdHMvbGVnaXRfYm90cy95YW5kZXguanNvbgogICAgZGVzdF9maWxlOiBsZWdpdF9ib3RzL3lhbmRleC5qc29uCiAgICB0eXBlOiBib3RzCiAgLSBzb3VyY2VfdXJsOiBodHRwczovL2h1Yi1kYXRhLmNyb3dkc2VjLm5ldC93aGl0ZWxpc3RzL2Jlbmlnbl9ib3RzL2xlZ2l0X2JvdHMvYmFpZHUuanNvbgogICAgZGVzdF9maWxlOiBsZWdpdF9ib3RzL2JhaWR1Lmpzb24KICAgIHR5cGU6IGJvdHMKICAtIHNvdXJjZV91cmw6IGh0dHBzOi8vaHViLWRhdGEuY3Jvd2RzZWMubmV0L3doaXRlbGlzdHMvYmVuaWduX2JvdHMvbGVnaXRfYm90cy95YWhvby5qc29uCiAgICBkZXN0X2ZpbGU6IGxlZ2l0X2JvdHMveWFob28uanNvbgogICAgdHlwZTogYm90cwogIC0gc291cmNlX3VybDogaHR0cHM6Ly9odWItZGF0YS5jcm93ZHNlYy5uZXQvd2hpdGVsaXN0cy9iZW5pZ25fYm90cy9sZWdpdF9ib3RzL3NvZ291Lmpzb24KICAgIGRlc3RfZmlsZTogbGVnaXRfYm90cy9zb2dvdS5qc29uCiAgICB0eXBlOiBib3RzCiAgLSBzb3VyY2VfdXJsOiBodHRwczovL2h1Yi1kYXRhLmNyb3dkc2VjLm5ldC93aGl0ZWxpc3RzL2Jlbmlnbl9ib3RzL2xlZ2l0X2JvdHMvcXdhbnQuanNvbgogICAgZGVzdF9maWxlOiBsZWdpdF9ib3RzL3F3YW50Lmpzb24KICAgIHR5cGU6IGJvdHMKICAtIHNvdXJjZV91cmw6IGh0dHBzOi8vaHViLWRhdGEuY3Jvd2RzZWMubmV0L3doaXRlbGlzdHMvYmVuaWduX2JvdHMvbGVnaXRfYm90cy9iYWJiYXIuanNvbgogICAgZGVzdF9maWxlOiBsZWdpdF9ib3RzL2JhYmJhci5qc29uCiAgICB0eXBlOiBib3RzCiAgLSBzb3VyY2VfdXJsOiBodHRwczovL2h1Yi1kYXRhLmNyb3dkc2VjLm5ldC93aGl0ZWxpc3RzL2Jlbmlnbl9ib3RzL2xlZ2l0X2JvdHMvZHVja2R1Y2tib3QuanNvbgogICAgZGVzdF9maWxlOiBsZWdpdF9ib3RzL2R1Y2tkdWNrYm90Lmpzb24KICAgIHR5cGU6IGJvdHMK", "labels": null, - "path": "appsec-rules/crowdsecurity/appsec-bot-legit-bots.yaml", + "path": "appsec-rules/crowdsecurity/appsec-bot-legit-search-engines.yaml", "version": "0.1", "versions": { "0.1": { "deprecated": false, - "digest": "d14aaf40e01d877ff1b70336a3cc4e0ca0716bc3b62a4d1750ff8f7459661b90" + "digest": "fff7199c8e8a1e86460baf7e9cb251d1906b18103d41eaa7440ea476d9d5c0ed" + } + } + }, + "crowdsecurity/appsec-bot-legit-social": { + "author": "crowdsecurity", + "content": "bmFtZTogY3Jvd2RzZWN1cml0eS9hcHBzZWMtYm90LWxlZ2l0LXNvY2lhbAoKIyBEZWNsYXJlcyB0aGUgbGVnaXRpbWF0ZSBzb2NpYWwgLyBsaW5rLXByZXZpZXcgdW5mdXJsZXIgZGF0YWZpbGVzIHNvIGNyb3dkc2VjIGRvd25sb2FkcyB0aGVtCiMgaW50byA8ZGF0YWRpcj4vbGVnaXRfYm90cy8uIFRoZXkgYXJlIGNvbnN1bWVkIGJ5IHRoZSBlbmdpbmUncyBJc0xlZ2l0aW1hdGVCb3QoKSBoZWxwZXIKIyAoc2VlIGNyb3dkc2VjdXJpdHkvYXBwc2VjLWJvdC1jaGFsbGVuZ2Utc2ltcGxlKSwgbm90IGJ5IHNlY2xhbmcgcnVsZXMuCgpkYXRhOgogIC0gc291cmNlX3VybDogaHR0cHM6Ly9odWItZGF0YS5jcm93ZHNlYy5uZXQvd2hpdGVsaXN0cy9iZW5pZ25fYm90cy9sZWdpdF9ib3RzL21ldGEuanNvbgogICAgZGVzdF9maWxlOiBsZWdpdF9ib3RzL21ldGEuanNvbgogICAgdHlwZTogYm90cwogIC0gc291cmNlX3VybDogaHR0cHM6Ly9odWItZGF0YS5jcm93ZHNlYy5uZXQvd2hpdGVsaXN0cy9iZW5pZ25fYm90cy9sZWdpdF9ib3RzL2Rpc2NvcmQuanNvbgogICAgZGVzdF9maWxlOiBsZWdpdF9ib3RzL2Rpc2NvcmQuanNvbgogICAgdHlwZTogYm90cwogIC0gc291cmNlX3VybDogaHR0cHM6Ly9odWItZGF0YS5jcm93ZHNlYy5uZXQvd2hpdGVsaXN0cy9iZW5pZ25fYm90cy9sZWdpdF9ib3RzL3RlbGVncmFtLmpzb24KICAgIGRlc3RfZmlsZTogbGVnaXRfYm90cy90ZWxlZ3JhbS5qc29uCiAgICB0eXBlOiBib3RzCiAgLSBzb3VyY2VfdXJsOiBodHRwczovL2h1Yi1kYXRhLmNyb3dkc2VjLm5ldC93aGl0ZWxpc3RzL2Jlbmlnbl9ib3RzL2xlZ2l0X2JvdHMvdHdpdHRlcmJvdC5qc29uCiAgICBkZXN0X2ZpbGU6IGxlZ2l0X2JvdHMvdHdpdHRlcmJvdC5qc29uCiAgICB0eXBlOiBib3RzCiAgLSBzb3VyY2VfdXJsOiBodHRwczovL2h1Yi1kYXRhLmNyb3dkc2VjLm5ldC93aGl0ZWxpc3RzL2Jlbmlnbl9ib3RzL2xlZ2l0X2JvdHMvcGludGVyZXN0Lmpzb24KICAgIGRlc3RfZmlsZTogbGVnaXRfYm90cy9waW50ZXJlc3QuanNvbgogICAgdHlwZTogYm90cwo=", + "labels": null, + "path": "appsec-rules/crowdsecurity/appsec-bot-legit-social.yaml", + "version": "0.1", + "versions": { + "0.1": { + "deprecated": false, + "digest": "7de6aab1a2cfcd0b3d1dc0d7b1eaa2ece6e2bd65488075d37f3cc9840ad33d65" } } }, @@ -7817,10 +7864,13 @@ "crowdsecurity/appsec-bot-challenge-exclude-webhooks" ], "appsec-rules": [ - "crowdsecurity/appsec-bot-legit-bots" + "crowdsecurity/appsec-bot-legit-search-engines", + "crowdsecurity/appsec-bot-legit-ai-crawlers", + "crowdsecurity/appsec-bot-legit-social", + "crowdsecurity/appsec-bot-legit-monitoring" ], "author": "crowdsecurity", - "content": "bmFtZTogY3Jvd2RzZWN1cml0eS9hcHBzZWMtYm90LWNoYWxsZW5nZQpwYXJzZXJzOgogIC0gY3Jvd2RzZWN1cml0eS9hcHBzZWMtbG9ncwogIC0gY3Jvd2RzZWN1cml0eS9hcHBzZWMtYm90LWRldGVjdGlvbi1sb2dzCmFwcHNlYy1jb25maWdzOgogIC0gY3Jvd2RzZWN1cml0eS9hcHBzZWMtYm90LWNoYWxsZW5nZS1zaW1wbGUKICAtIGNyb3dkc2VjdXJpdHkvYXBwc2VjLWJvdC1jaGFsbGVuZ2UtZXhjbHVkZS1jcmF3bGVyLWZpbGVzCiAgLSBjcm93ZHNlY3VyaXR5L2FwcHNlYy1ib3QtY2hhbGxlbmdlLWV4Y2x1ZGUtZmVlZHMKICAtIGNyb3dkc2VjdXJpdHkvYXBwc2VjLWJvdC1jaGFsbGVuZ2UtZXhjbHVkZS13ZWJob29rcwphcHBzZWMtcnVsZXM6CiAgLSBjcm93ZHNlY3VyaXR5L2FwcHNlYy1ib3QtbGVnaXQtYm90cwpzY2VuYXJpb3M6CiAgLSBjcm93ZHNlY3VyaXR5L2FwcHNlYy1ib3QtZGV0ZWN0ZWQKICAtIGNyb3dkc2VjdXJpdHkvYXBwc2VjLWJvdC1jaGFsbGVuZ2UtdG9vLW1hbnktcmVxdWVzdHMKICAtIGNyb3dkc2VjdXJpdHkvYXBwc2VjLWJvdC1jaGFsbGVuZ2UtdG9vLW1hbnktc3VibWlzc2lvbnMKICAtIGNyb3dkc2VjdXJpdHkvYXBwc2VjLWJvdC1jaGFsbGVuZ2UtcmVxdWVzdC13aXRoLW5vLXN1Ym1pc3Npb24KY29udGV4dHM6CiAgLSBjcm93ZHNlY3VyaXR5L2FwcHNlY19iYXNlCiAgLSBjcm93ZHNlY3VyaXR5L2FwcHNlYy1ib3QtZGV0ZWN0aW9uCmRlc2NyaXB0aW9uOiAiQXBwU2VjIGJvdCBkZXRlY3Rpb246IGNoYWxsZW5nZSBtb2RlIHdpdGggZmFzdC1kZXRlY3QgYm90IHJlamVjdGlvbiBhbmQgd2VsbC1rbm93bi1wYXRoIGV4Y2x1c2lvbnMiCmxhYmVsczoKICBsYWJlbDogIldBRiAtIEJvdCBDaGFsbGVuZ2UiCmF1dGhvcjogY3Jvd2RzZWN1cml0eQp0YWdzOgogIC0gd2FmCiAgLSBhcHBzZWMKICAtIGh0dHAKICAtIGJvdAo=", + "content": "bmFtZTogY3Jvd2RzZWN1cml0eS9hcHBzZWMtYm90LWNoYWxsZW5nZQpwYXJzZXJzOgogIC0gY3Jvd2RzZWN1cml0eS9hcHBzZWMtbG9ncwogIC0gY3Jvd2RzZWN1cml0eS9hcHBzZWMtYm90LWRldGVjdGlvbi1sb2dzCmFwcHNlYy1jb25maWdzOgogIC0gY3Jvd2RzZWN1cml0eS9hcHBzZWMtYm90LWNoYWxsZW5nZS1zaW1wbGUKICAtIGNyb3dkc2VjdXJpdHkvYXBwc2VjLWJvdC1jaGFsbGVuZ2UtZXhjbHVkZS1jcmF3bGVyLWZpbGVzCiAgLSBjcm93ZHNlY3VyaXR5L2FwcHNlYy1ib3QtY2hhbGxlbmdlLWV4Y2x1ZGUtZmVlZHMKICAtIGNyb3dkc2VjdXJpdHkvYXBwc2VjLWJvdC1jaGFsbGVuZ2UtZXhjbHVkZS13ZWJob29rcwphcHBzZWMtcnVsZXM6CiAgLSBjcm93ZHNlY3VyaXR5L2FwcHNlYy1ib3QtbGVnaXQtc2VhcmNoLWVuZ2luZXMKICAtIGNyb3dkc2VjdXJpdHkvYXBwc2VjLWJvdC1sZWdpdC1haS1jcmF3bGVycwogIC0gY3Jvd2RzZWN1cml0eS9hcHBzZWMtYm90LWxlZ2l0LXNvY2lhbAogIC0gY3Jvd2RzZWN1cml0eS9hcHBzZWMtYm90LWxlZ2l0LW1vbml0b3JpbmcKc2NlbmFyaW9zOgogIC0gY3Jvd2RzZWN1cml0eS9hcHBzZWMtYm90LWRldGVjdGVkCiAgLSBjcm93ZHNlY3VyaXR5L2FwcHNlYy1ib3QtY2hhbGxlbmdlLXRvby1tYW55LXJlcXVlc3RzCiAgLSBjcm93ZHNlY3VyaXR5L2FwcHNlYy1ib3QtY2hhbGxlbmdlLXRvby1tYW55LXN1Ym1pc3Npb25zCiAgLSBjcm93ZHNlY3VyaXR5L2FwcHNlYy1ib3QtY2hhbGxlbmdlLXJlcXVlc3Qtd2l0aC1uby1zdWJtaXNzaW9uCmNvbnRleHRzOgogIC0gY3Jvd2RzZWN1cml0eS9hcHBzZWNfYmFzZQogIC0gY3Jvd2RzZWN1cml0eS9hcHBzZWMtYm90LWRldGVjdGlvbgpkZXNjcmlwdGlvbjogIkFwcFNlYyBib3QgZGV0ZWN0aW9uOiBjaGFsbGVuZ2UgbW9kZSB3aXRoIGZhc3QtZGV0ZWN0IGJvdCByZWplY3Rpb24gYW5kIHdlbGwta25vd24tcGF0aCBleGNsdXNpb25zIgpsYWJlbHM6CiAgbGFiZWw6ICJXQUYgLSBCb3QgQ2hhbGxlbmdlIgphdXRob3I6IGNyb3dkc2VjdXJpdHkKdGFnczoKICAtIHdhZgogIC0gYXBwc2VjCiAgLSBodHRwCiAgLSBib3QK", "contexts": [ "crowdsecurity/appsec_base", "crowdsecurity/appsec-bot-detection" @@ -7829,7 +7879,7 @@ "labels": { "label": "WAF - Bot Challenge" }, - "long_description": "IyBBcHBTZWMgQm90IENoYWxsZW5nZQoKVGhpcyBjb2xsZWN0aW9uIGVuYWJsZXMgQ3Jvd2RTZWMgQXBwU2VjICoqY2hhbGxlbmdlIG1vZGUqKiBmb3IgYm90IGRldGVjdGlvbjogdmlzaXRvcnMgYXJlIHNlcnZlZCBhCmxpZ2h0d2VpZ2h0IHByb29mLW9mLXdvcmsgKyBicm93c2VyLWZpbmdlcnByaW50IGNoYWxsZW5nZSwgYW5kIGNsaWVudHMgZmxhZ2dlZCBhcyBrbm93biBib3RzIGJ5IHRoZQpmYXN0IGJvdCBkZXRlY3Rpb24gYXJlIHJlamVjdGVkLgoKV2hhdCBpdCBzaGlwczoKCiAtIGBjcm93ZHNlY3VyaXR5L2FwcHNlYy1ib3QtY2hhbGxlbmdlLXNpbXBsZWA6IGNoYWxsZW5nZXMgaW5jb21pbmcgcmVxdWVzdHMsIHNraXBzIHZlcmlmaWVkIGdvb2QgYm90cwogICAoZm9yd2FyZC1jb25maXJtZWQgckROUyksIGFuZCByZWplY3RzIGNoYWxsZW5nZSBzdWJtaXNzaW9ucyB3aG9zZSBmaW5nZXJwcmludCB0cmlwcyB0aGUgZmFzdCBib3QKICAgZGV0ZWN0aW9uLgogLSBgY3Jvd2RzZWN1cml0eS9hcHBzZWMtYm90LWxlZ2l0LWJvdHNgOiBzaGlwcyB0aGUgdmVyaWZpZWQtZ29vZC1ib3QgZGF0YWZpbGVzIChnb29nbGVib3QsIGJpbmdib3QsCiAgIGFwcGxlYm90LCBhbWF6b25ib3QsIGdwdGJvdCkgdGhhdCBiYWNrIHRoZSBmb3J3YXJkLWNvbmZpcm1lZCByRE5TIGV4Y2x1c2lvbiBhYm92ZSwgc28gbGVnaXRpbWF0ZQogICBjcmF3bGVycyBza2lwIHRoZSBjaGFsbGVuZ2UuCiAtIFdlbGwta25vd24tcGF0aCBleGNsdXNpb24gY29uZmlncyAoYGFwcHNlYy1ib3QtY2hhbGxlbmdlLWV4Y2x1ZGUtY3Jhd2xlci1maWxlc2AsIGAtZmVlZHNgLCBgLXdlYmhvb2tzYCkgdGhhdAogICBsZXQgbWFjaGluZS1mYWNpbmcgZW5kcG9pbnRzIChgL3JvYm90cy50eHRgLCBgLy53ZWxsLWtub3duLypgLCBmZWVkcywgd2ViaG9va3MpIHRocm91Z2ggd2l0aG91dCBhCiAgIGNoYWxsZW5nZS4gVGhlIGV4Y2x1c2lvbiBpcyBzdHJpY3RseSBwZXItcmVxdWVzdCBhbmQgaXMgbmV2ZXIgcGVyc2lzdGVkIHRvIGEgY29va2llIG9yIGFjcm9zcwogICByZXF1ZXN0cywgc28gaXQgY2Fubm90IGJlIGFidXNlZCB0byB3aGl0ZWxpc3QgYSBzZXNzaW9uIGZvciBvdGhlciBwYXRocy4KIC0gQSBkZWRpY2F0ZWQgYm90LWRldGVjdGlvbiBwYXJzZXIgdHJhY2tpbmcgdGhlIGZpbmdlcnByaW50IHNlc3Npb24gaWQgKGBmc2lkYCkgYW5kIE9TLgogLSBTY2VuYXJpb3MgdGhhdCBhbGVydCBvbiBkZXRlY3RlZCBib3RzIGFuZCBvbiBjaGFsbGVuZ2UgYWJ1c2UuCiAtIEEgdXNlci1mcmllbmRseSBhbGVydCBjb250ZXh0IGV4cG9zaW5nIGBmc2lkYCwgT1MsIGFuZCB0aGUgYm90IHNpZ25hbHMgdGhhdCBmaXJlZC4KCiMjIEVuYWJsaW5nIGJvdCBjaGFsbGVuZ2UKCkFkZCB0aGUgYGNyb3dkc2VjdXJpdHkvYXBwc2VjLWJvdC1jaGFsbGVuZ2Utc2ltcGxlYCBhcHBzZWMtY29uZmlnIHRvIHlvdXIgV0FGIGFjcXVpc2l0aW9uLCBwbHVzIGFueSBvZiB0aGUKd2VsbC1rbm93bi1wYXRoIGV4Y2x1c2lvbiBjb25maWdzIHlvdSBuZWVkOgoKYGBgeWFtbAphcHBzZWNfY29uZmlnczoKIC0gY3Jvd2RzZWN1cml0eS9hcHBzZWMtYm90LWNoYWxsZW5nZS1zaW1wbGUKIC0gY3Jvd2RzZWN1cml0eS9hcHBzZWMtYm90LWNoYWxsZW5nZS1leGNsdWRlLWNyYXdsZXItZmlsZXMKIC0gY3Jvd2RzZWN1cml0eS9hcHBzZWMtYm90LWNoYWxsZW5nZS1leGNsdWRlLWZlZWRzCiAtIGNyb3dkc2VjdXJpdHkvYXBwc2VjLWJvdC1jaGFsbGVuZ2UtZXhjbHVkZS13ZWJob29rcwpsYWJlbHM6CiAgdHlwZTogYXBwc2VjCmxpc3Rlbl9hZGRyOiAxMjcuMC4wLjE6NzQyMgpzb3VyY2U6IGFwcHNlYwpgYGAK", + "long_description": "IyBBcHBTZWMgQm90IENoYWxsZW5nZQoKVGhpcyBjb2xsZWN0aW9uIGVuYWJsZXMgQ3Jvd2RTZWMgQXBwU2VjICoqY2hhbGxlbmdlIG1vZGUqKiBmb3IgYm90IGRldGVjdGlvbjogdmlzaXRvcnMgYXJlIHNlcnZlZCBhCmxpZ2h0d2VpZ2h0IHByb29mLW9mLXdvcmsgKyBicm93c2VyLWZpbmdlcnByaW50IGNoYWxsZW5nZSwgYW5kIGNsaWVudHMgZmxhZ2dlZCBhcyBrbm93biBib3RzIGJ5IHRoZQpmYXN0IGJvdCBkZXRlY3Rpb24gYXJlIHJlamVjdGVkLgoKV2hhdCBpdCBzaGlwczoKCiAtIGBjcm93ZHNlY3VyaXR5L2FwcHNlYy1ib3QtY2hhbGxlbmdlLXNpbXBsZWA6IGNoYWxsZW5nZXMgaW5jb21pbmcgcmVxdWVzdHMsIHNraXBzIHZlcmlmaWVkIGdvb2QgYm90cwogICAoZm9yd2FyZC1jb25maXJtZWQgckROUyksIGFuZCByZWplY3RzIGNoYWxsZW5nZSBzdWJtaXNzaW9ucyB3aG9zZSBmaW5nZXJwcmludCB0cmlwcyB0aGUgZmFzdCBib3QKICAgZGV0ZWN0aW9uLgogLSBWZXJpZmllZC1nb29kLWJvdCBkYXRhZmlsZXMgdGhhdCBiYWNrIHRoZSBleGNsdXNpb24gYWJvdmUsIHNwbGl0IGJ5IGZhbWlseSBzbyB5b3UgY2FuIGVuYWJsZSBvbmx5IHRoZQogICBvbmVzIHlvdSBuZWVkOgogICAtIGBjcm93ZHNlY3VyaXR5L2FwcHNlYy1ib3QtbGVnaXQtc2VhcmNoLWVuZ2luZXNgOiBnb29nbGVib3QsIGJpbmdib3QsIGFwcGxlYm90LCBhbWF6b25ib3QsIHlhbmRleCwKICAgICBiYWlkdSwgeWFob28sIHNvZ291LCBxd2FudCwgYmFiYmFyLCBkdWNrZHVja2JvdAogICAtIGBjcm93ZHNlY3VyaXR5L2FwcHNlYy1ib3QtbGVnaXQtYWktY3Jhd2xlcnNgOiBncHRib3QsIG9wZW5haS1zZWFyY2hib3QsIG9wZW5haS1jaGF0Z3B0LXVzZXIsCiAgICAgcGVycGxleGl0eWJvdAogICAtIGBjcm93ZHNlY3VyaXR5L2FwcHNlYy1ib3QtbGVnaXQtc29jaWFsYDogbWV0YSwgZGlzY29yZCwgdGVsZWdyYW0sIHR3aXR0ZXJib3QsIHBpbnRlcmVzdAogICAtIGBjcm93ZHNlY3VyaXR5L2FwcHNlYy1ib3QtbGVnaXQtbW9uaXRvcmluZ2A6IHVwdGltZXJvYm90LCBjb29raWVib3QKCiAgIEEgYm90IGlzIGV4ZW1wdGVkICoqb25seSoqIHdoZW4gaXQgY2FuIGJlIG5ldHdvcmstdmVyaWZpZWQg4oCUIGZvcndhcmQtY29uZmlybWVkIHJETlMgb3IgYSBwdWJsaXNoZWQgSVAKICAgcmFuZ2UuIFVzZXItQWdlbnQtb25seSBib3RzIChlLmcuIENvbW1vbkNyYXdsL0NDQm90KSBhcmUgaW50ZW50aW9uYWxseSBsZWZ0IGNoYWxsZW5nZWQsIHNpbmNlIGEKICAgc3Bvb2ZlZCBVc2VyLUFnZW50IG11c3Qgbm90IGJ5cGFzcyB0aGUgY2hhbGxlbmdlLgogLSBXZWxsLWtub3duLXBhdGggZXhjbHVzaW9uIGNvbmZpZ3MgKGBhcHBzZWMtYm90LWNoYWxsZW5nZS1leGNsdWRlLWNyYXdsZXItZmlsZXNgLCBgLWZlZWRzYCwgYC13ZWJob29rc2ApIHRoYXQKICAgbGV0IG1hY2hpbmUtZmFjaW5nIGVuZHBvaW50cyAoYC9yb2JvdHMudHh0YCwgYC8ud2VsbC1rbm93bi8qYCwgZmVlZHMsIHdlYmhvb2tzKSB0aHJvdWdoIHdpdGhvdXQgYQogICBjaGFsbGVuZ2UuIFRoZSBleGNsdXNpb24gaXMgc3RyaWN0bHkgcGVyLXJlcXVlc3QgYW5kIGlzIG5ldmVyIHBlcnNpc3RlZCB0byBhIGNvb2tpZSBvciBhY3Jvc3MKICAgcmVxdWVzdHMsIHNvIGl0IGNhbm5vdCBiZSBhYnVzZWQgdG8gd2hpdGVsaXN0IGEgc2Vzc2lvbiBmb3Igb3RoZXIgcGF0aHMuCiAtIEEgZGVkaWNhdGVkIGJvdC1kZXRlY3Rpb24gcGFyc2VyIHRyYWNraW5nIHRoZSBmaW5nZXJwcmludCBzZXNzaW9uIGlkIChgZnNpZGApIGFuZCBPUy4KIC0gU2NlbmFyaW9zIHRoYXQgYWxlcnQgb24gZGV0ZWN0ZWQgYm90cyBhbmQgb24gY2hhbGxlbmdlIGFidXNlLgogLSBBIHVzZXItZnJpZW5kbHkgYWxlcnQgY29udGV4dCBleHBvc2luZyBgZnNpZGAsIE9TLCBhbmQgdGhlIGJvdCBzaWduYWxzIHRoYXQgZmlyZWQuCgojIyBFbmFibGluZyBib3QgY2hhbGxlbmdlCgpBZGQgdGhlIGBjcm93ZHNlY3VyaXR5L2FwcHNlYy1ib3QtY2hhbGxlbmdlLXNpbXBsZWAgYXBwc2VjLWNvbmZpZyB0byB5b3VyIFdBRiBhY3F1aXNpdGlvbiwgcGx1cyBhbnkgb2YgdGhlCndlbGwta25vd24tcGF0aCBleGNsdXNpb24gY29uZmlncyB5b3UgbmVlZDoKCmBgYHlhbWwKYXBwc2VjX2NvbmZpZ3M6CiAtIGNyb3dkc2VjdXJpdHkvYXBwc2VjLWJvdC1jaGFsbGVuZ2Utc2ltcGxlCiAtIGNyb3dkc2VjdXJpdHkvYXBwc2VjLWJvdC1jaGFsbGVuZ2UtZXhjbHVkZS1jcmF3bGVyLWZpbGVzCiAtIGNyb3dkc2VjdXJpdHkvYXBwc2VjLWJvdC1jaGFsbGVuZ2UtZXhjbHVkZS1mZWVkcwogLSBjcm93ZHNlY3VyaXR5L2FwcHNlYy1ib3QtY2hhbGxlbmdlLWV4Y2x1ZGUtd2ViaG9va3MKbGFiZWxzOgogIHR5cGU6IGFwcHNlYwpsaXN0ZW5fYWRkcjogMTI3LjAuMC4xOjc0MjIKc291cmNlOiBhcHBzZWMKYGBgCg==", "parsers": [ "crowdsecurity/appsec-logs", "crowdsecurity/appsec-bot-detection-logs" @@ -7841,7 +7891,7 @@ "crowdsecurity/appsec-bot-challenge-too-many-submissions", "crowdsecurity/appsec-bot-challenge-request-with-no-submission" ], - "version": "0.3", + "version": "0.4", "versions": { "0.1": { "deprecated": false, @@ -7854,6 +7904,10 @@ "0.3": { "deprecated": false, "digest": "15a3e245424158241a8178dcb4df0f8e81906e69ca01894974924846aa365889" + }, + "0.4": { + "deprecated": false, + "digest": "7c8d5418e6d02711f582f031d9062aaa31701bc691ac59b1dc96d49cb774e692" } } }, From 3f15d336bc5df0815cc0cefc977a413301ba6829 Mon Sep 17 00:00:00 2001 From: Thibault Koechlin Date: Wed, 1 Jul 2026 11:30:00 +0200 Subject: [PATCH 23/36] be more lenient --- .../crowdsecurity/appsec-bot-challenge-exclude-webhooks.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/appsec-configs/crowdsecurity/appsec-bot-challenge-exclude-webhooks.yaml b/appsec-configs/crowdsecurity/appsec-bot-challenge-exclude-webhooks.yaml index ef35866c529..bfbfb88846b 100644 --- a/appsec-configs/crowdsecurity/appsec-bot-challenge-exclude-webhooks.yaml +++ b/appsec-configs/crowdsecurity/appsec-bot-challenge-exclude-webhooks.yaml @@ -2,6 +2,6 @@ name: crowdsecurity/appsec-bot-challenge-exclude-webhooks # Let third-party webhook callbacks fly through without a challenge. inband: pre_eval: - - filter: "req.URL.Path in ['/webhooks/stripe', '/webhooks/github', '/webhooks/sendgrid']" + - filter: "req.URL.Path startsWith '/webhooks/'" apply: - ExemptFromChallenge() From 389aae4e8734e4aea409ba0d526eb7eacd2f0eb8 Mon Sep 17 00:00:00 2001 From: GitHub Action Date: Wed, 1 Jul 2026 09:31:10 +0000 Subject: [PATCH 24/36] Update index --- .index.json | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/.index.json b/.index.json index f44cfae97c1..801185d484a 100644 --- a/.index.json +++ b/.index.json @@ -36,14 +36,18 @@ }, "crowdsecurity/appsec-bot-challenge-exclude-webhooks": { "author": "crowdsecurity", - "content": "bmFtZTogY3Jvd2RzZWN1cml0eS9hcHBzZWMtYm90LWNoYWxsZW5nZS1leGNsdWRlLXdlYmhvb2tzCiMgTGV0IHRoaXJkLXBhcnR5IHdlYmhvb2sgY2FsbGJhY2tzIGZseSB0aHJvdWdoIHdpdGhvdXQgYSBjaGFsbGVuZ2UuCmluYmFuZDoKICBwcmVfZXZhbDoKICAgIC0gZmlsdGVyOiAicmVxLlVSTC5QYXRoIGluIFsnL3dlYmhvb2tzL3N0cmlwZScsICcvd2ViaG9va3MvZ2l0aHViJywgJy93ZWJob29rcy9zZW5kZ3JpZCddIgogICAgICBhcHBseToKICAgICAgICAtIEV4ZW1wdEZyb21DaGFsbGVuZ2UoKQo=", + "content": "bmFtZTogY3Jvd2RzZWN1cml0eS9hcHBzZWMtYm90LWNoYWxsZW5nZS1leGNsdWRlLXdlYmhvb2tzCiMgTGV0IHRoaXJkLXBhcnR5IHdlYmhvb2sgY2FsbGJhY2tzIGZseSB0aHJvdWdoIHdpdGhvdXQgYSBjaGFsbGVuZ2UuCmluYmFuZDoKICBwcmVfZXZhbDoKICAgIC0gZmlsdGVyOiAicmVxLlVSTC5QYXRoIHN0YXJ0c1dpdGggJy93ZWJob29rcy8nIgogICAgICBhcHBseToKICAgICAgICAtIEV4ZW1wdEZyb21DaGFsbGVuZ2UoKQo=", "labels": null, "path": "appsec-configs/crowdsecurity/appsec-bot-challenge-exclude-webhooks.yaml", - "version": "0.1", + "version": "0.2", "versions": { "0.1": { "deprecated": false, "digest": "ce0eb972b99d443f980cc91f1a0cad8e7f71eeafbbf069b68632baded4f03c25" + }, + "0.2": { + "deprecated": false, + "digest": "c44f5e91e2aacd0c98d88697ea520485d4f5e3b9e9f699ab4df5c7ce9f2bca15" } } }, From 862da2fd465733c7ea315345f1150a072672a693 Mon Sep 17 00:00:00 2001 From: Thibault Koechlin Date: Wed, 1 Jul 2026 14:31:36 +0200 Subject: [PATCH 25/36] exclude more commons paths from bot challenge --- .../appsec-bot-challenge-exclude-api.yaml | 17 +++++++++++++++++ .../appsec-bot-challenge-exclude-static.yaml | 12 ++++++++++++ .../crowdsecurity/appsec-bot-challenge.md | 19 +++++++++++++++---- .../crowdsecurity/appsec-bot-challenge.yaml | 2 ++ 4 files changed, 46 insertions(+), 4 deletions(-) create mode 100644 appsec-configs/crowdsecurity/appsec-bot-challenge-exclude-api.yaml create mode 100644 appsec-configs/crowdsecurity/appsec-bot-challenge-exclude-static.yaml diff --git a/appsec-configs/crowdsecurity/appsec-bot-challenge-exclude-api.yaml b/appsec-configs/crowdsecurity/appsec-bot-challenge-exclude-api.yaml new file mode 100644 index 00000000000..a81c980ae52 --- /dev/null +++ b/appsec-configs/crowdsecurity/appsec-bot-challenge-exclude-api.yaml @@ -0,0 +1,17 @@ +name: crowdsecurity/appsec-bot-challenge-exclude-api +# Let programmatic/API endpoints through without a challenge: their clients (mobile apps, SDKs, +# server-to-server, XHR/fetch) can't run the JavaScript proof-of-work, so a challenge just breaks them. +# Protect these with rate-limit/auth-based scenarios instead of the browser challenge. +# Note: '/v1/' and '/v2/' also match versioned HTML documentation sites, so those pages won't be +# challenged. Accepted under the over-exclude strategy; drop this config if you serve HTML under /v1/. +inband: + pre_eval: + - filter: >- + req.URL.Path in ['/api', '/graphql'] || + req.URL.Path startsWith '/api/' || req.URL.Path startsWith '/wp-json/' || + req.URL.Path startsWith '/graphql/' || req.URL.Path startsWith '/rest/' || + req.URL.Path startsWith '/v1/' || req.URL.Path startsWith '/v2/' || + req.URL.Path startsWith '/oauth/' || req.URL.Path startsWith '/.netlify/functions/' || + req.URL.Path startsWith '/_next/data/' + apply: + - ExemptFromChallenge() diff --git a/appsec-configs/crowdsecurity/appsec-bot-challenge-exclude-static.yaml b/appsec-configs/crowdsecurity/appsec-bot-challenge-exclude-static.yaml new file mode 100644 index 00000000000..384ff29f261 --- /dev/null +++ b/appsec-configs/crowdsecurity/appsec-bot-challenge-exclude-static.yaml @@ -0,0 +1,12 @@ +name: crowdsecurity/appsec-bot-challenge-exclude-static +# Let static assets (styles, scripts, sourcemaps, images, fonts, audio/video) and the two browser +# metadata files fly through without a challenge. A challenge page returned for a subresource breaks +# page rendering for real users, and these carry no content worth gating. Downloads/documents +# (pdf, zip, ...) are deliberately NOT exempted, as they may be the gated content itself. +inband: + pre_eval: + - filter: >- + req.URL.Path matches '(?i)\.(css|js|mjs|map|png|jpe?g|gif|svg|webp|avif|ico|bmp|woff2?|ttf|otf|eot|mp4|m4v|webm|mov|mp3|m4a|wav|ogg|oga|ogv|flac|aac|webmanifest)$' || + req.URL.Path in ['/manifest.json', '/browserconfig.xml'] + apply: + - ExemptFromChallenge() diff --git a/collections/crowdsecurity/appsec-bot-challenge.md b/collections/crowdsecurity/appsec-bot-challenge.md index 710d4aaa7ae..5d07119c5c1 100644 --- a/collections/crowdsecurity/appsec-bot-challenge.md +++ b/collections/crowdsecurity/appsec-bot-challenge.md @@ -21,10 +21,19 @@ What it ships: A bot is exempted **only** when it can be network-verified — forward-confirmed rDNS or a published IP range. User-Agent-only bots (e.g. CommonCrawl/CCBot) are intentionally left challenged, since a spoofed User-Agent must not bypass the challenge. - - Well-known-path exclusion configs (`appsec-bot-challenge-exclude-crawler-files`, `-feeds`, `-webhooks`) that - let machine-facing endpoints (`/robots.txt`, `/.well-known/*`, feeds, webhooks) through without a - challenge. The exclusion is strictly per-request and is never persisted to a cookie or across - requests, so it cannot be abused to whitelist a session for other paths. + - Path exclusion configs that let machine-facing or non-navigational requests through without a + challenge: + - `appsec-bot-challenge-exclude-crawler-files` — `/robots.txt`, `/.well-known/*`, `/security.txt`, … + - `appsec-bot-challenge-exclude-feeds` — RSS/Atom feed paths + - `appsec-bot-challenge-exclude-webhooks` — third-party webhook paths + - `appsec-bot-challenge-exclude-static` — static assets and media (css, js, images, fonts, + audio/video, sourcemaps); a challenge page returned for a subresource would break page rendering + - `appsec-bot-challenge-exclude-api` — programmatic endpoints (`/api/`, `/wp-json/`, `/graphql`, + `/rest/`, `/v1/`, `/v2/`, `/oauth/`, …) whose non-browser clients can't run the PoW. These are + intentionally left un-challenged; protect them with rate-limit/auth-based scenarios instead. + + The exclusion is strictly per-request and is never persisted to a cookie or across requests, so it + cannot be abused to whitelist a session for other paths. - A dedicated bot-detection parser tracking the fingerprint session id (`fsid`) and OS. - Scenarios that alert on detected bots and on challenge abuse. - A user-friendly alert context exposing `fsid`, OS, and the bot signals that fired. @@ -40,6 +49,8 @@ appsec_configs: - crowdsecurity/appsec-bot-challenge-exclude-crawler-files - crowdsecurity/appsec-bot-challenge-exclude-feeds - crowdsecurity/appsec-bot-challenge-exclude-webhooks + - crowdsecurity/appsec-bot-challenge-exclude-static + - crowdsecurity/appsec-bot-challenge-exclude-api labels: type: appsec listen_addr: 127.0.0.1:7422 diff --git a/collections/crowdsecurity/appsec-bot-challenge.yaml b/collections/crowdsecurity/appsec-bot-challenge.yaml index 2ce3a53876a..a8392688855 100644 --- a/collections/crowdsecurity/appsec-bot-challenge.yaml +++ b/collections/crowdsecurity/appsec-bot-challenge.yaml @@ -7,6 +7,8 @@ appsec-configs: - crowdsecurity/appsec-bot-challenge-exclude-crawler-files - crowdsecurity/appsec-bot-challenge-exclude-feeds - crowdsecurity/appsec-bot-challenge-exclude-webhooks + - crowdsecurity/appsec-bot-challenge-exclude-static + - crowdsecurity/appsec-bot-challenge-exclude-api appsec-rules: - crowdsecurity/appsec-bot-legit-search-engines - crowdsecurity/appsec-bot-legit-ai-crawlers From 46bcfcd62e51a7386d3c21fcd2d7eb4ea10ef7dd Mon Sep 17 00:00:00 2001 From: Thibault Koechlin Date: Wed, 1 Jul 2026 14:38:56 +0200 Subject: [PATCH 26/36] cleanup comments --- .../appsec-bot-challenge-exclude-api.yaml | 8 +++----- .../appsec-bot-challenge-exclude-crawler-files.yaml | 1 + .../appsec-bot-challenge-exclude-feeds.yaml | 3 +-- .../appsec-bot-challenge-exclude-static.yaml | 6 ++---- .../appsec-bot-challenge-exclude-webhooks.yaml | 1 + .../crowdsecurity/appsec-bot-challenge-simple.yaml | 7 +++---- .../crowdsecurity/appsec-bot-legit-ai-crawlers.yaml | 5 ++--- .../crowdsecurity/appsec-bot-legit-monitoring.yaml | 5 ++--- .../appsec-bot-legit-search-engines.yaml | 5 ++--- .../crowdsecurity/appsec-bot-legit-social.yaml | 4 +--- collections/crowdsecurity/appsec-bot-challenge.md | 11 ++--------- 11 files changed, 20 insertions(+), 36 deletions(-) diff --git a/appsec-configs/crowdsecurity/appsec-bot-challenge-exclude-api.yaml b/appsec-configs/crowdsecurity/appsec-bot-challenge-exclude-api.yaml index a81c980ae52..6756a1bdb28 100644 --- a/appsec-configs/crowdsecurity/appsec-bot-challenge-exclude-api.yaml +++ b/appsec-configs/crowdsecurity/appsec-bot-challenge-exclude-api.yaml @@ -1,9 +1,7 @@ name: crowdsecurity/appsec-bot-challenge-exclude-api -# Let programmatic/API endpoints through without a challenge: their clients (mobile apps, SDKs, -# server-to-server, XHR/fetch) can't run the JavaScript proof-of-work, so a challenge just breaks them. -# Protect these with rate-limit/auth-based scenarios instead of the browser challenge. -# Note: '/v1/' and '/v2/' also match versioned HTML documentation sites, so those pages won't be -# challenged. Accepted under the over-exclude strategy; drop this config if you serve HTML under /v1/. +# Let programmatic/API endpoints through without a challenge: it would break with legitimate clients +# that cannot solve the challenge. +# Do not edit this file to add your own exclusions, create a custom config. inband: pre_eval: - filter: >- diff --git a/appsec-configs/crowdsecurity/appsec-bot-challenge-exclude-crawler-files.yaml b/appsec-configs/crowdsecurity/appsec-bot-challenge-exclude-crawler-files.yaml index a39cbad74b3..6ab9e701339 100644 --- a/appsec-configs/crowdsecurity/appsec-bot-challenge-exclude-crawler-files.yaml +++ b/appsec-configs/crowdsecurity/appsec-bot-challenge-exclude-crawler-files.yaml @@ -1,5 +1,6 @@ name: crowdsecurity/appsec-bot-challenge-exclude-crawler-files # Let well-known crawler files fly through without a challenge. +# Do not edit this file to add your own exclusions, create a custom config. inband: pre_eval: - filter: >- diff --git a/appsec-configs/crowdsecurity/appsec-bot-challenge-exclude-feeds.yaml b/appsec-configs/crowdsecurity/appsec-bot-challenge-exclude-feeds.yaml index 2c1b83d3deb..7aa6d972fac 100644 --- a/appsec-configs/crowdsecurity/appsec-bot-challenge-exclude-feeds.yaml +++ b/appsec-configs/crowdsecurity/appsec-bot-challenge-exclude-feeds.yaml @@ -1,9 +1,8 @@ name: crowdsecurity/appsec-bot-challenge-exclude-feeds # Let syndication feed endpoints fly through without a challenge. +# Do not edit this file to add your own exclusions, create a custom config. inband: pre_eval: - # Exact feed filenames are safe to exempt; the pre-existing '/feed/' and '/rss/' prefixes are kept - # but not broadened — a prefix exemption would turn a whole namespace into challenge-free surface. - filter: >- req.URL.Path in ['/feed', '/rss', '/atom.xml', '/feed.xml', '/rss.xml', '/index.xml', '/feed.atom'] || req.URL.Path startsWith '/feed/' || req.URL.Path startsWith '/rss/' diff --git a/appsec-configs/crowdsecurity/appsec-bot-challenge-exclude-static.yaml b/appsec-configs/crowdsecurity/appsec-bot-challenge-exclude-static.yaml index 384ff29f261..67100fe9d82 100644 --- a/appsec-configs/crowdsecurity/appsec-bot-challenge-exclude-static.yaml +++ b/appsec-configs/crowdsecurity/appsec-bot-challenge-exclude-static.yaml @@ -1,8 +1,6 @@ name: crowdsecurity/appsec-bot-challenge-exclude-static -# Let static assets (styles, scripts, sourcemaps, images, fonts, audio/video) and the two browser -# metadata files fly through without a challenge. A challenge page returned for a subresource breaks -# page rendering for real users, and these carry no content worth gating. Downloads/documents -# (pdf, zip, ...) are deliberately NOT exempted, as they may be the gated content itself. +# Let static assets and browser metadata files fly through without a challenge +# Do not edit this file to add your own exclusions, create a custom config. inband: pre_eval: - filter: >- diff --git a/appsec-configs/crowdsecurity/appsec-bot-challenge-exclude-webhooks.yaml b/appsec-configs/crowdsecurity/appsec-bot-challenge-exclude-webhooks.yaml index bfbfb88846b..483fbe6e5d6 100644 --- a/appsec-configs/crowdsecurity/appsec-bot-challenge-exclude-webhooks.yaml +++ b/appsec-configs/crowdsecurity/appsec-bot-challenge-exclude-webhooks.yaml @@ -1,5 +1,6 @@ name: crowdsecurity/appsec-bot-challenge-exclude-webhooks # Let third-party webhook callbacks fly through without a challenge. +# Do not edit this file to add your own exclusions, create a custom config. inband: pre_eval: - filter: "req.URL.Path startsWith '/webhooks/'" diff --git a/appsec-configs/crowdsecurity/appsec-bot-challenge-simple.yaml b/appsec-configs/crowdsecurity/appsec-bot-challenge-simple.yaml index 18cb86e18db..caeb889bded 100644 --- a/appsec-configs/crowdsecurity/appsec-bot-challenge-simple.yaml +++ b/appsec-configs/crowdsecurity/appsec-bot-challenge-simple.yaml @@ -1,14 +1,13 @@ name: crowdsecurity/appsec-bot-challenge-simple inband: post_eval: - # Skip the challenge for verified good bots (forward-confirmed rDNS) and for requests a - # well-known-path exclusion config flagged via ExemptFromChallenge(). The flag is per-request only. + # Skip the challenge for verified good bots and for requests a + # well-known-path exclusion config flagged via ExemptFromChallenge(). - filter: "!IsLegitimateBot(req.RemoteAddr, req.UserAgent(), req.URL.Path)" apply: - SendChallenge() on_challenge_submit: - # Reject submissions whose fingerprint fast-detect flags a known bot. The resulting "rejected" - # event feeds crowdsecurity/appsec-bot-detected (alert only, no active ban). + # Reject submissions whose fingerprint fast-detect flags a known bot. - filter: "fingerprint.IsBot()" apply: - RejectSubmission("known bot (fast bot detection)") diff --git a/appsec-rules/crowdsecurity/appsec-bot-legit-ai-crawlers.yaml b/appsec-rules/crowdsecurity/appsec-bot-legit-ai-crawlers.yaml index db08ccd9949..50945095051 100644 --- a/appsec-rules/crowdsecurity/appsec-bot-legit-ai-crawlers.yaml +++ b/appsec-rules/crowdsecurity/appsec-bot-legit-ai-crawlers.yaml @@ -1,8 +1,7 @@ name: crowdsecurity/appsec-bot-legit-ai-crawlers -# Declares the legitimate AI-crawler datafiles so crowdsec downloads them into -# /legit_bots/. They are consumed by the engine's IsLegitimateBot() helper -# (see crowdsecurity/appsec-bot-challenge-simple), not by seclang rules. +# Declares the legitimate AI-crawler datafiles so crowdsec downloads them. +# Do not edit this file to add your own exclusions, create a custom config. data: - source_url: https://hub-data.crowdsec.net/whitelists/benign_bots/legit_bots/gptbot.json diff --git a/appsec-rules/crowdsecurity/appsec-bot-legit-monitoring.yaml b/appsec-rules/crowdsecurity/appsec-bot-legit-monitoring.yaml index 583a0237aad..ac1c9c06cfe 100644 --- a/appsec-rules/crowdsecurity/appsec-bot-legit-monitoring.yaml +++ b/appsec-rules/crowdsecurity/appsec-bot-legit-monitoring.yaml @@ -1,8 +1,7 @@ name: crowdsecurity/appsec-bot-legit-monitoring -# Declares the legitimate uptime/monitoring datafiles so crowdsec downloads them into -# /legit_bots/. They are consumed by the engine's IsLegitimateBot() helper -# (see crowdsecurity/appsec-bot-challenge-simple), not by seclang rules. +# Declares the legitimate uptime/monitoring datafiles so crowdsec downloads them +# Do not edit this file to add your own exclusions, create a custom config. data: - source_url: https://hub-data.crowdsec.net/whitelists/benign_bots/legit_bots/uptimerobot.json diff --git a/appsec-rules/crowdsecurity/appsec-bot-legit-search-engines.yaml b/appsec-rules/crowdsecurity/appsec-bot-legit-search-engines.yaml index 41cb577a3de..e49ec821dda 100644 --- a/appsec-rules/crowdsecurity/appsec-bot-legit-search-engines.yaml +++ b/appsec-rules/crowdsecurity/appsec-bot-legit-search-engines.yaml @@ -1,8 +1,7 @@ name: crowdsecurity/appsec-bot-legit-search-engines -# Declares the legitimate search-engine datafiles so crowdsec downloads them into -# /legit_bots/. They are consumed by the engine's IsLegitimateBot() helper -# (see crowdsecurity/appsec-bot-challenge-simple), not by seclang rules. +# Declares the legitimate search-engine datafiles so crowdsec downloads them +# Do not edit this file to add your own exclusions, create a custom config. data: - source_url: https://hub-data.crowdsec.net/whitelists/benign_bots/legit_bots/googlebot.json diff --git a/appsec-rules/crowdsecurity/appsec-bot-legit-social.yaml b/appsec-rules/crowdsecurity/appsec-bot-legit-social.yaml index 120c5812f10..880f40eb19a 100644 --- a/appsec-rules/crowdsecurity/appsec-bot-legit-social.yaml +++ b/appsec-rules/crowdsecurity/appsec-bot-legit-social.yaml @@ -1,8 +1,6 @@ name: crowdsecurity/appsec-bot-legit-social -# Declares the legitimate social / link-preview unfurler datafiles so crowdsec downloads them -# into /legit_bots/. They are consumed by the engine's IsLegitimateBot() helper -# (see crowdsecurity/appsec-bot-challenge-simple), not by seclang rules. +# Declares the legitimate social / link-preview datafiles so crowdsec downloads them data: - source_url: https://hub-data.crowdsec.net/whitelists/benign_bots/legit_bots/meta.json diff --git a/collections/crowdsecurity/appsec-bot-challenge.md b/collections/crowdsecurity/appsec-bot-challenge.md index 5d07119c5c1..a41c8e59587 100644 --- a/collections/crowdsecurity/appsec-bot-challenge.md +++ b/collections/crowdsecurity/appsec-bot-challenge.md @@ -28,9 +28,7 @@ What it ships: - `appsec-bot-challenge-exclude-webhooks` — third-party webhook paths - `appsec-bot-challenge-exclude-static` — static assets and media (css, js, images, fonts, audio/video, sourcemaps); a challenge page returned for a subresource would break page rendering - - `appsec-bot-challenge-exclude-api` — programmatic endpoints (`/api/`, `/wp-json/`, `/graphql`, - `/rest/`, `/v1/`, `/v2/`, `/oauth/`, …) whose non-browser clients can't run the PoW. These are - intentionally left un-challenged; protect them with rate-limit/auth-based scenarios instead. + - `appsec-bot-challenge-exclude-api` — programmatic endpoints The exclusion is strictly per-request and is never persisted to a cookie or across requests, so it cannot be abused to whitelist a session for other paths. @@ -45,12 +43,7 @@ well-known-path exclusion configs you need: ```yaml appsec_configs: - - crowdsecurity/appsec-bot-challenge-simple - - crowdsecurity/appsec-bot-challenge-exclude-crawler-files - - crowdsecurity/appsec-bot-challenge-exclude-feeds - - crowdsecurity/appsec-bot-challenge-exclude-webhooks - - crowdsecurity/appsec-bot-challenge-exclude-static - - crowdsecurity/appsec-bot-challenge-exclude-api + - crowdsecurity/appsec-bot-* labels: type: appsec listen_addr: 127.0.0.1:7422 From a41deabfc47e188b8c6a930bafbbb1bee4471aa4 Mon Sep 17 00:00:00 2001 From: GitHub Action Date: Wed, 1 Jul 2026 12:39:15 +0000 Subject: [PATCH 27/36] Update index --- .index.json | 104 ++++++++++++++++++++++++++++++++++++++++++---------- 1 file changed, 84 insertions(+), 20 deletions(-) diff --git a/.index.json b/.index.json index 801185d484a..9343ea53902 100644 --- a/.index.json +++ b/.index.json @@ -1,11 +1,24 @@ { "appsec-configs": { + "crowdsecurity/appsec-bot-challenge-exclude-api": { + "author": "crowdsecurity", + "content": "bmFtZTogY3Jvd2RzZWN1cml0eS9hcHBzZWMtYm90LWNoYWxsZW5nZS1leGNsdWRlLWFwaQojIExldCBwcm9ncmFtbWF0aWMvQVBJIGVuZHBvaW50cyB0aHJvdWdoIHdpdGhvdXQgYSBjaGFsbGVuZ2U6IGl0IHdvdWxkIGJyZWFrIHdpdGggbGVnaXRpbWF0ZSBjbGllbnRzIAojIHRoYXQgY2Fubm90IHNvbHZlIHRoZSBjaGFsbGVuZ2UuCiMgRG8gbm90IGVkaXQgdGhpcyBmaWxlIHRvIGFkZCB5b3VyIG93biBleGNsdXNpb25zLCBjcmVhdGUgYSBjdXN0b20gY29uZmlnLgppbmJhbmQ6CiAgcHJlX2V2YWw6CiAgICAtIGZpbHRlcjogPi0KICAgICAgICByZXEuVVJMLlBhdGggaW4gWycvYXBpJywgJy9ncmFwaHFsJ10gfHwKICAgICAgICByZXEuVVJMLlBhdGggc3RhcnRzV2l0aCAnL2FwaS8nIHx8IHJlcS5VUkwuUGF0aCBzdGFydHNXaXRoICcvd3AtanNvbi8nIHx8CiAgICAgICAgcmVxLlVSTC5QYXRoIHN0YXJ0c1dpdGggJy9ncmFwaHFsLycgfHwgcmVxLlVSTC5QYXRoIHN0YXJ0c1dpdGggJy9yZXN0LycgfHwKICAgICAgICByZXEuVVJMLlBhdGggc3RhcnRzV2l0aCAnL3YxLycgfHwgcmVxLlVSTC5QYXRoIHN0YXJ0c1dpdGggJy92Mi8nIHx8CiAgICAgICAgcmVxLlVSTC5QYXRoIHN0YXJ0c1dpdGggJy9vYXV0aC8nIHx8IHJlcS5VUkwuUGF0aCBzdGFydHNXaXRoICcvLm5ldGxpZnkvZnVuY3Rpb25zLycgfHwKICAgICAgICByZXEuVVJMLlBhdGggc3RhcnRzV2l0aCAnL19uZXh0L2RhdGEvJwogICAgICBhcHBseToKICAgICAgICAtIEV4ZW1wdEZyb21DaGFsbGVuZ2UoKQo=", + "labels": null, + "path": "appsec-configs/crowdsecurity/appsec-bot-challenge-exclude-api.yaml", + "version": "0.1", + "versions": { + "0.1": { + "deprecated": false, + "digest": "197d83f7991eb04490a492c1a100bc0fa6efb0fb85f3ae107bad3d576fbe916e" + } + } + }, "crowdsecurity/appsec-bot-challenge-exclude-crawler-files": { "author": "crowdsecurity", - "content": "bmFtZTogY3Jvd2RzZWN1cml0eS9hcHBzZWMtYm90LWNoYWxsZW5nZS1leGNsdWRlLWNyYXdsZXItZmlsZXMKIyBMZXQgd2VsbC1rbm93biBjcmF3bGVyIGZpbGVzIGZseSB0aHJvdWdoIHdpdGhvdXQgYSBjaGFsbGVuZ2UuCmluYmFuZDoKICBwcmVfZXZhbDoKICAgIC0gZmlsdGVyOiA+LQogICAgICAgIHJlcS5VUkwuUGF0aCBpbiBbJy9yb2JvdHMudHh0JywgJy9hZHMudHh0JywgJy9hcHAtYWRzLnR4dCcsICcvc2l0ZW1hcC54bWwnLCAnL2FwcGxlLWFwcC1zaXRlLWFzc29jaWF0aW9uJywgJy9zZWN1cml0eS50eHQnLCAnL2h1bWFucy50eHQnXSB8fAogICAgICAgIHJlcS5VUkwuUGF0aCBzdGFydHNXaXRoICcvLndlbGwta25vd24vJwogICAgICBhcHBseToKICAgICAgICAtIEV4ZW1wdEZyb21DaGFsbGVuZ2UoKQo=", + "content": "bmFtZTogY3Jvd2RzZWN1cml0eS9hcHBzZWMtYm90LWNoYWxsZW5nZS1leGNsdWRlLWNyYXdsZXItZmlsZXMKIyBMZXQgd2VsbC1rbm93biBjcmF3bGVyIGZpbGVzIGZseSB0aHJvdWdoIHdpdGhvdXQgYSBjaGFsbGVuZ2UuCiMgRG8gbm90IGVkaXQgdGhpcyBmaWxlIHRvIGFkZCB5b3VyIG93biBleGNsdXNpb25zLCBjcmVhdGUgYSBjdXN0b20gY29uZmlnLgppbmJhbmQ6CiAgcHJlX2V2YWw6CiAgICAtIGZpbHRlcjogPi0KICAgICAgICByZXEuVVJMLlBhdGggaW4gWycvcm9ib3RzLnR4dCcsICcvYWRzLnR4dCcsICcvYXBwLWFkcy50eHQnLCAnL3NpdGVtYXAueG1sJywgJy9hcHBsZS1hcHAtc2l0ZS1hc3NvY2lhdGlvbicsICcvc2VjdXJpdHkudHh0JywgJy9odW1hbnMudHh0J10gfHwKICAgICAgICByZXEuVVJMLlBhdGggc3RhcnRzV2l0aCAnLy53ZWxsLWtub3duLycKICAgICAgYXBwbHk6CiAgICAgICAgLSBFeGVtcHRGcm9tQ2hhbGxlbmdlKCkK", "labels": null, "path": "appsec-configs/crowdsecurity/appsec-bot-challenge-exclude-crawler-files.yaml", - "version": "0.2", + "version": "0.3", "versions": { "0.1": { "deprecated": false, @@ -14,15 +27,19 @@ "0.2": { "deprecated": false, "digest": "55d2690765beb9e9c805dce648dc2e1ba5d9e13e0cb44541877d16cce092f836" + }, + "0.3": { + "deprecated": false, + "digest": "2141075edbc3fa56f5f9daa2dd4026d4707c79ac9feb6cd5bb42c5ca0f0794d5" } } }, "crowdsecurity/appsec-bot-challenge-exclude-feeds": { "author": "crowdsecurity", - "content": "bmFtZTogY3Jvd2RzZWN1cml0eS9hcHBzZWMtYm90LWNoYWxsZW5nZS1leGNsdWRlLWZlZWRzCiMgTGV0IHN5bmRpY2F0aW9uIGZlZWQgZW5kcG9pbnRzIGZseSB0aHJvdWdoIHdpdGhvdXQgYSBjaGFsbGVuZ2UuCmluYmFuZDoKICBwcmVfZXZhbDoKICAgICMgRXhhY3QgZmVlZCBmaWxlbmFtZXMgYXJlIHNhZmUgdG8gZXhlbXB0OyB0aGUgcHJlLWV4aXN0aW5nICcvZmVlZC8nIGFuZCAnL3Jzcy8nIHByZWZpeGVzIGFyZSBrZXB0CiAgICAjIGJ1dCBub3QgYnJvYWRlbmVkIOKAlCBhIHByZWZpeCBleGVtcHRpb24gd291bGQgdHVybiBhIHdob2xlIG5hbWVzcGFjZSBpbnRvIGNoYWxsZW5nZS1mcmVlIHN1cmZhY2UuCiAgICAtIGZpbHRlcjogPi0KICAgICAgICByZXEuVVJMLlBhdGggaW4gWycvZmVlZCcsICcvcnNzJywgJy9hdG9tLnhtbCcsICcvZmVlZC54bWwnLCAnL3Jzcy54bWwnLCAnL2luZGV4LnhtbCcsICcvZmVlZC5hdG9tJ10gfHwKICAgICAgICByZXEuVVJMLlBhdGggc3RhcnRzV2l0aCAnL2ZlZWQvJyB8fCByZXEuVVJMLlBhdGggc3RhcnRzV2l0aCAnL3Jzcy8nCiAgICAgIGFwcGx5OgogICAgICAgIC0gRXhlbXB0RnJvbUNoYWxsZW5nZSgpCg==", + "content": "bmFtZTogY3Jvd2RzZWN1cml0eS9hcHBzZWMtYm90LWNoYWxsZW5nZS1leGNsdWRlLWZlZWRzCiMgTGV0IHN5bmRpY2F0aW9uIGZlZWQgZW5kcG9pbnRzIGZseSB0aHJvdWdoIHdpdGhvdXQgYSBjaGFsbGVuZ2UuCiMgRG8gbm90IGVkaXQgdGhpcyBmaWxlIHRvIGFkZCB5b3VyIG93biBleGNsdXNpb25zLCBjcmVhdGUgYSBjdXN0b20gY29uZmlnLgppbmJhbmQ6CiAgcHJlX2V2YWw6CiAgICAtIGZpbHRlcjogPi0KICAgICAgICByZXEuVVJMLlBhdGggaW4gWycvZmVlZCcsICcvcnNzJywgJy9hdG9tLnhtbCcsICcvZmVlZC54bWwnLCAnL3Jzcy54bWwnLCAnL2luZGV4LnhtbCcsICcvZmVlZC5hdG9tJ10gfHwKICAgICAgICByZXEuVVJMLlBhdGggc3RhcnRzV2l0aCAnL2ZlZWQvJyB8fCByZXEuVVJMLlBhdGggc3RhcnRzV2l0aCAnL3Jzcy8nCiAgICAgIGFwcGx5OgogICAgICAgIC0gRXhlbXB0RnJvbUNoYWxsZW5nZSgpCg==", "labels": null, "path": "appsec-configs/crowdsecurity/appsec-bot-challenge-exclude-feeds.yaml", - "version": "0.2", + "version": "0.3", "versions": { "0.1": { "deprecated": false, @@ -31,15 +48,32 @@ "0.2": { "deprecated": false, "digest": "f00fb52eefbc55a6468c0f016efcbd742139ddcdfeb93d7c7ab737fceb22f8b5" + }, + "0.3": { + "deprecated": false, + "digest": "b1d32602201d25e4e58b29d5769dd7238f28848bf35eec5a8ee7df34060b42ac" + } + } + }, + "crowdsecurity/appsec-bot-challenge-exclude-static": { + "author": "crowdsecurity", + "content": "bmFtZTogY3Jvd2RzZWN1cml0eS9hcHBzZWMtYm90LWNoYWxsZW5nZS1leGNsdWRlLXN0YXRpYwojIExldCBzdGF0aWMgYXNzZXRzIGFuZCBicm93c2VyIG1ldGFkYXRhIGZpbGVzIGZseSB0aHJvdWdoIHdpdGhvdXQgYSBjaGFsbGVuZ2UKIyBEbyBub3QgZWRpdCB0aGlzIGZpbGUgdG8gYWRkIHlvdXIgb3duIGV4Y2x1c2lvbnMsIGNyZWF0ZSBhIGN1c3RvbSBjb25maWcuCmluYmFuZDoKICBwcmVfZXZhbDoKICAgIC0gZmlsdGVyOiA+LQogICAgICAgIHJlcS5VUkwuUGF0aCBtYXRjaGVzICcoP2kpXC4oY3NzfGpzfG1qc3xtYXB8cG5nfGpwZT9nfGdpZnxzdmd8d2VicHxhdmlmfGljb3xibXB8d29mZjI/fHR0ZnxvdGZ8ZW90fG1wNHxtNHZ8d2VibXxtb3Z8bXAzfG00YXx3YXZ8b2dnfG9nYXxvZ3Z8ZmxhY3xhYWN8d2VibWFuaWZlc3QpJCcgfHwKICAgICAgICByZXEuVVJMLlBhdGggaW4gWycvbWFuaWZlc3QuanNvbicsICcvYnJvd3NlcmNvbmZpZy54bWwnXQogICAgICBhcHBseToKICAgICAgICAtIEV4ZW1wdEZyb21DaGFsbGVuZ2UoKQo=", + "labels": null, + "path": "appsec-configs/crowdsecurity/appsec-bot-challenge-exclude-static.yaml", + "version": "0.1", + "versions": { + "0.1": { + "deprecated": false, + "digest": "5fec907bb30a247b55bc11e547bc967f37369957e060895c3e9a2f20e71b1867" } } }, "crowdsecurity/appsec-bot-challenge-exclude-webhooks": { "author": "crowdsecurity", - "content": "bmFtZTogY3Jvd2RzZWN1cml0eS9hcHBzZWMtYm90LWNoYWxsZW5nZS1leGNsdWRlLXdlYmhvb2tzCiMgTGV0IHRoaXJkLXBhcnR5IHdlYmhvb2sgY2FsbGJhY2tzIGZseSB0aHJvdWdoIHdpdGhvdXQgYSBjaGFsbGVuZ2UuCmluYmFuZDoKICBwcmVfZXZhbDoKICAgIC0gZmlsdGVyOiAicmVxLlVSTC5QYXRoIHN0YXJ0c1dpdGggJy93ZWJob29rcy8nIgogICAgICBhcHBseToKICAgICAgICAtIEV4ZW1wdEZyb21DaGFsbGVuZ2UoKQo=", + "content": "bmFtZTogY3Jvd2RzZWN1cml0eS9hcHBzZWMtYm90LWNoYWxsZW5nZS1leGNsdWRlLXdlYmhvb2tzCiMgTGV0IHRoaXJkLXBhcnR5IHdlYmhvb2sgY2FsbGJhY2tzIGZseSB0aHJvdWdoIHdpdGhvdXQgYSBjaGFsbGVuZ2UuCiMgRG8gbm90IGVkaXQgdGhpcyBmaWxlIHRvIGFkZCB5b3VyIG93biBleGNsdXNpb25zLCBjcmVhdGUgYSBjdXN0b20gY29uZmlnLgppbmJhbmQ6CiAgcHJlX2V2YWw6CiAgICAtIGZpbHRlcjogInJlcS5VUkwuUGF0aCBzdGFydHNXaXRoICcvd2ViaG9va3MvJyIKICAgICAgYXBwbHk6CiAgICAgICAgLSBFeGVtcHRGcm9tQ2hhbGxlbmdlKCkK", "labels": null, "path": "appsec-configs/crowdsecurity/appsec-bot-challenge-exclude-webhooks.yaml", - "version": "0.2", + "version": "0.3", "versions": { "0.1": { "deprecated": false, @@ -48,19 +82,27 @@ "0.2": { "deprecated": false, "digest": "c44f5e91e2aacd0c98d88697ea520485d4f5e3b9e9f699ab4df5c7ce9f2bca15" + }, + "0.3": { + "deprecated": false, + "digest": "02d6640898ab358d1b8c53ced8db57071f0f6a735c9a2983093a46a508befeb7" } } }, "crowdsecurity/appsec-bot-challenge-simple": { "author": "crowdsecurity", - "content": "bmFtZTogY3Jvd2RzZWN1cml0eS9hcHBzZWMtYm90LWNoYWxsZW5nZS1zaW1wbGUKaW5iYW5kOgogIHBvc3RfZXZhbDoKICAgICMgU2tpcCB0aGUgY2hhbGxlbmdlIGZvciB2ZXJpZmllZCBnb29kIGJvdHMgKGZvcndhcmQtY29uZmlybWVkIHJETlMpIGFuZCBmb3IgcmVxdWVzdHMgYQogICAgIyB3ZWxsLWtub3duLXBhdGggZXhjbHVzaW9uIGNvbmZpZyBmbGFnZ2VkIHZpYSBFeGVtcHRGcm9tQ2hhbGxlbmdlKCkuIFRoZSBmbGFnIGlzIHBlci1yZXF1ZXN0IG9ubHkuCiAgICAtIGZpbHRlcjogIiFJc0xlZ2l0aW1hdGVCb3QocmVxLlJlbW90ZUFkZHIsIHJlcS5Vc2VyQWdlbnQoKSwgcmVxLlVSTC5QYXRoKSIKICAgICAgYXBwbHk6CiAgICAgICAgLSBTZW5kQ2hhbGxlbmdlKCkKICBvbl9jaGFsbGVuZ2Vfc3VibWl0OgogICAgIyBSZWplY3Qgc3VibWlzc2lvbnMgd2hvc2UgZmluZ2VycHJpbnQgZmFzdC1kZXRlY3QgZmxhZ3MgYSBrbm93biBib3QuIFRoZSByZXN1bHRpbmcgInJlamVjdGVkIgogICAgIyBldmVudCBmZWVkcyBjcm93ZHNlY3VyaXR5L2FwcHNlYy1ib3QtZGV0ZWN0ZWQgKGFsZXJ0IG9ubHksIG5vIGFjdGl2ZSBiYW4pLgogICAgLSBmaWx0ZXI6ICJmaW5nZXJwcmludC5Jc0JvdCgpIgogICAgICBhcHBseToKICAgICAgICAtIFJlamVjdFN1Ym1pc3Npb24oImtub3duIGJvdCAoZmFzdCBib3QgZGV0ZWN0aW9uKSIpCg==", + "content": "bmFtZTogY3Jvd2RzZWN1cml0eS9hcHBzZWMtYm90LWNoYWxsZW5nZS1zaW1wbGUKaW5iYW5kOgogIHBvc3RfZXZhbDoKICAgICMgU2tpcCB0aGUgY2hhbGxlbmdlIGZvciB2ZXJpZmllZCBnb29kIGJvdHMgYW5kIGZvciByZXF1ZXN0cyBhCiAgICAjIHdlbGwta25vd24tcGF0aCBleGNsdXNpb24gY29uZmlnIGZsYWdnZWQgdmlhIEV4ZW1wdEZyb21DaGFsbGVuZ2UoKS4KICAgIC0gZmlsdGVyOiAiIUlzTGVnaXRpbWF0ZUJvdChyZXEuUmVtb3RlQWRkciwgcmVxLlVzZXJBZ2VudCgpLCByZXEuVVJMLlBhdGgpIgogICAgICBhcHBseToKICAgICAgICAtIFNlbmRDaGFsbGVuZ2UoKQogIG9uX2NoYWxsZW5nZV9zdWJtaXQ6CiAgICAjIFJlamVjdCBzdWJtaXNzaW9ucyB3aG9zZSBmaW5nZXJwcmludCBmYXN0LWRldGVjdCBmbGFncyBhIGtub3duIGJvdC4KICAgIC0gZmlsdGVyOiAiZmluZ2VycHJpbnQuSXNCb3QoKSIKICAgICAgYXBwbHk6CiAgICAgICAgLSBSZWplY3RTdWJtaXNzaW9uKCJrbm93biBib3QgKGZhc3QgYm90IGRldGVjdGlvbikiKQo=", "labels": null, "path": "appsec-configs/crowdsecurity/appsec-bot-challenge-simple.yaml", - "version": "0.1", + "version": "0.2", "versions": { "0.1": { "deprecated": false, "digest": "cd0e642e5fec65d59189e06c31b20c4b44f2d1009230ee3280e06a9ef451db09" + }, + "0.2": { + "deprecated": false, + "digest": "f6913f2f3244dc62e0f1a9a519038eac6d9300d3e3221aa5e8fdbd628e0c279d" } } }, @@ -185,53 +227,69 @@ "appsec-rules": { "crowdsecurity/appsec-bot-legit-ai-crawlers": { "author": "crowdsecurity", - "content": "bmFtZTogY3Jvd2RzZWN1cml0eS9hcHBzZWMtYm90LWxlZ2l0LWFpLWNyYXdsZXJzCgojIERlY2xhcmVzIHRoZSBsZWdpdGltYXRlIEFJLWNyYXdsZXIgZGF0YWZpbGVzIHNvIGNyb3dkc2VjIGRvd25sb2FkcyB0aGVtIGludG8KIyA8ZGF0YWRpcj4vbGVnaXRfYm90cy8uIFRoZXkgYXJlIGNvbnN1bWVkIGJ5IHRoZSBlbmdpbmUncyBJc0xlZ2l0aW1hdGVCb3QoKSBoZWxwZXIKIyAoc2VlIGNyb3dkc2VjdXJpdHkvYXBwc2VjLWJvdC1jaGFsbGVuZ2Utc2ltcGxlKSwgbm90IGJ5IHNlY2xhbmcgcnVsZXMuCgpkYXRhOgogIC0gc291cmNlX3VybDogaHR0cHM6Ly9odWItZGF0YS5jcm93ZHNlYy5uZXQvd2hpdGVsaXN0cy9iZW5pZ25fYm90cy9sZWdpdF9ib3RzL2dwdGJvdC5qc29uCiAgICBkZXN0X2ZpbGU6IGxlZ2l0X2JvdHMvZ3B0Ym90Lmpzb24KICAgIHR5cGU6IGJvdHMKICAtIHNvdXJjZV91cmw6IGh0dHBzOi8vaHViLWRhdGEuY3Jvd2RzZWMubmV0L3doaXRlbGlzdHMvYmVuaWduX2JvdHMvbGVnaXRfYm90cy9vcGVuYWktc2VhcmNoYm90Lmpzb24KICAgIGRlc3RfZmlsZTogbGVnaXRfYm90cy9vcGVuYWktc2VhcmNoYm90Lmpzb24KICAgIHR5cGU6IGJvdHMKICAtIHNvdXJjZV91cmw6IGh0dHBzOi8vaHViLWRhdGEuY3Jvd2RzZWMubmV0L3doaXRlbGlzdHMvYmVuaWduX2JvdHMvbGVnaXRfYm90cy9vcGVuYWktY2hhdGdwdC11c2VyLmpzb24KICAgIGRlc3RfZmlsZTogbGVnaXRfYm90cy9vcGVuYWktY2hhdGdwdC11c2VyLmpzb24KICAgIHR5cGU6IGJvdHMKICAtIHNvdXJjZV91cmw6IGh0dHBzOi8vaHViLWRhdGEuY3Jvd2RzZWMubmV0L3doaXRlbGlzdHMvYmVuaWduX2JvdHMvbGVnaXRfYm90cy9wZXJwbGV4aXR5Ym90Lmpzb24KICAgIGRlc3RfZmlsZTogbGVnaXRfYm90cy9wZXJwbGV4aXR5Ym90Lmpzb24KICAgIHR5cGU6IGJvdHMK", + "content": "bmFtZTogY3Jvd2RzZWN1cml0eS9hcHBzZWMtYm90LWxlZ2l0LWFpLWNyYXdsZXJzCgojIERlY2xhcmVzIHRoZSBsZWdpdGltYXRlIEFJLWNyYXdsZXIgZGF0YWZpbGVzIHNvIGNyb3dkc2VjIGRvd25sb2FkcyB0aGVtLgojIERvIG5vdCBlZGl0IHRoaXMgZmlsZSB0byBhZGQgeW91ciBvd24gZXhjbHVzaW9ucywgY3JlYXRlIGEgY3VzdG9tIGNvbmZpZy4KCmRhdGE6CiAgLSBzb3VyY2VfdXJsOiBodHRwczovL2h1Yi1kYXRhLmNyb3dkc2VjLm5ldC93aGl0ZWxpc3RzL2Jlbmlnbl9ib3RzL2xlZ2l0X2JvdHMvZ3B0Ym90Lmpzb24KICAgIGRlc3RfZmlsZTogbGVnaXRfYm90cy9ncHRib3QuanNvbgogICAgdHlwZTogYm90cwogIC0gc291cmNlX3VybDogaHR0cHM6Ly9odWItZGF0YS5jcm93ZHNlYy5uZXQvd2hpdGVsaXN0cy9iZW5pZ25fYm90cy9sZWdpdF9ib3RzL29wZW5haS1zZWFyY2hib3QuanNvbgogICAgZGVzdF9maWxlOiBsZWdpdF9ib3RzL29wZW5haS1zZWFyY2hib3QuanNvbgogICAgdHlwZTogYm90cwogIC0gc291cmNlX3VybDogaHR0cHM6Ly9odWItZGF0YS5jcm93ZHNlYy5uZXQvd2hpdGVsaXN0cy9iZW5pZ25fYm90cy9sZWdpdF9ib3RzL29wZW5haS1jaGF0Z3B0LXVzZXIuanNvbgogICAgZGVzdF9maWxlOiBsZWdpdF9ib3RzL29wZW5haS1jaGF0Z3B0LXVzZXIuanNvbgogICAgdHlwZTogYm90cwogIC0gc291cmNlX3VybDogaHR0cHM6Ly9odWItZGF0YS5jcm93ZHNlYy5uZXQvd2hpdGVsaXN0cy9iZW5pZ25fYm90cy9sZWdpdF9ib3RzL3BlcnBsZXhpdHlib3QuanNvbgogICAgZGVzdF9maWxlOiBsZWdpdF9ib3RzL3BlcnBsZXhpdHlib3QuanNvbgogICAgdHlwZTogYm90cwo=", "labels": null, "path": "appsec-rules/crowdsecurity/appsec-bot-legit-ai-crawlers.yaml", - "version": "0.1", + "version": "0.2", "versions": { "0.1": { "deprecated": false, "digest": "dee256dafa5c404651a5ae8e4b92931e145bca67ae6c6f2d991d371f96183c18" + }, + "0.2": { + "deprecated": false, + "digest": "179b1183274191e142abd72a7632a0fd5fd6c312f69a7db5ed00893be3282156" } } }, "crowdsecurity/appsec-bot-legit-monitoring": { "author": "crowdsecurity", - "content": "bmFtZTogY3Jvd2RzZWN1cml0eS9hcHBzZWMtYm90LWxlZ2l0LW1vbml0b3JpbmcKCiMgRGVjbGFyZXMgdGhlIGxlZ2l0aW1hdGUgdXB0aW1lL21vbml0b3JpbmcgZGF0YWZpbGVzIHNvIGNyb3dkc2VjIGRvd25sb2FkcyB0aGVtIGludG8KIyA8ZGF0YWRpcj4vbGVnaXRfYm90cy8uIFRoZXkgYXJlIGNvbnN1bWVkIGJ5IHRoZSBlbmdpbmUncyBJc0xlZ2l0aW1hdGVCb3QoKSBoZWxwZXIKIyAoc2VlIGNyb3dkc2VjdXJpdHkvYXBwc2VjLWJvdC1jaGFsbGVuZ2Utc2ltcGxlKSwgbm90IGJ5IHNlY2xhbmcgcnVsZXMuCgpkYXRhOgogIC0gc291cmNlX3VybDogaHR0cHM6Ly9odWItZGF0YS5jcm93ZHNlYy5uZXQvd2hpdGVsaXN0cy9iZW5pZ25fYm90cy9sZWdpdF9ib3RzL3VwdGltZXJvYm90Lmpzb24KICAgIGRlc3RfZmlsZTogbGVnaXRfYm90cy91cHRpbWVyb2JvdC5qc29uCiAgICB0eXBlOiBib3RzCiAgLSBzb3VyY2VfdXJsOiBodHRwczovL2h1Yi1kYXRhLmNyb3dkc2VjLm5ldC93aGl0ZWxpc3RzL2Jlbmlnbl9ib3RzL2xlZ2l0X2JvdHMvY29va2llYm90Lmpzb24KICAgIGRlc3RfZmlsZTogbGVnaXRfYm90cy9jb29raWVib3QuanNvbgogICAgdHlwZTogYm90cwo=", + "content": "bmFtZTogY3Jvd2RzZWN1cml0eS9hcHBzZWMtYm90LWxlZ2l0LW1vbml0b3JpbmcKCiMgRGVjbGFyZXMgdGhlIGxlZ2l0aW1hdGUgdXB0aW1lL21vbml0b3JpbmcgZGF0YWZpbGVzIHNvIGNyb3dkc2VjIGRvd25sb2FkcyB0aGVtCiMgRG8gbm90IGVkaXQgdGhpcyBmaWxlIHRvIGFkZCB5b3VyIG93biBleGNsdXNpb25zLCBjcmVhdGUgYSBjdXN0b20gY29uZmlnLgoKZGF0YToKICAtIHNvdXJjZV91cmw6IGh0dHBzOi8vaHViLWRhdGEuY3Jvd2RzZWMubmV0L3doaXRlbGlzdHMvYmVuaWduX2JvdHMvbGVnaXRfYm90cy91cHRpbWVyb2JvdC5qc29uCiAgICBkZXN0X2ZpbGU6IGxlZ2l0X2JvdHMvdXB0aW1lcm9ib3QuanNvbgogICAgdHlwZTogYm90cwogIC0gc291cmNlX3VybDogaHR0cHM6Ly9odWItZGF0YS5jcm93ZHNlYy5uZXQvd2hpdGVsaXN0cy9iZW5pZ25fYm90cy9sZWdpdF9ib3RzL2Nvb2tpZWJvdC5qc29uCiAgICBkZXN0X2ZpbGU6IGxlZ2l0X2JvdHMvY29va2llYm90Lmpzb24KICAgIHR5cGU6IGJvdHMK", "labels": null, "path": "appsec-rules/crowdsecurity/appsec-bot-legit-monitoring.yaml", - "version": "0.1", + "version": "0.2", "versions": { "0.1": { "deprecated": false, "digest": "e08498be5b24f43ee79dba7bfa3810cc7424737ac0d4930470a34a53754f4b9b" + }, + "0.2": { + "deprecated": false, + "digest": "c4ea8155feb02a9a622e88072637e6eaf1ec5fd404ecb2f46a271d1af1b70cd2" } } }, "crowdsecurity/appsec-bot-legit-search-engines": { "author": "crowdsecurity", - "content": "bmFtZTogY3Jvd2RzZWN1cml0eS9hcHBzZWMtYm90LWxlZ2l0LXNlYXJjaC1lbmdpbmVzCgojIERlY2xhcmVzIHRoZSBsZWdpdGltYXRlIHNlYXJjaC1lbmdpbmUgZGF0YWZpbGVzIHNvIGNyb3dkc2VjIGRvd25sb2FkcyB0aGVtIGludG8KIyA8ZGF0YWRpcj4vbGVnaXRfYm90cy8uIFRoZXkgYXJlIGNvbnN1bWVkIGJ5IHRoZSBlbmdpbmUncyBJc0xlZ2l0aW1hdGVCb3QoKSBoZWxwZXIKIyAoc2VlIGNyb3dkc2VjdXJpdHkvYXBwc2VjLWJvdC1jaGFsbGVuZ2Utc2ltcGxlKSwgbm90IGJ5IHNlY2xhbmcgcnVsZXMuCgpkYXRhOgogIC0gc291cmNlX3VybDogaHR0cHM6Ly9odWItZGF0YS5jcm93ZHNlYy5uZXQvd2hpdGVsaXN0cy9iZW5pZ25fYm90cy9sZWdpdF9ib3RzL2dvb2dsZWJvdC5qc29uCiAgICBkZXN0X2ZpbGU6IGxlZ2l0X2JvdHMvZ29vZ2xlYm90Lmpzb24KICAgIHR5cGU6IGJvdHMKICAtIHNvdXJjZV91cmw6IGh0dHBzOi8vaHViLWRhdGEuY3Jvd2RzZWMubmV0L3doaXRlbGlzdHMvYmVuaWduX2JvdHMvbGVnaXRfYm90cy9iaW5nYm90Lmpzb24KICAgIGRlc3RfZmlsZTogbGVnaXRfYm90cy9iaW5nYm90Lmpzb24KICAgIHR5cGU6IGJvdHMKICAtIHNvdXJjZV91cmw6IGh0dHBzOi8vaHViLWRhdGEuY3Jvd2RzZWMubmV0L3doaXRlbGlzdHMvYmVuaWduX2JvdHMvbGVnaXRfYm90cy9hcHBsZWJvdC5qc29uCiAgICBkZXN0X2ZpbGU6IGxlZ2l0X2JvdHMvYXBwbGVib3QuanNvbgogICAgdHlwZTogYm90cwogIC0gc291cmNlX3VybDogaHR0cHM6Ly9odWItZGF0YS5jcm93ZHNlYy5uZXQvd2hpdGVsaXN0cy9iZW5pZ25fYm90cy9sZWdpdF9ib3RzL2FtYXpvbmJvdC5qc29uCiAgICBkZXN0X2ZpbGU6IGxlZ2l0X2JvdHMvYW1hem9uYm90Lmpzb24KICAgIHR5cGU6IGJvdHMKICAtIHNvdXJjZV91cmw6IGh0dHBzOi8vaHViLWRhdGEuY3Jvd2RzZWMubmV0L3doaXRlbGlzdHMvYmVuaWduX2JvdHMvbGVnaXRfYm90cy95YW5kZXguanNvbgogICAgZGVzdF9maWxlOiBsZWdpdF9ib3RzL3lhbmRleC5qc29uCiAgICB0eXBlOiBib3RzCiAgLSBzb3VyY2VfdXJsOiBodHRwczovL2h1Yi1kYXRhLmNyb3dkc2VjLm5ldC93aGl0ZWxpc3RzL2Jlbmlnbl9ib3RzL2xlZ2l0X2JvdHMvYmFpZHUuanNvbgogICAgZGVzdF9maWxlOiBsZWdpdF9ib3RzL2JhaWR1Lmpzb24KICAgIHR5cGU6IGJvdHMKICAtIHNvdXJjZV91cmw6IGh0dHBzOi8vaHViLWRhdGEuY3Jvd2RzZWMubmV0L3doaXRlbGlzdHMvYmVuaWduX2JvdHMvbGVnaXRfYm90cy95YWhvby5qc29uCiAgICBkZXN0X2ZpbGU6IGxlZ2l0X2JvdHMveWFob28uanNvbgogICAgdHlwZTogYm90cwogIC0gc291cmNlX3VybDogaHR0cHM6Ly9odWItZGF0YS5jcm93ZHNlYy5uZXQvd2hpdGVsaXN0cy9iZW5pZ25fYm90cy9sZWdpdF9ib3RzL3NvZ291Lmpzb24KICAgIGRlc3RfZmlsZTogbGVnaXRfYm90cy9zb2dvdS5qc29uCiAgICB0eXBlOiBib3RzCiAgLSBzb3VyY2VfdXJsOiBodHRwczovL2h1Yi1kYXRhLmNyb3dkc2VjLm5ldC93aGl0ZWxpc3RzL2Jlbmlnbl9ib3RzL2xlZ2l0X2JvdHMvcXdhbnQuanNvbgogICAgZGVzdF9maWxlOiBsZWdpdF9ib3RzL3F3YW50Lmpzb24KICAgIHR5cGU6IGJvdHMKICAtIHNvdXJjZV91cmw6IGh0dHBzOi8vaHViLWRhdGEuY3Jvd2RzZWMubmV0L3doaXRlbGlzdHMvYmVuaWduX2JvdHMvbGVnaXRfYm90cy9iYWJiYXIuanNvbgogICAgZGVzdF9maWxlOiBsZWdpdF9ib3RzL2JhYmJhci5qc29uCiAgICB0eXBlOiBib3RzCiAgLSBzb3VyY2VfdXJsOiBodHRwczovL2h1Yi1kYXRhLmNyb3dkc2VjLm5ldC93aGl0ZWxpc3RzL2Jlbmlnbl9ib3RzL2xlZ2l0X2JvdHMvZHVja2R1Y2tib3QuanNvbgogICAgZGVzdF9maWxlOiBsZWdpdF9ib3RzL2R1Y2tkdWNrYm90Lmpzb24KICAgIHR5cGU6IGJvdHMK", + "content": "bmFtZTogY3Jvd2RzZWN1cml0eS9hcHBzZWMtYm90LWxlZ2l0LXNlYXJjaC1lbmdpbmVzCgojIERlY2xhcmVzIHRoZSBsZWdpdGltYXRlIHNlYXJjaC1lbmdpbmUgZGF0YWZpbGVzIHNvIGNyb3dkc2VjIGRvd25sb2FkcyB0aGVtCiMgRG8gbm90IGVkaXQgdGhpcyBmaWxlIHRvIGFkZCB5b3VyIG93biBleGNsdXNpb25zLCBjcmVhdGUgYSBjdXN0b20gY29uZmlnLgoKZGF0YToKICAtIHNvdXJjZV91cmw6IGh0dHBzOi8vaHViLWRhdGEuY3Jvd2RzZWMubmV0L3doaXRlbGlzdHMvYmVuaWduX2JvdHMvbGVnaXRfYm90cy9nb29nbGVib3QuanNvbgogICAgZGVzdF9maWxlOiBsZWdpdF9ib3RzL2dvb2dsZWJvdC5qc29uCiAgICB0eXBlOiBib3RzCiAgLSBzb3VyY2VfdXJsOiBodHRwczovL2h1Yi1kYXRhLmNyb3dkc2VjLm5ldC93aGl0ZWxpc3RzL2Jlbmlnbl9ib3RzL2xlZ2l0X2JvdHMvYmluZ2JvdC5qc29uCiAgICBkZXN0X2ZpbGU6IGxlZ2l0X2JvdHMvYmluZ2JvdC5qc29uCiAgICB0eXBlOiBib3RzCiAgLSBzb3VyY2VfdXJsOiBodHRwczovL2h1Yi1kYXRhLmNyb3dkc2VjLm5ldC93aGl0ZWxpc3RzL2Jlbmlnbl9ib3RzL2xlZ2l0X2JvdHMvYXBwbGVib3QuanNvbgogICAgZGVzdF9maWxlOiBsZWdpdF9ib3RzL2FwcGxlYm90Lmpzb24KICAgIHR5cGU6IGJvdHMKICAtIHNvdXJjZV91cmw6IGh0dHBzOi8vaHViLWRhdGEuY3Jvd2RzZWMubmV0L3doaXRlbGlzdHMvYmVuaWduX2JvdHMvbGVnaXRfYm90cy9hbWF6b25ib3QuanNvbgogICAgZGVzdF9maWxlOiBsZWdpdF9ib3RzL2FtYXpvbmJvdC5qc29uCiAgICB0eXBlOiBib3RzCiAgLSBzb3VyY2VfdXJsOiBodHRwczovL2h1Yi1kYXRhLmNyb3dkc2VjLm5ldC93aGl0ZWxpc3RzL2Jlbmlnbl9ib3RzL2xlZ2l0X2JvdHMveWFuZGV4Lmpzb24KICAgIGRlc3RfZmlsZTogbGVnaXRfYm90cy95YW5kZXguanNvbgogICAgdHlwZTogYm90cwogIC0gc291cmNlX3VybDogaHR0cHM6Ly9odWItZGF0YS5jcm93ZHNlYy5uZXQvd2hpdGVsaXN0cy9iZW5pZ25fYm90cy9sZWdpdF9ib3RzL2JhaWR1Lmpzb24KICAgIGRlc3RfZmlsZTogbGVnaXRfYm90cy9iYWlkdS5qc29uCiAgICB0eXBlOiBib3RzCiAgLSBzb3VyY2VfdXJsOiBodHRwczovL2h1Yi1kYXRhLmNyb3dkc2VjLm5ldC93aGl0ZWxpc3RzL2Jlbmlnbl9ib3RzL2xlZ2l0X2JvdHMveWFob28uanNvbgogICAgZGVzdF9maWxlOiBsZWdpdF9ib3RzL3lhaG9vLmpzb24KICAgIHR5cGU6IGJvdHMKICAtIHNvdXJjZV91cmw6IGh0dHBzOi8vaHViLWRhdGEuY3Jvd2RzZWMubmV0L3doaXRlbGlzdHMvYmVuaWduX2JvdHMvbGVnaXRfYm90cy9zb2dvdS5qc29uCiAgICBkZXN0X2ZpbGU6IGxlZ2l0X2JvdHMvc29nb3UuanNvbgogICAgdHlwZTogYm90cwogIC0gc291cmNlX3VybDogaHR0cHM6Ly9odWItZGF0YS5jcm93ZHNlYy5uZXQvd2hpdGVsaXN0cy9iZW5pZ25fYm90cy9sZWdpdF9ib3RzL3F3YW50Lmpzb24KICAgIGRlc3RfZmlsZTogbGVnaXRfYm90cy9xd2FudC5qc29uCiAgICB0eXBlOiBib3RzCiAgLSBzb3VyY2VfdXJsOiBodHRwczovL2h1Yi1kYXRhLmNyb3dkc2VjLm5ldC93aGl0ZWxpc3RzL2Jlbmlnbl9ib3RzL2xlZ2l0X2JvdHMvYmFiYmFyLmpzb24KICAgIGRlc3RfZmlsZTogbGVnaXRfYm90cy9iYWJiYXIuanNvbgogICAgdHlwZTogYm90cwogIC0gc291cmNlX3VybDogaHR0cHM6Ly9odWItZGF0YS5jcm93ZHNlYy5uZXQvd2hpdGVsaXN0cy9iZW5pZ25fYm90cy9sZWdpdF9ib3RzL2R1Y2tkdWNrYm90Lmpzb24KICAgIGRlc3RfZmlsZTogbGVnaXRfYm90cy9kdWNrZHVja2JvdC5qc29uCiAgICB0eXBlOiBib3RzCg==", "labels": null, "path": "appsec-rules/crowdsecurity/appsec-bot-legit-search-engines.yaml", - "version": "0.1", + "version": "0.2", "versions": { "0.1": { "deprecated": false, "digest": "fff7199c8e8a1e86460baf7e9cb251d1906b18103d41eaa7440ea476d9d5c0ed" + }, + "0.2": { + "deprecated": false, + "digest": "a32201657fb0a675f4ca089902def79a6b4cce641218a56ead2f124f6311298d" } } }, "crowdsecurity/appsec-bot-legit-social": { "author": "crowdsecurity", - "content": "bmFtZTogY3Jvd2RzZWN1cml0eS9hcHBzZWMtYm90LWxlZ2l0LXNvY2lhbAoKIyBEZWNsYXJlcyB0aGUgbGVnaXRpbWF0ZSBzb2NpYWwgLyBsaW5rLXByZXZpZXcgdW5mdXJsZXIgZGF0YWZpbGVzIHNvIGNyb3dkc2VjIGRvd25sb2FkcyB0aGVtCiMgaW50byA8ZGF0YWRpcj4vbGVnaXRfYm90cy8uIFRoZXkgYXJlIGNvbnN1bWVkIGJ5IHRoZSBlbmdpbmUncyBJc0xlZ2l0aW1hdGVCb3QoKSBoZWxwZXIKIyAoc2VlIGNyb3dkc2VjdXJpdHkvYXBwc2VjLWJvdC1jaGFsbGVuZ2Utc2ltcGxlKSwgbm90IGJ5IHNlY2xhbmcgcnVsZXMuCgpkYXRhOgogIC0gc291cmNlX3VybDogaHR0cHM6Ly9odWItZGF0YS5jcm93ZHNlYy5uZXQvd2hpdGVsaXN0cy9iZW5pZ25fYm90cy9sZWdpdF9ib3RzL21ldGEuanNvbgogICAgZGVzdF9maWxlOiBsZWdpdF9ib3RzL21ldGEuanNvbgogICAgdHlwZTogYm90cwogIC0gc291cmNlX3VybDogaHR0cHM6Ly9odWItZGF0YS5jcm93ZHNlYy5uZXQvd2hpdGVsaXN0cy9iZW5pZ25fYm90cy9sZWdpdF9ib3RzL2Rpc2NvcmQuanNvbgogICAgZGVzdF9maWxlOiBsZWdpdF9ib3RzL2Rpc2NvcmQuanNvbgogICAgdHlwZTogYm90cwogIC0gc291cmNlX3VybDogaHR0cHM6Ly9odWItZGF0YS5jcm93ZHNlYy5uZXQvd2hpdGVsaXN0cy9iZW5pZ25fYm90cy9sZWdpdF9ib3RzL3RlbGVncmFtLmpzb24KICAgIGRlc3RfZmlsZTogbGVnaXRfYm90cy90ZWxlZ3JhbS5qc29uCiAgICB0eXBlOiBib3RzCiAgLSBzb3VyY2VfdXJsOiBodHRwczovL2h1Yi1kYXRhLmNyb3dkc2VjLm5ldC93aGl0ZWxpc3RzL2Jlbmlnbl9ib3RzL2xlZ2l0X2JvdHMvdHdpdHRlcmJvdC5qc29uCiAgICBkZXN0X2ZpbGU6IGxlZ2l0X2JvdHMvdHdpdHRlcmJvdC5qc29uCiAgICB0eXBlOiBib3RzCiAgLSBzb3VyY2VfdXJsOiBodHRwczovL2h1Yi1kYXRhLmNyb3dkc2VjLm5ldC93aGl0ZWxpc3RzL2Jlbmlnbl9ib3RzL2xlZ2l0X2JvdHMvcGludGVyZXN0Lmpzb24KICAgIGRlc3RfZmlsZTogbGVnaXRfYm90cy9waW50ZXJlc3QuanNvbgogICAgdHlwZTogYm90cwo=", + "content": "bmFtZTogY3Jvd2RzZWN1cml0eS9hcHBzZWMtYm90LWxlZ2l0LXNvY2lhbAoKIyBEZWNsYXJlcyB0aGUgbGVnaXRpbWF0ZSBzb2NpYWwgLyBsaW5rLXByZXZpZXcgZGF0YWZpbGVzIHNvIGNyb3dkc2VjIGRvd25sb2FkcyB0aGVtCgpkYXRhOgogIC0gc291cmNlX3VybDogaHR0cHM6Ly9odWItZGF0YS5jcm93ZHNlYy5uZXQvd2hpdGVsaXN0cy9iZW5pZ25fYm90cy9sZWdpdF9ib3RzL21ldGEuanNvbgogICAgZGVzdF9maWxlOiBsZWdpdF9ib3RzL21ldGEuanNvbgogICAgdHlwZTogYm90cwogIC0gc291cmNlX3VybDogaHR0cHM6Ly9odWItZGF0YS5jcm93ZHNlYy5uZXQvd2hpdGVsaXN0cy9iZW5pZ25fYm90cy9sZWdpdF9ib3RzL2Rpc2NvcmQuanNvbgogICAgZGVzdF9maWxlOiBsZWdpdF9ib3RzL2Rpc2NvcmQuanNvbgogICAgdHlwZTogYm90cwogIC0gc291cmNlX3VybDogaHR0cHM6Ly9odWItZGF0YS5jcm93ZHNlYy5uZXQvd2hpdGVsaXN0cy9iZW5pZ25fYm90cy9sZWdpdF9ib3RzL3RlbGVncmFtLmpzb24KICAgIGRlc3RfZmlsZTogbGVnaXRfYm90cy90ZWxlZ3JhbS5qc29uCiAgICB0eXBlOiBib3RzCiAgLSBzb3VyY2VfdXJsOiBodHRwczovL2h1Yi1kYXRhLmNyb3dkc2VjLm5ldC93aGl0ZWxpc3RzL2Jlbmlnbl9ib3RzL2xlZ2l0X2JvdHMvdHdpdHRlcmJvdC5qc29uCiAgICBkZXN0X2ZpbGU6IGxlZ2l0X2JvdHMvdHdpdHRlcmJvdC5qc29uCiAgICB0eXBlOiBib3RzCiAgLSBzb3VyY2VfdXJsOiBodHRwczovL2h1Yi1kYXRhLmNyb3dkc2VjLm5ldC93aGl0ZWxpc3RzL2Jlbmlnbl9ib3RzL2xlZ2l0X2JvdHMvcGludGVyZXN0Lmpzb24KICAgIGRlc3RfZmlsZTogbGVnaXRfYm90cy9waW50ZXJlc3QuanNvbgogICAgdHlwZTogYm90cwo=", "labels": null, "path": "appsec-rules/crowdsecurity/appsec-bot-legit-social.yaml", - "version": "0.1", + "version": "0.2", "versions": { "0.1": { "deprecated": false, "digest": "7de6aab1a2cfcd0b3d1dc0d7b1eaa2ece6e2bd65488075d37f3cc9840ad33d65" + }, + "0.2": { + "deprecated": false, + "digest": "5e5787ee1cdb337ef7fa13bbb3f281e224d24b877879f53f7adae08045db02c3" } } }, @@ -7865,7 +7923,9 @@ "crowdsecurity/appsec-bot-challenge-simple", "crowdsecurity/appsec-bot-challenge-exclude-crawler-files", "crowdsecurity/appsec-bot-challenge-exclude-feeds", - "crowdsecurity/appsec-bot-challenge-exclude-webhooks" + "crowdsecurity/appsec-bot-challenge-exclude-webhooks", + "crowdsecurity/appsec-bot-challenge-exclude-static", + "crowdsecurity/appsec-bot-challenge-exclude-api" ], "appsec-rules": [ "crowdsecurity/appsec-bot-legit-search-engines", @@ -7874,7 +7934,7 @@ "crowdsecurity/appsec-bot-legit-monitoring" ], "author": "crowdsecurity", - "content": "bmFtZTogY3Jvd2RzZWN1cml0eS9hcHBzZWMtYm90LWNoYWxsZW5nZQpwYXJzZXJzOgogIC0gY3Jvd2RzZWN1cml0eS9hcHBzZWMtbG9ncwogIC0gY3Jvd2RzZWN1cml0eS9hcHBzZWMtYm90LWRldGVjdGlvbi1sb2dzCmFwcHNlYy1jb25maWdzOgogIC0gY3Jvd2RzZWN1cml0eS9hcHBzZWMtYm90LWNoYWxsZW5nZS1zaW1wbGUKICAtIGNyb3dkc2VjdXJpdHkvYXBwc2VjLWJvdC1jaGFsbGVuZ2UtZXhjbHVkZS1jcmF3bGVyLWZpbGVzCiAgLSBjcm93ZHNlY3VyaXR5L2FwcHNlYy1ib3QtY2hhbGxlbmdlLWV4Y2x1ZGUtZmVlZHMKICAtIGNyb3dkc2VjdXJpdHkvYXBwc2VjLWJvdC1jaGFsbGVuZ2UtZXhjbHVkZS13ZWJob29rcwphcHBzZWMtcnVsZXM6CiAgLSBjcm93ZHNlY3VyaXR5L2FwcHNlYy1ib3QtbGVnaXQtc2VhcmNoLWVuZ2luZXMKICAtIGNyb3dkc2VjdXJpdHkvYXBwc2VjLWJvdC1sZWdpdC1haS1jcmF3bGVycwogIC0gY3Jvd2RzZWN1cml0eS9hcHBzZWMtYm90LWxlZ2l0LXNvY2lhbAogIC0gY3Jvd2RzZWN1cml0eS9hcHBzZWMtYm90LWxlZ2l0LW1vbml0b3JpbmcKc2NlbmFyaW9zOgogIC0gY3Jvd2RzZWN1cml0eS9hcHBzZWMtYm90LWRldGVjdGVkCiAgLSBjcm93ZHNlY3VyaXR5L2FwcHNlYy1ib3QtY2hhbGxlbmdlLXRvby1tYW55LXJlcXVlc3RzCiAgLSBjcm93ZHNlY3VyaXR5L2FwcHNlYy1ib3QtY2hhbGxlbmdlLXRvby1tYW55LXN1Ym1pc3Npb25zCiAgLSBjcm93ZHNlY3VyaXR5L2FwcHNlYy1ib3QtY2hhbGxlbmdlLXJlcXVlc3Qtd2l0aC1uby1zdWJtaXNzaW9uCmNvbnRleHRzOgogIC0gY3Jvd2RzZWN1cml0eS9hcHBzZWNfYmFzZQogIC0gY3Jvd2RzZWN1cml0eS9hcHBzZWMtYm90LWRldGVjdGlvbgpkZXNjcmlwdGlvbjogIkFwcFNlYyBib3QgZGV0ZWN0aW9uOiBjaGFsbGVuZ2UgbW9kZSB3aXRoIGZhc3QtZGV0ZWN0IGJvdCByZWplY3Rpb24gYW5kIHdlbGwta25vd24tcGF0aCBleGNsdXNpb25zIgpsYWJlbHM6CiAgbGFiZWw6ICJXQUYgLSBCb3QgQ2hhbGxlbmdlIgphdXRob3I6IGNyb3dkc2VjdXJpdHkKdGFnczoKICAtIHdhZgogIC0gYXBwc2VjCiAgLSBodHRwCiAgLSBib3QK", + "content": "bmFtZTogY3Jvd2RzZWN1cml0eS9hcHBzZWMtYm90LWNoYWxsZW5nZQpwYXJzZXJzOgogIC0gY3Jvd2RzZWN1cml0eS9hcHBzZWMtbG9ncwogIC0gY3Jvd2RzZWN1cml0eS9hcHBzZWMtYm90LWRldGVjdGlvbi1sb2dzCmFwcHNlYy1jb25maWdzOgogIC0gY3Jvd2RzZWN1cml0eS9hcHBzZWMtYm90LWNoYWxsZW5nZS1zaW1wbGUKICAtIGNyb3dkc2VjdXJpdHkvYXBwc2VjLWJvdC1jaGFsbGVuZ2UtZXhjbHVkZS1jcmF3bGVyLWZpbGVzCiAgLSBjcm93ZHNlY3VyaXR5L2FwcHNlYy1ib3QtY2hhbGxlbmdlLWV4Y2x1ZGUtZmVlZHMKICAtIGNyb3dkc2VjdXJpdHkvYXBwc2VjLWJvdC1jaGFsbGVuZ2UtZXhjbHVkZS13ZWJob29rcwogIC0gY3Jvd2RzZWN1cml0eS9hcHBzZWMtYm90LWNoYWxsZW5nZS1leGNsdWRlLXN0YXRpYwogIC0gY3Jvd2RzZWN1cml0eS9hcHBzZWMtYm90LWNoYWxsZW5nZS1leGNsdWRlLWFwaQphcHBzZWMtcnVsZXM6CiAgLSBjcm93ZHNlY3VyaXR5L2FwcHNlYy1ib3QtbGVnaXQtc2VhcmNoLWVuZ2luZXMKICAtIGNyb3dkc2VjdXJpdHkvYXBwc2VjLWJvdC1sZWdpdC1haS1jcmF3bGVycwogIC0gY3Jvd2RzZWN1cml0eS9hcHBzZWMtYm90LWxlZ2l0LXNvY2lhbAogIC0gY3Jvd2RzZWN1cml0eS9hcHBzZWMtYm90LWxlZ2l0LW1vbml0b3JpbmcKc2NlbmFyaW9zOgogIC0gY3Jvd2RzZWN1cml0eS9hcHBzZWMtYm90LWRldGVjdGVkCiAgLSBjcm93ZHNlY3VyaXR5L2FwcHNlYy1ib3QtY2hhbGxlbmdlLXRvby1tYW55LXJlcXVlc3RzCiAgLSBjcm93ZHNlY3VyaXR5L2FwcHNlYy1ib3QtY2hhbGxlbmdlLXRvby1tYW55LXN1Ym1pc3Npb25zCiAgLSBjcm93ZHNlY3VyaXR5L2FwcHNlYy1ib3QtY2hhbGxlbmdlLXJlcXVlc3Qtd2l0aC1uby1zdWJtaXNzaW9uCmNvbnRleHRzOgogIC0gY3Jvd2RzZWN1cml0eS9hcHBzZWNfYmFzZQogIC0gY3Jvd2RzZWN1cml0eS9hcHBzZWMtYm90LWRldGVjdGlvbgpkZXNjcmlwdGlvbjogIkFwcFNlYyBib3QgZGV0ZWN0aW9uOiBjaGFsbGVuZ2UgbW9kZSB3aXRoIGZhc3QtZGV0ZWN0IGJvdCByZWplY3Rpb24gYW5kIHdlbGwta25vd24tcGF0aCBleGNsdXNpb25zIgpsYWJlbHM6CiAgbGFiZWw6ICJXQUYgLSBCb3QgQ2hhbGxlbmdlIgphdXRob3I6IGNyb3dkc2VjdXJpdHkKdGFnczoKICAtIHdhZgogIC0gYXBwc2VjCiAgLSBodHRwCiAgLSBib3QK", "contexts": [ "crowdsecurity/appsec_base", "crowdsecurity/appsec-bot-detection" @@ -7883,7 +7943,7 @@ "labels": { "label": "WAF - Bot Challenge" }, - "long_description": "IyBBcHBTZWMgQm90IENoYWxsZW5nZQoKVGhpcyBjb2xsZWN0aW9uIGVuYWJsZXMgQ3Jvd2RTZWMgQXBwU2VjICoqY2hhbGxlbmdlIG1vZGUqKiBmb3IgYm90IGRldGVjdGlvbjogdmlzaXRvcnMgYXJlIHNlcnZlZCBhCmxpZ2h0d2VpZ2h0IHByb29mLW9mLXdvcmsgKyBicm93c2VyLWZpbmdlcnByaW50IGNoYWxsZW5nZSwgYW5kIGNsaWVudHMgZmxhZ2dlZCBhcyBrbm93biBib3RzIGJ5IHRoZQpmYXN0IGJvdCBkZXRlY3Rpb24gYXJlIHJlamVjdGVkLgoKV2hhdCBpdCBzaGlwczoKCiAtIGBjcm93ZHNlY3VyaXR5L2FwcHNlYy1ib3QtY2hhbGxlbmdlLXNpbXBsZWA6IGNoYWxsZW5nZXMgaW5jb21pbmcgcmVxdWVzdHMsIHNraXBzIHZlcmlmaWVkIGdvb2QgYm90cwogICAoZm9yd2FyZC1jb25maXJtZWQgckROUyksIGFuZCByZWplY3RzIGNoYWxsZW5nZSBzdWJtaXNzaW9ucyB3aG9zZSBmaW5nZXJwcmludCB0cmlwcyB0aGUgZmFzdCBib3QKICAgZGV0ZWN0aW9uLgogLSBWZXJpZmllZC1nb29kLWJvdCBkYXRhZmlsZXMgdGhhdCBiYWNrIHRoZSBleGNsdXNpb24gYWJvdmUsIHNwbGl0IGJ5IGZhbWlseSBzbyB5b3UgY2FuIGVuYWJsZSBvbmx5IHRoZQogICBvbmVzIHlvdSBuZWVkOgogICAtIGBjcm93ZHNlY3VyaXR5L2FwcHNlYy1ib3QtbGVnaXQtc2VhcmNoLWVuZ2luZXNgOiBnb29nbGVib3QsIGJpbmdib3QsIGFwcGxlYm90LCBhbWF6b25ib3QsIHlhbmRleCwKICAgICBiYWlkdSwgeWFob28sIHNvZ291LCBxd2FudCwgYmFiYmFyLCBkdWNrZHVja2JvdAogICAtIGBjcm93ZHNlY3VyaXR5L2FwcHNlYy1ib3QtbGVnaXQtYWktY3Jhd2xlcnNgOiBncHRib3QsIG9wZW5haS1zZWFyY2hib3QsIG9wZW5haS1jaGF0Z3B0LXVzZXIsCiAgICAgcGVycGxleGl0eWJvdAogICAtIGBjcm93ZHNlY3VyaXR5L2FwcHNlYy1ib3QtbGVnaXQtc29jaWFsYDogbWV0YSwgZGlzY29yZCwgdGVsZWdyYW0sIHR3aXR0ZXJib3QsIHBpbnRlcmVzdAogICAtIGBjcm93ZHNlY3VyaXR5L2FwcHNlYy1ib3QtbGVnaXQtbW9uaXRvcmluZ2A6IHVwdGltZXJvYm90LCBjb29raWVib3QKCiAgIEEgYm90IGlzIGV4ZW1wdGVkICoqb25seSoqIHdoZW4gaXQgY2FuIGJlIG5ldHdvcmstdmVyaWZpZWQg4oCUIGZvcndhcmQtY29uZmlybWVkIHJETlMgb3IgYSBwdWJsaXNoZWQgSVAKICAgcmFuZ2UuIFVzZXItQWdlbnQtb25seSBib3RzIChlLmcuIENvbW1vbkNyYXdsL0NDQm90KSBhcmUgaW50ZW50aW9uYWxseSBsZWZ0IGNoYWxsZW5nZWQsIHNpbmNlIGEKICAgc3Bvb2ZlZCBVc2VyLUFnZW50IG11c3Qgbm90IGJ5cGFzcyB0aGUgY2hhbGxlbmdlLgogLSBXZWxsLWtub3duLXBhdGggZXhjbHVzaW9uIGNvbmZpZ3MgKGBhcHBzZWMtYm90LWNoYWxsZW5nZS1leGNsdWRlLWNyYXdsZXItZmlsZXNgLCBgLWZlZWRzYCwgYC13ZWJob29rc2ApIHRoYXQKICAgbGV0IG1hY2hpbmUtZmFjaW5nIGVuZHBvaW50cyAoYC9yb2JvdHMudHh0YCwgYC8ud2VsbC1rbm93bi8qYCwgZmVlZHMsIHdlYmhvb2tzKSB0aHJvdWdoIHdpdGhvdXQgYQogICBjaGFsbGVuZ2UuIFRoZSBleGNsdXNpb24gaXMgc3RyaWN0bHkgcGVyLXJlcXVlc3QgYW5kIGlzIG5ldmVyIHBlcnNpc3RlZCB0byBhIGNvb2tpZSBvciBhY3Jvc3MKICAgcmVxdWVzdHMsIHNvIGl0IGNhbm5vdCBiZSBhYnVzZWQgdG8gd2hpdGVsaXN0IGEgc2Vzc2lvbiBmb3Igb3RoZXIgcGF0aHMuCiAtIEEgZGVkaWNhdGVkIGJvdC1kZXRlY3Rpb24gcGFyc2VyIHRyYWNraW5nIHRoZSBmaW5nZXJwcmludCBzZXNzaW9uIGlkIChgZnNpZGApIGFuZCBPUy4KIC0gU2NlbmFyaW9zIHRoYXQgYWxlcnQgb24gZGV0ZWN0ZWQgYm90cyBhbmQgb24gY2hhbGxlbmdlIGFidXNlLgogLSBBIHVzZXItZnJpZW5kbHkgYWxlcnQgY29udGV4dCBleHBvc2luZyBgZnNpZGAsIE9TLCBhbmQgdGhlIGJvdCBzaWduYWxzIHRoYXQgZmlyZWQuCgojIyBFbmFibGluZyBib3QgY2hhbGxlbmdlCgpBZGQgdGhlIGBjcm93ZHNlY3VyaXR5L2FwcHNlYy1ib3QtY2hhbGxlbmdlLXNpbXBsZWAgYXBwc2VjLWNvbmZpZyB0byB5b3VyIFdBRiBhY3F1aXNpdGlvbiwgcGx1cyBhbnkgb2YgdGhlCndlbGwta25vd24tcGF0aCBleGNsdXNpb24gY29uZmlncyB5b3UgbmVlZDoKCmBgYHlhbWwKYXBwc2VjX2NvbmZpZ3M6CiAtIGNyb3dkc2VjdXJpdHkvYXBwc2VjLWJvdC1jaGFsbGVuZ2Utc2ltcGxlCiAtIGNyb3dkc2VjdXJpdHkvYXBwc2VjLWJvdC1jaGFsbGVuZ2UtZXhjbHVkZS1jcmF3bGVyLWZpbGVzCiAtIGNyb3dkc2VjdXJpdHkvYXBwc2VjLWJvdC1jaGFsbGVuZ2UtZXhjbHVkZS1mZWVkcwogLSBjcm93ZHNlY3VyaXR5L2FwcHNlYy1ib3QtY2hhbGxlbmdlLWV4Y2x1ZGUtd2ViaG9va3MKbGFiZWxzOgogIHR5cGU6IGFwcHNlYwpsaXN0ZW5fYWRkcjogMTI3LjAuMC4xOjc0MjIKc291cmNlOiBhcHBzZWMKYGBgCg==", + "long_description": "IyBBcHBTZWMgQm90IENoYWxsZW5nZQoKVGhpcyBjb2xsZWN0aW9uIGVuYWJsZXMgQ3Jvd2RTZWMgQXBwU2VjICoqY2hhbGxlbmdlIG1vZGUqKiBmb3IgYm90IGRldGVjdGlvbjogdmlzaXRvcnMgYXJlIHNlcnZlZCBhCmxpZ2h0d2VpZ2h0IHByb29mLW9mLXdvcmsgKyBicm93c2VyLWZpbmdlcnByaW50IGNoYWxsZW5nZSwgYW5kIGNsaWVudHMgZmxhZ2dlZCBhcyBrbm93biBib3RzIGJ5IHRoZQpmYXN0IGJvdCBkZXRlY3Rpb24gYXJlIHJlamVjdGVkLgoKV2hhdCBpdCBzaGlwczoKCiAtIGBjcm93ZHNlY3VyaXR5L2FwcHNlYy1ib3QtY2hhbGxlbmdlLXNpbXBsZWA6IGNoYWxsZW5nZXMgaW5jb21pbmcgcmVxdWVzdHMsIHNraXBzIHZlcmlmaWVkIGdvb2QgYm90cwogICAoZm9yd2FyZC1jb25maXJtZWQgckROUyksIGFuZCByZWplY3RzIGNoYWxsZW5nZSBzdWJtaXNzaW9ucyB3aG9zZSBmaW5nZXJwcmludCB0cmlwcyB0aGUgZmFzdCBib3QKICAgZGV0ZWN0aW9uLgogLSBWZXJpZmllZC1nb29kLWJvdCBkYXRhZmlsZXMgdGhhdCBiYWNrIHRoZSBleGNsdXNpb24gYWJvdmUsIHNwbGl0IGJ5IGZhbWlseSBzbyB5b3UgY2FuIGVuYWJsZSBvbmx5IHRoZQogICBvbmVzIHlvdSBuZWVkOgogICAtIGBjcm93ZHNlY3VyaXR5L2FwcHNlYy1ib3QtbGVnaXQtc2VhcmNoLWVuZ2luZXNgOiBnb29nbGVib3QsIGJpbmdib3QsIGFwcGxlYm90LCBhbWF6b25ib3QsIHlhbmRleCwKICAgICBiYWlkdSwgeWFob28sIHNvZ291LCBxd2FudCwgYmFiYmFyLCBkdWNrZHVja2JvdAogICAtIGBjcm93ZHNlY3VyaXR5L2FwcHNlYy1ib3QtbGVnaXQtYWktY3Jhd2xlcnNgOiBncHRib3QsIG9wZW5haS1zZWFyY2hib3QsIG9wZW5haS1jaGF0Z3B0LXVzZXIsCiAgICAgcGVycGxleGl0eWJvdAogICAtIGBjcm93ZHNlY3VyaXR5L2FwcHNlYy1ib3QtbGVnaXQtc29jaWFsYDogbWV0YSwgZGlzY29yZCwgdGVsZWdyYW0sIHR3aXR0ZXJib3QsIHBpbnRlcmVzdAogICAtIGBjcm93ZHNlY3VyaXR5L2FwcHNlYy1ib3QtbGVnaXQtbW9uaXRvcmluZ2A6IHVwdGltZXJvYm90LCBjb29raWVib3QKCiAgIEEgYm90IGlzIGV4ZW1wdGVkICoqb25seSoqIHdoZW4gaXQgY2FuIGJlIG5ldHdvcmstdmVyaWZpZWQg4oCUIGZvcndhcmQtY29uZmlybWVkIHJETlMgb3IgYSBwdWJsaXNoZWQgSVAKICAgcmFuZ2UuIFVzZXItQWdlbnQtb25seSBib3RzIChlLmcuIENvbW1vbkNyYXdsL0NDQm90KSBhcmUgaW50ZW50aW9uYWxseSBsZWZ0IGNoYWxsZW5nZWQsIHNpbmNlIGEKICAgc3Bvb2ZlZCBVc2VyLUFnZW50IG11c3Qgbm90IGJ5cGFzcyB0aGUgY2hhbGxlbmdlLgogLSBQYXRoIGV4Y2x1c2lvbiBjb25maWdzIHRoYXQgbGV0IG1hY2hpbmUtZmFjaW5nIG9yIG5vbi1uYXZpZ2F0aW9uYWwgcmVxdWVzdHMgdGhyb3VnaCB3aXRob3V0IGEKICAgY2hhbGxlbmdlOgogICAtIGBhcHBzZWMtYm90LWNoYWxsZW5nZS1leGNsdWRlLWNyYXdsZXItZmlsZXNgIOKAlCBgL3JvYm90cy50eHRgLCBgLy53ZWxsLWtub3duLypgLCBgL3NlY3VyaXR5LnR4dGAsIOKApgogICAtIGBhcHBzZWMtYm90LWNoYWxsZW5nZS1leGNsdWRlLWZlZWRzYCDigJQgUlNTL0F0b20gZmVlZCBwYXRocwogICAtIGBhcHBzZWMtYm90LWNoYWxsZW5nZS1leGNsdWRlLXdlYmhvb2tzYCDigJQgdGhpcmQtcGFydHkgd2ViaG9vayBwYXRocwogICAtIGBhcHBzZWMtYm90LWNoYWxsZW5nZS1leGNsdWRlLXN0YXRpY2Ag4oCUIHN0YXRpYyBhc3NldHMgYW5kIG1lZGlhIChjc3MsIGpzLCBpbWFnZXMsIGZvbnRzLAogICAgIGF1ZGlvL3ZpZGVvLCBzb3VyY2VtYXBzKTsgYSBjaGFsbGVuZ2UgcGFnZSByZXR1cm5lZCBmb3IgYSBzdWJyZXNvdXJjZSB3b3VsZCBicmVhayBwYWdlIHJlbmRlcmluZwogICAtIGBhcHBzZWMtYm90LWNoYWxsZW5nZS1leGNsdWRlLWFwaWAg4oCUIHByb2dyYW1tYXRpYyBlbmRwb2ludHMKCiAgIFRoZSBleGNsdXNpb24gaXMgc3RyaWN0bHkgcGVyLXJlcXVlc3QgYW5kIGlzIG5ldmVyIHBlcnNpc3RlZCB0byBhIGNvb2tpZSBvciBhY3Jvc3MgcmVxdWVzdHMsIHNvIGl0CiAgIGNhbm5vdCBiZSBhYnVzZWQgdG8gd2hpdGVsaXN0IGEgc2Vzc2lvbiBmb3Igb3RoZXIgcGF0aHMuCiAtIEEgZGVkaWNhdGVkIGJvdC1kZXRlY3Rpb24gcGFyc2VyIHRyYWNraW5nIHRoZSBmaW5nZXJwcmludCBzZXNzaW9uIGlkIChgZnNpZGApIGFuZCBPUy4KIC0gU2NlbmFyaW9zIHRoYXQgYWxlcnQgb24gZGV0ZWN0ZWQgYm90cyBhbmQgb24gY2hhbGxlbmdlIGFidXNlLgogLSBBIHVzZXItZnJpZW5kbHkgYWxlcnQgY29udGV4dCBleHBvc2luZyBgZnNpZGAsIE9TLCBhbmQgdGhlIGJvdCBzaWduYWxzIHRoYXQgZmlyZWQuCgojIyBFbmFibGluZyBib3QgY2hhbGxlbmdlCgpBZGQgdGhlIGBjcm93ZHNlY3VyaXR5L2FwcHNlYy1ib3QtY2hhbGxlbmdlLXNpbXBsZWAgYXBwc2VjLWNvbmZpZyB0byB5b3VyIFdBRiBhY3F1aXNpdGlvbiwgcGx1cyBhbnkgb2YgdGhlCndlbGwta25vd24tcGF0aCBleGNsdXNpb24gY29uZmlncyB5b3UgbmVlZDoKCmBgYHlhbWwKYXBwc2VjX2NvbmZpZ3M6CiAtIGNyb3dkc2VjdXJpdHkvYXBwc2VjLWJvdC0qCmxhYmVsczoKICB0eXBlOiBhcHBzZWMKbGlzdGVuX2FkZHI6IDEyNy4wLjAuMTo3NDIyCnNvdXJjZTogYXBwc2VjCmBgYAo=", "parsers": [ "crowdsecurity/appsec-logs", "crowdsecurity/appsec-bot-detection-logs" @@ -7895,7 +7955,7 @@ "crowdsecurity/appsec-bot-challenge-too-many-submissions", "crowdsecurity/appsec-bot-challenge-request-with-no-submission" ], - "version": "0.4", + "version": "0.5", "versions": { "0.1": { "deprecated": false, @@ -7912,6 +7972,10 @@ "0.4": { "deprecated": false, "digest": "7c8d5418e6d02711f582f031d9062aaa31701bc691ac59b1dc96d49cb774e692" + }, + "0.5": { + "deprecated": false, + "digest": "3f99fdceabb67f9ad3d3708e9025b0cf02b422fc86572ac2ec1146864d587a90" } } }, From b9b4a915996963d395e639c65f520f9cfe3d0c49 Mon Sep 17 00:00:00 2001 From: Thibault Koechlin Date: Wed, 1 Jul 2026 14:54:52 +0200 Subject: [PATCH 28/36] datadog --- appsec-rules/crowdsecurity/appsec-bot-legit-monitoring.yaml | 6 ++++++ collections/crowdsecurity/appsec-bot-challenge.md | 2 +- 2 files changed, 7 insertions(+), 1 deletion(-) diff --git a/appsec-rules/crowdsecurity/appsec-bot-legit-monitoring.yaml b/appsec-rules/crowdsecurity/appsec-bot-legit-monitoring.yaml index ac1c9c06cfe..3758c39f2c5 100644 --- a/appsec-rules/crowdsecurity/appsec-bot-legit-monitoring.yaml +++ b/appsec-rules/crowdsecurity/appsec-bot-legit-monitoring.yaml @@ -10,3 +10,9 @@ data: - source_url: https://hub-data.crowdsec.net/whitelists/benign_bots/legit_bots/cookiebot.json dest_file: legit_bots/cookiebot.json type: bots + - source_url: https://hub-data.crowdsec.net/whitelists/benign_bots/legit_bots/datadog.json + dest_file: legit_bots/datadog.json + type: bots + - source_url: https://hub-data.crowdsec.net/whitelists/benign_bots/legit_bots/pagerduty.json + dest_file: legit_bots/pagerduty.json + type: bots diff --git a/collections/crowdsecurity/appsec-bot-challenge.md b/collections/crowdsecurity/appsec-bot-challenge.md index a41c8e59587..cfe9298eaac 100644 --- a/collections/crowdsecurity/appsec-bot-challenge.md +++ b/collections/crowdsecurity/appsec-bot-challenge.md @@ -16,7 +16,7 @@ What it ships: - `crowdsecurity/appsec-bot-legit-ai-crawlers`: gptbot, openai-searchbot, openai-chatgpt-user, perplexitybot - `crowdsecurity/appsec-bot-legit-social`: meta, discord, telegram, twitterbot, pinterest - - `crowdsecurity/appsec-bot-legit-monitoring`: uptimerobot, cookiebot + - `crowdsecurity/appsec-bot-legit-monitoring`: uptimerobot, cookiebot, datadog A bot is exempted **only** when it can be network-verified — forward-confirmed rDNS or a published IP range. User-Agent-only bots (e.g. CommonCrawl/CCBot) are intentionally left challenged, since a From 60b320c11b004cc33ed0a5962d6c9d70c6564d43 Mon Sep 17 00:00:00 2001 From: Thibault Koechlin Date: Wed, 1 Jul 2026 14:55:17 +0200 Subject: [PATCH 29/36] up --- collections/crowdsecurity/appsec-bot-challenge.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/collections/crowdsecurity/appsec-bot-challenge.md b/collections/crowdsecurity/appsec-bot-challenge.md index cfe9298eaac..4b60ea65d88 100644 --- a/collections/crowdsecurity/appsec-bot-challenge.md +++ b/collections/crowdsecurity/appsec-bot-challenge.md @@ -16,7 +16,7 @@ What it ships: - `crowdsecurity/appsec-bot-legit-ai-crawlers`: gptbot, openai-searchbot, openai-chatgpt-user, perplexitybot - `crowdsecurity/appsec-bot-legit-social`: meta, discord, telegram, twitterbot, pinterest - - `crowdsecurity/appsec-bot-legit-monitoring`: uptimerobot, cookiebot, datadog + - `crowdsecurity/appsec-bot-legit-monitoring`: uptimerobot, cookiebot, datadog, pagerduty A bot is exempted **only** when it can be network-verified — forward-confirmed rDNS or a published IP range. User-Agent-only bots (e.g. CommonCrawl/CCBot) are intentionally left challenged, since a From 3bcc4d3665d2bf6d5f9cf1e91a5589867403bc35 Mon Sep 17 00:00:00 2001 From: GitHub Action Date: Wed, 1 Jul 2026 12:55:45 +0000 Subject: [PATCH 30/36] Update index --- .index.json | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/.index.json b/.index.json index 9343ea53902..a59cee2c899 100644 --- a/.index.json +++ b/.index.json @@ -244,10 +244,10 @@ }, "crowdsecurity/appsec-bot-legit-monitoring": { "author": "crowdsecurity", - "content": "bmFtZTogY3Jvd2RzZWN1cml0eS9hcHBzZWMtYm90LWxlZ2l0LW1vbml0b3JpbmcKCiMgRGVjbGFyZXMgdGhlIGxlZ2l0aW1hdGUgdXB0aW1lL21vbml0b3JpbmcgZGF0YWZpbGVzIHNvIGNyb3dkc2VjIGRvd25sb2FkcyB0aGVtCiMgRG8gbm90IGVkaXQgdGhpcyBmaWxlIHRvIGFkZCB5b3VyIG93biBleGNsdXNpb25zLCBjcmVhdGUgYSBjdXN0b20gY29uZmlnLgoKZGF0YToKICAtIHNvdXJjZV91cmw6IGh0dHBzOi8vaHViLWRhdGEuY3Jvd2RzZWMubmV0L3doaXRlbGlzdHMvYmVuaWduX2JvdHMvbGVnaXRfYm90cy91cHRpbWVyb2JvdC5qc29uCiAgICBkZXN0X2ZpbGU6IGxlZ2l0X2JvdHMvdXB0aW1lcm9ib3QuanNvbgogICAgdHlwZTogYm90cwogIC0gc291cmNlX3VybDogaHR0cHM6Ly9odWItZGF0YS5jcm93ZHNlYy5uZXQvd2hpdGVsaXN0cy9iZW5pZ25fYm90cy9sZWdpdF9ib3RzL2Nvb2tpZWJvdC5qc29uCiAgICBkZXN0X2ZpbGU6IGxlZ2l0X2JvdHMvY29va2llYm90Lmpzb24KICAgIHR5cGU6IGJvdHMK", + "content": "bmFtZTogY3Jvd2RzZWN1cml0eS9hcHBzZWMtYm90LWxlZ2l0LW1vbml0b3JpbmcKCiMgRGVjbGFyZXMgdGhlIGxlZ2l0aW1hdGUgdXB0aW1lL21vbml0b3JpbmcgZGF0YWZpbGVzIHNvIGNyb3dkc2VjIGRvd25sb2FkcyB0aGVtCiMgRG8gbm90IGVkaXQgdGhpcyBmaWxlIHRvIGFkZCB5b3VyIG93biBleGNsdXNpb25zLCBjcmVhdGUgYSBjdXN0b20gY29uZmlnLgoKZGF0YToKICAtIHNvdXJjZV91cmw6IGh0dHBzOi8vaHViLWRhdGEuY3Jvd2RzZWMubmV0L3doaXRlbGlzdHMvYmVuaWduX2JvdHMvbGVnaXRfYm90cy91cHRpbWVyb2JvdC5qc29uCiAgICBkZXN0X2ZpbGU6IGxlZ2l0X2JvdHMvdXB0aW1lcm9ib3QuanNvbgogICAgdHlwZTogYm90cwogIC0gc291cmNlX3VybDogaHR0cHM6Ly9odWItZGF0YS5jcm93ZHNlYy5uZXQvd2hpdGVsaXN0cy9iZW5pZ25fYm90cy9sZWdpdF9ib3RzL2Nvb2tpZWJvdC5qc29uCiAgICBkZXN0X2ZpbGU6IGxlZ2l0X2JvdHMvY29va2llYm90Lmpzb24KICAgIHR5cGU6IGJvdHMKICAtIHNvdXJjZV91cmw6IGh0dHBzOi8vaHViLWRhdGEuY3Jvd2RzZWMubmV0L3doaXRlbGlzdHMvYmVuaWduX2JvdHMvbGVnaXRfYm90cy9kYXRhZG9nLmpzb24KICAgIGRlc3RfZmlsZTogbGVnaXRfYm90cy9kYXRhZG9nLmpzb24KICAgIHR5cGU6IGJvdHMKICAtIHNvdXJjZV91cmw6IGh0dHBzOi8vaHViLWRhdGEuY3Jvd2RzZWMubmV0L3doaXRlbGlzdHMvYmVuaWduX2JvdHMvbGVnaXRfYm90cy9wYWdlcmR1dHkuanNvbgogICAgZGVzdF9maWxlOiBsZWdpdF9ib3RzL3BhZ2VyZHV0eS5qc29uCiAgICB0eXBlOiBib3RzCg==", "labels": null, "path": "appsec-rules/crowdsecurity/appsec-bot-legit-monitoring.yaml", - "version": "0.2", + "version": "0.3", "versions": { "0.1": { "deprecated": false, @@ -256,6 +256,10 @@ "0.2": { "deprecated": false, "digest": "c4ea8155feb02a9a622e88072637e6eaf1ec5fd404ecb2f46a271d1af1b70cd2" + }, + "0.3": { + "deprecated": false, + "digest": "269a526cf439cb6b4f21c56820b933e0bae19cca4a3c1581915b6b57e085507a" } } }, @@ -7943,7 +7947,7 @@ "labels": { "label": "WAF - Bot Challenge" }, - "long_description": "IyBBcHBTZWMgQm90IENoYWxsZW5nZQoKVGhpcyBjb2xsZWN0aW9uIGVuYWJsZXMgQ3Jvd2RTZWMgQXBwU2VjICoqY2hhbGxlbmdlIG1vZGUqKiBmb3IgYm90IGRldGVjdGlvbjogdmlzaXRvcnMgYXJlIHNlcnZlZCBhCmxpZ2h0d2VpZ2h0IHByb29mLW9mLXdvcmsgKyBicm93c2VyLWZpbmdlcnByaW50IGNoYWxsZW5nZSwgYW5kIGNsaWVudHMgZmxhZ2dlZCBhcyBrbm93biBib3RzIGJ5IHRoZQpmYXN0IGJvdCBkZXRlY3Rpb24gYXJlIHJlamVjdGVkLgoKV2hhdCBpdCBzaGlwczoKCiAtIGBjcm93ZHNlY3VyaXR5L2FwcHNlYy1ib3QtY2hhbGxlbmdlLXNpbXBsZWA6IGNoYWxsZW5nZXMgaW5jb21pbmcgcmVxdWVzdHMsIHNraXBzIHZlcmlmaWVkIGdvb2QgYm90cwogICAoZm9yd2FyZC1jb25maXJtZWQgckROUyksIGFuZCByZWplY3RzIGNoYWxsZW5nZSBzdWJtaXNzaW9ucyB3aG9zZSBmaW5nZXJwcmludCB0cmlwcyB0aGUgZmFzdCBib3QKICAgZGV0ZWN0aW9uLgogLSBWZXJpZmllZC1nb29kLWJvdCBkYXRhZmlsZXMgdGhhdCBiYWNrIHRoZSBleGNsdXNpb24gYWJvdmUsIHNwbGl0IGJ5IGZhbWlseSBzbyB5b3UgY2FuIGVuYWJsZSBvbmx5IHRoZQogICBvbmVzIHlvdSBuZWVkOgogICAtIGBjcm93ZHNlY3VyaXR5L2FwcHNlYy1ib3QtbGVnaXQtc2VhcmNoLWVuZ2luZXNgOiBnb29nbGVib3QsIGJpbmdib3QsIGFwcGxlYm90LCBhbWF6b25ib3QsIHlhbmRleCwKICAgICBiYWlkdSwgeWFob28sIHNvZ291LCBxd2FudCwgYmFiYmFyLCBkdWNrZHVja2JvdAogICAtIGBjcm93ZHNlY3VyaXR5L2FwcHNlYy1ib3QtbGVnaXQtYWktY3Jhd2xlcnNgOiBncHRib3QsIG9wZW5haS1zZWFyY2hib3QsIG9wZW5haS1jaGF0Z3B0LXVzZXIsCiAgICAgcGVycGxleGl0eWJvdAogICAtIGBjcm93ZHNlY3VyaXR5L2FwcHNlYy1ib3QtbGVnaXQtc29jaWFsYDogbWV0YSwgZGlzY29yZCwgdGVsZWdyYW0sIHR3aXR0ZXJib3QsIHBpbnRlcmVzdAogICAtIGBjcm93ZHNlY3VyaXR5L2FwcHNlYy1ib3QtbGVnaXQtbW9uaXRvcmluZ2A6IHVwdGltZXJvYm90LCBjb29raWVib3QKCiAgIEEgYm90IGlzIGV4ZW1wdGVkICoqb25seSoqIHdoZW4gaXQgY2FuIGJlIG5ldHdvcmstdmVyaWZpZWQg4oCUIGZvcndhcmQtY29uZmlybWVkIHJETlMgb3IgYSBwdWJsaXNoZWQgSVAKICAgcmFuZ2UuIFVzZXItQWdlbnQtb25seSBib3RzIChlLmcuIENvbW1vbkNyYXdsL0NDQm90KSBhcmUgaW50ZW50aW9uYWxseSBsZWZ0IGNoYWxsZW5nZWQsIHNpbmNlIGEKICAgc3Bvb2ZlZCBVc2VyLUFnZW50IG11c3Qgbm90IGJ5cGFzcyB0aGUgY2hhbGxlbmdlLgogLSBQYXRoIGV4Y2x1c2lvbiBjb25maWdzIHRoYXQgbGV0IG1hY2hpbmUtZmFjaW5nIG9yIG5vbi1uYXZpZ2F0aW9uYWwgcmVxdWVzdHMgdGhyb3VnaCB3aXRob3V0IGEKICAgY2hhbGxlbmdlOgogICAtIGBhcHBzZWMtYm90LWNoYWxsZW5nZS1leGNsdWRlLWNyYXdsZXItZmlsZXNgIOKAlCBgL3JvYm90cy50eHRgLCBgLy53ZWxsLWtub3duLypgLCBgL3NlY3VyaXR5LnR4dGAsIOKApgogICAtIGBhcHBzZWMtYm90LWNoYWxsZW5nZS1leGNsdWRlLWZlZWRzYCDigJQgUlNTL0F0b20gZmVlZCBwYXRocwogICAtIGBhcHBzZWMtYm90LWNoYWxsZW5nZS1leGNsdWRlLXdlYmhvb2tzYCDigJQgdGhpcmQtcGFydHkgd2ViaG9vayBwYXRocwogICAtIGBhcHBzZWMtYm90LWNoYWxsZW5nZS1leGNsdWRlLXN0YXRpY2Ag4oCUIHN0YXRpYyBhc3NldHMgYW5kIG1lZGlhIChjc3MsIGpzLCBpbWFnZXMsIGZvbnRzLAogICAgIGF1ZGlvL3ZpZGVvLCBzb3VyY2VtYXBzKTsgYSBjaGFsbGVuZ2UgcGFnZSByZXR1cm5lZCBmb3IgYSBzdWJyZXNvdXJjZSB3b3VsZCBicmVhayBwYWdlIHJlbmRlcmluZwogICAtIGBhcHBzZWMtYm90LWNoYWxsZW5nZS1leGNsdWRlLWFwaWAg4oCUIHByb2dyYW1tYXRpYyBlbmRwb2ludHMKCiAgIFRoZSBleGNsdXNpb24gaXMgc3RyaWN0bHkgcGVyLXJlcXVlc3QgYW5kIGlzIG5ldmVyIHBlcnNpc3RlZCB0byBhIGNvb2tpZSBvciBhY3Jvc3MgcmVxdWVzdHMsIHNvIGl0CiAgIGNhbm5vdCBiZSBhYnVzZWQgdG8gd2hpdGVsaXN0IGEgc2Vzc2lvbiBmb3Igb3RoZXIgcGF0aHMuCiAtIEEgZGVkaWNhdGVkIGJvdC1kZXRlY3Rpb24gcGFyc2VyIHRyYWNraW5nIHRoZSBmaW5nZXJwcmludCBzZXNzaW9uIGlkIChgZnNpZGApIGFuZCBPUy4KIC0gU2NlbmFyaW9zIHRoYXQgYWxlcnQgb24gZGV0ZWN0ZWQgYm90cyBhbmQgb24gY2hhbGxlbmdlIGFidXNlLgogLSBBIHVzZXItZnJpZW5kbHkgYWxlcnQgY29udGV4dCBleHBvc2luZyBgZnNpZGAsIE9TLCBhbmQgdGhlIGJvdCBzaWduYWxzIHRoYXQgZmlyZWQuCgojIyBFbmFibGluZyBib3QgY2hhbGxlbmdlCgpBZGQgdGhlIGBjcm93ZHNlY3VyaXR5L2FwcHNlYy1ib3QtY2hhbGxlbmdlLXNpbXBsZWAgYXBwc2VjLWNvbmZpZyB0byB5b3VyIFdBRiBhY3F1aXNpdGlvbiwgcGx1cyBhbnkgb2YgdGhlCndlbGwta25vd24tcGF0aCBleGNsdXNpb24gY29uZmlncyB5b3UgbmVlZDoKCmBgYHlhbWwKYXBwc2VjX2NvbmZpZ3M6CiAtIGNyb3dkc2VjdXJpdHkvYXBwc2VjLWJvdC0qCmxhYmVsczoKICB0eXBlOiBhcHBzZWMKbGlzdGVuX2FkZHI6IDEyNy4wLjAuMTo3NDIyCnNvdXJjZTogYXBwc2VjCmBgYAo=", + "long_description": "IyBBcHBTZWMgQm90IENoYWxsZW5nZQoKVGhpcyBjb2xsZWN0aW9uIGVuYWJsZXMgQ3Jvd2RTZWMgQXBwU2VjICoqY2hhbGxlbmdlIG1vZGUqKiBmb3IgYm90IGRldGVjdGlvbjogdmlzaXRvcnMgYXJlIHNlcnZlZCBhCmxpZ2h0d2VpZ2h0IHByb29mLW9mLXdvcmsgKyBicm93c2VyLWZpbmdlcnByaW50IGNoYWxsZW5nZSwgYW5kIGNsaWVudHMgZmxhZ2dlZCBhcyBrbm93biBib3RzIGJ5IHRoZQpmYXN0IGJvdCBkZXRlY3Rpb24gYXJlIHJlamVjdGVkLgoKV2hhdCBpdCBzaGlwczoKCiAtIGBjcm93ZHNlY3VyaXR5L2FwcHNlYy1ib3QtY2hhbGxlbmdlLXNpbXBsZWA6IGNoYWxsZW5nZXMgaW5jb21pbmcgcmVxdWVzdHMsIHNraXBzIHZlcmlmaWVkIGdvb2QgYm90cwogICAoZm9yd2FyZC1jb25maXJtZWQgckROUyksIGFuZCByZWplY3RzIGNoYWxsZW5nZSBzdWJtaXNzaW9ucyB3aG9zZSBmaW5nZXJwcmludCB0cmlwcyB0aGUgZmFzdCBib3QKICAgZGV0ZWN0aW9uLgogLSBWZXJpZmllZC1nb29kLWJvdCBkYXRhZmlsZXMgdGhhdCBiYWNrIHRoZSBleGNsdXNpb24gYWJvdmUsIHNwbGl0IGJ5IGZhbWlseSBzbyB5b3UgY2FuIGVuYWJsZSBvbmx5IHRoZQogICBvbmVzIHlvdSBuZWVkOgogICAtIGBjcm93ZHNlY3VyaXR5L2FwcHNlYy1ib3QtbGVnaXQtc2VhcmNoLWVuZ2luZXNgOiBnb29nbGVib3QsIGJpbmdib3QsIGFwcGxlYm90LCBhbWF6b25ib3QsIHlhbmRleCwKICAgICBiYWlkdSwgeWFob28sIHNvZ291LCBxd2FudCwgYmFiYmFyLCBkdWNrZHVja2JvdAogICAtIGBjcm93ZHNlY3VyaXR5L2FwcHNlYy1ib3QtbGVnaXQtYWktY3Jhd2xlcnNgOiBncHRib3QsIG9wZW5haS1zZWFyY2hib3QsIG9wZW5haS1jaGF0Z3B0LXVzZXIsCiAgICAgcGVycGxleGl0eWJvdAogICAtIGBjcm93ZHNlY3VyaXR5L2FwcHNlYy1ib3QtbGVnaXQtc29jaWFsYDogbWV0YSwgZGlzY29yZCwgdGVsZWdyYW0sIHR3aXR0ZXJib3QsIHBpbnRlcmVzdAogICAtIGBjcm93ZHNlY3VyaXR5L2FwcHNlYy1ib3QtbGVnaXQtbW9uaXRvcmluZ2A6IHVwdGltZXJvYm90LCBjb29raWVib3QsIGRhdGFkb2csIHBhZ2VyZHV0eQoKICAgQSBib3QgaXMgZXhlbXB0ZWQgKipvbmx5Kiogd2hlbiBpdCBjYW4gYmUgbmV0d29yay12ZXJpZmllZCDigJQgZm9yd2FyZC1jb25maXJtZWQgckROUyBvciBhIHB1Ymxpc2hlZCBJUAogICByYW5nZS4gVXNlci1BZ2VudC1vbmx5IGJvdHMgKGUuZy4gQ29tbW9uQ3Jhd2wvQ0NCb3QpIGFyZSBpbnRlbnRpb25hbGx5IGxlZnQgY2hhbGxlbmdlZCwgc2luY2UgYQogICBzcG9vZmVkIFVzZXItQWdlbnQgbXVzdCBub3QgYnlwYXNzIHRoZSBjaGFsbGVuZ2UuCiAtIFBhdGggZXhjbHVzaW9uIGNvbmZpZ3MgdGhhdCBsZXQgbWFjaGluZS1mYWNpbmcgb3Igbm9uLW5hdmlnYXRpb25hbCByZXF1ZXN0cyB0aHJvdWdoIHdpdGhvdXQgYQogICBjaGFsbGVuZ2U6CiAgIC0gYGFwcHNlYy1ib3QtY2hhbGxlbmdlLWV4Y2x1ZGUtY3Jhd2xlci1maWxlc2Ag4oCUIGAvcm9ib3RzLnR4dGAsIGAvLndlbGwta25vd24vKmAsIGAvc2VjdXJpdHkudHh0YCwg4oCmCiAgIC0gYGFwcHNlYy1ib3QtY2hhbGxlbmdlLWV4Y2x1ZGUtZmVlZHNgIOKAlCBSU1MvQXRvbSBmZWVkIHBhdGhzCiAgIC0gYGFwcHNlYy1ib3QtY2hhbGxlbmdlLWV4Y2x1ZGUtd2ViaG9va3NgIOKAlCB0aGlyZC1wYXJ0eSB3ZWJob29rIHBhdGhzCiAgIC0gYGFwcHNlYy1ib3QtY2hhbGxlbmdlLWV4Y2x1ZGUtc3RhdGljYCDigJQgc3RhdGljIGFzc2V0cyBhbmQgbWVkaWEgKGNzcywganMsIGltYWdlcywgZm9udHMsCiAgICAgYXVkaW8vdmlkZW8sIHNvdXJjZW1hcHMpOyBhIGNoYWxsZW5nZSBwYWdlIHJldHVybmVkIGZvciBhIHN1YnJlc291cmNlIHdvdWxkIGJyZWFrIHBhZ2UgcmVuZGVyaW5nCiAgIC0gYGFwcHNlYy1ib3QtY2hhbGxlbmdlLWV4Y2x1ZGUtYXBpYCDigJQgcHJvZ3JhbW1hdGljIGVuZHBvaW50cwoKICAgVGhlIGV4Y2x1c2lvbiBpcyBzdHJpY3RseSBwZXItcmVxdWVzdCBhbmQgaXMgbmV2ZXIgcGVyc2lzdGVkIHRvIGEgY29va2llIG9yIGFjcm9zcyByZXF1ZXN0cywgc28gaXQKICAgY2Fubm90IGJlIGFidXNlZCB0byB3aGl0ZWxpc3QgYSBzZXNzaW9uIGZvciBvdGhlciBwYXRocy4KIC0gQSBkZWRpY2F0ZWQgYm90LWRldGVjdGlvbiBwYXJzZXIgdHJhY2tpbmcgdGhlIGZpbmdlcnByaW50IHNlc3Npb24gaWQgKGBmc2lkYCkgYW5kIE9TLgogLSBTY2VuYXJpb3MgdGhhdCBhbGVydCBvbiBkZXRlY3RlZCBib3RzIGFuZCBvbiBjaGFsbGVuZ2UgYWJ1c2UuCiAtIEEgdXNlci1mcmllbmRseSBhbGVydCBjb250ZXh0IGV4cG9zaW5nIGBmc2lkYCwgT1MsIGFuZCB0aGUgYm90IHNpZ25hbHMgdGhhdCBmaXJlZC4KCiMjIEVuYWJsaW5nIGJvdCBjaGFsbGVuZ2UKCkFkZCB0aGUgYGNyb3dkc2VjdXJpdHkvYXBwc2VjLWJvdC1jaGFsbGVuZ2Utc2ltcGxlYCBhcHBzZWMtY29uZmlnIHRvIHlvdXIgV0FGIGFjcXVpc2l0aW9uLCBwbHVzIGFueSBvZiB0aGUKd2VsbC1rbm93bi1wYXRoIGV4Y2x1c2lvbiBjb25maWdzIHlvdSBuZWVkOgoKYGBgeWFtbAphcHBzZWNfY29uZmlnczoKIC0gY3Jvd2RzZWN1cml0eS9hcHBzZWMtYm90LSoKbGFiZWxzOgogIHR5cGU6IGFwcHNlYwpsaXN0ZW5fYWRkcjogMTI3LjAuMC4xOjc0MjIKc291cmNlOiBhcHBzZWMKYGBgCg==", "parsers": [ "crowdsecurity/appsec-logs", "crowdsecurity/appsec-bot-detection-logs" From fef0309862faaf36171c72a05bcf338421154ddb Mon Sep 17 00:00:00 2001 From: Thibault Koechlin Date: Wed, 1 Jul 2026 15:00:35 +0200 Subject: [PATCH 31/36] up --- .../crowdsecurity/appsec-bot-challenge.md | 16 ++++------------ 1 file changed, 4 insertions(+), 12 deletions(-) diff --git a/collections/crowdsecurity/appsec-bot-challenge.md b/collections/crowdsecurity/appsec-bot-challenge.md index 4b60ea65d88..48c03f7966c 100644 --- a/collections/crowdsecurity/appsec-bot-challenge.md +++ b/collections/crowdsecurity/appsec-bot-challenge.md @@ -7,8 +7,7 @@ fast bot detection are rejected. What it ships: - `crowdsecurity/appsec-bot-challenge-simple`: challenges incoming requests, skips verified good bots - (forward-confirmed rDNS), and rejects challenge submissions whose fingerprint trips the fast bot - detection. + and rejects challenge submissions whose fingerprint trips the bot detection. - Verified-good-bot datafiles that back the exclusion above, split by family so you can enable only the ones you need: - `crowdsecurity/appsec-bot-legit-search-engines`: googlebot, bingbot, applebot, amazonbot, yandex, @@ -18,27 +17,20 @@ What it ships: - `crowdsecurity/appsec-bot-legit-social`: meta, discord, telegram, twitterbot, pinterest - `crowdsecurity/appsec-bot-legit-monitoring`: uptimerobot, cookiebot, datadog, pagerduty - A bot is exempted **only** when it can be network-verified — forward-confirmed rDNS or a published IP - range. User-Agent-only bots (e.g. CommonCrawl/CCBot) are intentionally left challenged, since a - spoofed User-Agent must not bypass the challenge. + A bot is exempted **only** when it can be network-verified (dns or ip range). - Path exclusion configs that let machine-facing or non-navigational requests through without a challenge: - `appsec-bot-challenge-exclude-crawler-files` — `/robots.txt`, `/.well-known/*`, `/security.txt`, … - `appsec-bot-challenge-exclude-feeds` — RSS/Atom feed paths - `appsec-bot-challenge-exclude-webhooks` — third-party webhook paths - - `appsec-bot-challenge-exclude-static` — static assets and media (css, js, images, fonts, - audio/video, sourcemaps); a challenge page returned for a subresource would break page rendering + - `appsec-bot-challenge-exclude-static` — static assets and media - `appsec-bot-challenge-exclude-api` — programmatic endpoints - - The exclusion is strictly per-request and is never persisted to a cookie or across requests, so it - cannot be abused to whitelist a session for other paths. - - A dedicated bot-detection parser tracking the fingerprint session id (`fsid`) and OS. - Scenarios that alert on detected bots and on challenge abuse. - A user-friendly alert context exposing `fsid`, OS, and the bot signals that fired. ## Enabling bot challenge -Add the `crowdsecurity/appsec-bot-challenge-simple` appsec-config to your WAF acquisition, plus any of the +Add the `crowdsecurity/appsec-bot-*` appsec-configs to your WAF acquisition, plus any of the well-known-path exclusion configs you need: ```yaml From c5594ae141877277ebc2cbb02c3448042311d46b Mon Sep 17 00:00:00 2001 From: GitHub Action Date: Wed, 1 Jul 2026 13:00:56 +0000 Subject: [PATCH 32/36] Update index --- .index.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.index.json b/.index.json index a59cee2c899..e97b597ff9e 100644 --- a/.index.json +++ b/.index.json @@ -7947,7 +7947,7 @@ "labels": { "label": "WAF - Bot Challenge" }, - "long_description": "IyBBcHBTZWMgQm90IENoYWxsZW5nZQoKVGhpcyBjb2xsZWN0aW9uIGVuYWJsZXMgQ3Jvd2RTZWMgQXBwU2VjICoqY2hhbGxlbmdlIG1vZGUqKiBmb3IgYm90IGRldGVjdGlvbjogdmlzaXRvcnMgYXJlIHNlcnZlZCBhCmxpZ2h0d2VpZ2h0IHByb29mLW9mLXdvcmsgKyBicm93c2VyLWZpbmdlcnByaW50IGNoYWxsZW5nZSwgYW5kIGNsaWVudHMgZmxhZ2dlZCBhcyBrbm93biBib3RzIGJ5IHRoZQpmYXN0IGJvdCBkZXRlY3Rpb24gYXJlIHJlamVjdGVkLgoKV2hhdCBpdCBzaGlwczoKCiAtIGBjcm93ZHNlY3VyaXR5L2FwcHNlYy1ib3QtY2hhbGxlbmdlLXNpbXBsZWA6IGNoYWxsZW5nZXMgaW5jb21pbmcgcmVxdWVzdHMsIHNraXBzIHZlcmlmaWVkIGdvb2QgYm90cwogICAoZm9yd2FyZC1jb25maXJtZWQgckROUyksIGFuZCByZWplY3RzIGNoYWxsZW5nZSBzdWJtaXNzaW9ucyB3aG9zZSBmaW5nZXJwcmludCB0cmlwcyB0aGUgZmFzdCBib3QKICAgZGV0ZWN0aW9uLgogLSBWZXJpZmllZC1nb29kLWJvdCBkYXRhZmlsZXMgdGhhdCBiYWNrIHRoZSBleGNsdXNpb24gYWJvdmUsIHNwbGl0IGJ5IGZhbWlseSBzbyB5b3UgY2FuIGVuYWJsZSBvbmx5IHRoZQogICBvbmVzIHlvdSBuZWVkOgogICAtIGBjcm93ZHNlY3VyaXR5L2FwcHNlYy1ib3QtbGVnaXQtc2VhcmNoLWVuZ2luZXNgOiBnb29nbGVib3QsIGJpbmdib3QsIGFwcGxlYm90LCBhbWF6b25ib3QsIHlhbmRleCwKICAgICBiYWlkdSwgeWFob28sIHNvZ291LCBxd2FudCwgYmFiYmFyLCBkdWNrZHVja2JvdAogICAtIGBjcm93ZHNlY3VyaXR5L2FwcHNlYy1ib3QtbGVnaXQtYWktY3Jhd2xlcnNgOiBncHRib3QsIG9wZW5haS1zZWFyY2hib3QsIG9wZW5haS1jaGF0Z3B0LXVzZXIsCiAgICAgcGVycGxleGl0eWJvdAogICAtIGBjcm93ZHNlY3VyaXR5L2FwcHNlYy1ib3QtbGVnaXQtc29jaWFsYDogbWV0YSwgZGlzY29yZCwgdGVsZWdyYW0sIHR3aXR0ZXJib3QsIHBpbnRlcmVzdAogICAtIGBjcm93ZHNlY3VyaXR5L2FwcHNlYy1ib3QtbGVnaXQtbW9uaXRvcmluZ2A6IHVwdGltZXJvYm90LCBjb29raWVib3QsIGRhdGFkb2csIHBhZ2VyZHV0eQoKICAgQSBib3QgaXMgZXhlbXB0ZWQgKipvbmx5Kiogd2hlbiBpdCBjYW4gYmUgbmV0d29yay12ZXJpZmllZCDigJQgZm9yd2FyZC1jb25maXJtZWQgckROUyBvciBhIHB1Ymxpc2hlZCBJUAogICByYW5nZS4gVXNlci1BZ2VudC1vbmx5IGJvdHMgKGUuZy4gQ29tbW9uQ3Jhd2wvQ0NCb3QpIGFyZSBpbnRlbnRpb25hbGx5IGxlZnQgY2hhbGxlbmdlZCwgc2luY2UgYQogICBzcG9vZmVkIFVzZXItQWdlbnQgbXVzdCBub3QgYnlwYXNzIHRoZSBjaGFsbGVuZ2UuCiAtIFBhdGggZXhjbHVzaW9uIGNvbmZpZ3MgdGhhdCBsZXQgbWFjaGluZS1mYWNpbmcgb3Igbm9uLW5hdmlnYXRpb25hbCByZXF1ZXN0cyB0aHJvdWdoIHdpdGhvdXQgYQogICBjaGFsbGVuZ2U6CiAgIC0gYGFwcHNlYy1ib3QtY2hhbGxlbmdlLWV4Y2x1ZGUtY3Jhd2xlci1maWxlc2Ag4oCUIGAvcm9ib3RzLnR4dGAsIGAvLndlbGwta25vd24vKmAsIGAvc2VjdXJpdHkudHh0YCwg4oCmCiAgIC0gYGFwcHNlYy1ib3QtY2hhbGxlbmdlLWV4Y2x1ZGUtZmVlZHNgIOKAlCBSU1MvQXRvbSBmZWVkIHBhdGhzCiAgIC0gYGFwcHNlYy1ib3QtY2hhbGxlbmdlLWV4Y2x1ZGUtd2ViaG9va3NgIOKAlCB0aGlyZC1wYXJ0eSB3ZWJob29rIHBhdGhzCiAgIC0gYGFwcHNlYy1ib3QtY2hhbGxlbmdlLWV4Y2x1ZGUtc3RhdGljYCDigJQgc3RhdGljIGFzc2V0cyBhbmQgbWVkaWEgKGNzcywganMsIGltYWdlcywgZm9udHMsCiAgICAgYXVkaW8vdmlkZW8sIHNvdXJjZW1hcHMpOyBhIGNoYWxsZW5nZSBwYWdlIHJldHVybmVkIGZvciBhIHN1YnJlc291cmNlIHdvdWxkIGJyZWFrIHBhZ2UgcmVuZGVyaW5nCiAgIC0gYGFwcHNlYy1ib3QtY2hhbGxlbmdlLWV4Y2x1ZGUtYXBpYCDigJQgcHJvZ3JhbW1hdGljIGVuZHBvaW50cwoKICAgVGhlIGV4Y2x1c2lvbiBpcyBzdHJpY3RseSBwZXItcmVxdWVzdCBhbmQgaXMgbmV2ZXIgcGVyc2lzdGVkIHRvIGEgY29va2llIG9yIGFjcm9zcyByZXF1ZXN0cywgc28gaXQKICAgY2Fubm90IGJlIGFidXNlZCB0byB3aGl0ZWxpc3QgYSBzZXNzaW9uIGZvciBvdGhlciBwYXRocy4KIC0gQSBkZWRpY2F0ZWQgYm90LWRldGVjdGlvbiBwYXJzZXIgdHJhY2tpbmcgdGhlIGZpbmdlcnByaW50IHNlc3Npb24gaWQgKGBmc2lkYCkgYW5kIE9TLgogLSBTY2VuYXJpb3MgdGhhdCBhbGVydCBvbiBkZXRlY3RlZCBib3RzIGFuZCBvbiBjaGFsbGVuZ2UgYWJ1c2UuCiAtIEEgdXNlci1mcmllbmRseSBhbGVydCBjb250ZXh0IGV4cG9zaW5nIGBmc2lkYCwgT1MsIGFuZCB0aGUgYm90IHNpZ25hbHMgdGhhdCBmaXJlZC4KCiMjIEVuYWJsaW5nIGJvdCBjaGFsbGVuZ2UKCkFkZCB0aGUgYGNyb3dkc2VjdXJpdHkvYXBwc2VjLWJvdC1jaGFsbGVuZ2Utc2ltcGxlYCBhcHBzZWMtY29uZmlnIHRvIHlvdXIgV0FGIGFjcXVpc2l0aW9uLCBwbHVzIGFueSBvZiB0aGUKd2VsbC1rbm93bi1wYXRoIGV4Y2x1c2lvbiBjb25maWdzIHlvdSBuZWVkOgoKYGBgeWFtbAphcHBzZWNfY29uZmlnczoKIC0gY3Jvd2RzZWN1cml0eS9hcHBzZWMtYm90LSoKbGFiZWxzOgogIHR5cGU6IGFwcHNlYwpsaXN0ZW5fYWRkcjogMTI3LjAuMC4xOjc0MjIKc291cmNlOiBhcHBzZWMKYGBgCg==", + "long_description": "IyBBcHBTZWMgQm90IENoYWxsZW5nZQoKVGhpcyBjb2xsZWN0aW9uIGVuYWJsZXMgQ3Jvd2RTZWMgQXBwU2VjICoqY2hhbGxlbmdlIG1vZGUqKiBmb3IgYm90IGRldGVjdGlvbjogdmlzaXRvcnMgYXJlIHNlcnZlZCBhCmxpZ2h0d2VpZ2h0IHByb29mLW9mLXdvcmsgKyBicm93c2VyLWZpbmdlcnByaW50IGNoYWxsZW5nZSwgYW5kIGNsaWVudHMgZmxhZ2dlZCBhcyBrbm93biBib3RzIGJ5IHRoZQpmYXN0IGJvdCBkZXRlY3Rpb24gYXJlIHJlamVjdGVkLgoKV2hhdCBpdCBzaGlwczoKCiAtIGBjcm93ZHNlY3VyaXR5L2FwcHNlYy1ib3QtY2hhbGxlbmdlLXNpbXBsZWA6IGNoYWxsZW5nZXMgaW5jb21pbmcgcmVxdWVzdHMsIHNraXBzIHZlcmlmaWVkIGdvb2QgYm90cwogICBhbmQgcmVqZWN0cyBjaGFsbGVuZ2Ugc3VibWlzc2lvbnMgd2hvc2UgZmluZ2VycHJpbnQgdHJpcHMgdGhlIGJvdCBkZXRlY3Rpb24uCiAtIFZlcmlmaWVkLWdvb2QtYm90IGRhdGFmaWxlcyB0aGF0IGJhY2sgdGhlIGV4Y2x1c2lvbiBhYm92ZSwgc3BsaXQgYnkgZmFtaWx5IHNvIHlvdSBjYW4gZW5hYmxlIG9ubHkgdGhlCiAgIG9uZXMgeW91IG5lZWQ6CiAgIC0gYGNyb3dkc2VjdXJpdHkvYXBwc2VjLWJvdC1sZWdpdC1zZWFyY2gtZW5naW5lc2A6IGdvb2dsZWJvdCwgYmluZ2JvdCwgYXBwbGVib3QsIGFtYXpvbmJvdCwgeWFuZGV4LAogICAgIGJhaWR1LCB5YWhvbywgc29nb3UsIHF3YW50LCBiYWJiYXIsIGR1Y2tkdWNrYm90CiAgIC0gYGNyb3dkc2VjdXJpdHkvYXBwc2VjLWJvdC1sZWdpdC1haS1jcmF3bGVyc2A6IGdwdGJvdCwgb3BlbmFpLXNlYXJjaGJvdCwgb3BlbmFpLWNoYXRncHQtdXNlciwKICAgICBwZXJwbGV4aXR5Ym90CiAgIC0gYGNyb3dkc2VjdXJpdHkvYXBwc2VjLWJvdC1sZWdpdC1zb2NpYWxgOiBtZXRhLCBkaXNjb3JkLCB0ZWxlZ3JhbSwgdHdpdHRlcmJvdCwgcGludGVyZXN0CiAgIC0gYGNyb3dkc2VjdXJpdHkvYXBwc2VjLWJvdC1sZWdpdC1tb25pdG9yaW5nYDogdXB0aW1lcm9ib3QsIGNvb2tpZWJvdCwgZGF0YWRvZywgcGFnZXJkdXR5CgogICBBIGJvdCBpcyBleGVtcHRlZCAqKm9ubHkqKiB3aGVuIGl0IGNhbiBiZSBuZXR3b3JrLXZlcmlmaWVkIChkbnMgb3IgaXAgcmFuZ2UpLgogLSBQYXRoIGV4Y2x1c2lvbiBjb25maWdzIHRoYXQgbGV0IG1hY2hpbmUtZmFjaW5nIG9yIG5vbi1uYXZpZ2F0aW9uYWwgcmVxdWVzdHMgdGhyb3VnaCB3aXRob3V0IGEKICAgY2hhbGxlbmdlOgogICAtIGBhcHBzZWMtYm90LWNoYWxsZW5nZS1leGNsdWRlLWNyYXdsZXItZmlsZXNgIOKAlCBgL3JvYm90cy50eHRgLCBgLy53ZWxsLWtub3duLypgLCBgL3NlY3VyaXR5LnR4dGAsIOKApgogICAtIGBhcHBzZWMtYm90LWNoYWxsZW5nZS1leGNsdWRlLWZlZWRzYCDigJQgUlNTL0F0b20gZmVlZCBwYXRocwogICAtIGBhcHBzZWMtYm90LWNoYWxsZW5nZS1leGNsdWRlLXdlYmhvb2tzYCDigJQgdGhpcmQtcGFydHkgd2ViaG9vayBwYXRocwogICAtIGBhcHBzZWMtYm90LWNoYWxsZW5nZS1leGNsdWRlLXN0YXRpY2Ag4oCUIHN0YXRpYyBhc3NldHMgYW5kIG1lZGlhCiAgIC0gYGFwcHNlYy1ib3QtY2hhbGxlbmdlLWV4Y2x1ZGUtYXBpYCDigJQgcHJvZ3JhbW1hdGljIGVuZHBvaW50cwogLSBTY2VuYXJpb3MgdGhhdCBhbGVydCBvbiBkZXRlY3RlZCBib3RzIGFuZCBvbiBjaGFsbGVuZ2UgYWJ1c2UuCiAtIEEgdXNlci1mcmllbmRseSBhbGVydCBjb250ZXh0IGV4cG9zaW5nIGBmc2lkYCwgT1MsIGFuZCB0aGUgYm90IHNpZ25hbHMgdGhhdCBmaXJlZC4KCiMjIEVuYWJsaW5nIGJvdCBjaGFsbGVuZ2UKCkFkZCB0aGUgYGNyb3dkc2VjdXJpdHkvYXBwc2VjLWJvdC0qYCBhcHBzZWMtY29uZmlncyB0byB5b3VyIFdBRiBhY3F1aXNpdGlvbiwgcGx1cyBhbnkgb2YgdGhlCndlbGwta25vd24tcGF0aCBleGNsdXNpb24gY29uZmlncyB5b3UgbmVlZDoKCmBgYHlhbWwKYXBwc2VjX2NvbmZpZ3M6CiAtIGNyb3dkc2VjdXJpdHkvYXBwc2VjLWJvdC0qCmxhYmVsczoKICB0eXBlOiBhcHBzZWMKbGlzdGVuX2FkZHI6IDEyNy4wLjAuMTo3NDIyCnNvdXJjZTogYXBwc2VjCmBgYAo=", "parsers": [ "crowdsecurity/appsec-logs", "crowdsecurity/appsec-bot-detection-logs" From 27808d5b86de76f4cc580e8a82946528c21f0579 Mon Sep 17 00:00:00 2001 From: Thibault Koechlin Date: Wed, 1 Jul 2026 18:20:00 +0200 Subject: [PATCH 33/36] fix escape --- .../crowdsecurity/appsec-bot-challenge-exclude-static.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/appsec-configs/crowdsecurity/appsec-bot-challenge-exclude-static.yaml b/appsec-configs/crowdsecurity/appsec-bot-challenge-exclude-static.yaml index 67100fe9d82..408d9c85e9e 100644 --- a/appsec-configs/crowdsecurity/appsec-bot-challenge-exclude-static.yaml +++ b/appsec-configs/crowdsecurity/appsec-bot-challenge-exclude-static.yaml @@ -4,7 +4,7 @@ name: crowdsecurity/appsec-bot-challenge-exclude-static inband: pre_eval: - filter: >- - req.URL.Path matches '(?i)\.(css|js|mjs|map|png|jpe?g|gif|svg|webp|avif|ico|bmp|woff2?|ttf|otf|eot|mp4|m4v|webm|mov|mp3|m4a|wav|ogg|oga|ogv|flac|aac|webmanifest)$' || + req.URL.Path matches '\\.(css|js|mjs|map|png|jpe?g|gif|svg|webp|avif|ico|bmp|woff2?|ttf|otf|eot|mp4|m4v|webm|mov|mp3|m4a|wav|ogg|oga|ogv|flac|aac|webmanifest)$' || req.URL.Path in ['/manifest.json', '/browserconfig.xml'] apply: - ExemptFromChallenge() From d0b7e3f79cadc4b1019d02577a953a2138b93f10 Mon Sep 17 00:00:00 2001 From: GitHub Action Date: Thu, 2 Jul 2026 07:00:05 +0000 Subject: [PATCH 34/36] Update index --- .index.json | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/.index.json b/.index.json index e97b597ff9e..17f4f6b5c8a 100644 --- a/.index.json +++ b/.index.json @@ -57,14 +57,18 @@ }, "crowdsecurity/appsec-bot-challenge-exclude-static": { "author": "crowdsecurity", - "content": "bmFtZTogY3Jvd2RzZWN1cml0eS9hcHBzZWMtYm90LWNoYWxsZW5nZS1leGNsdWRlLXN0YXRpYwojIExldCBzdGF0aWMgYXNzZXRzIGFuZCBicm93c2VyIG1ldGFkYXRhIGZpbGVzIGZseSB0aHJvdWdoIHdpdGhvdXQgYSBjaGFsbGVuZ2UKIyBEbyBub3QgZWRpdCB0aGlzIGZpbGUgdG8gYWRkIHlvdXIgb3duIGV4Y2x1c2lvbnMsIGNyZWF0ZSBhIGN1c3RvbSBjb25maWcuCmluYmFuZDoKICBwcmVfZXZhbDoKICAgIC0gZmlsdGVyOiA+LQogICAgICAgIHJlcS5VUkwuUGF0aCBtYXRjaGVzICcoP2kpXC4oY3NzfGpzfG1qc3xtYXB8cG5nfGpwZT9nfGdpZnxzdmd8d2VicHxhdmlmfGljb3xibXB8d29mZjI/fHR0ZnxvdGZ8ZW90fG1wNHxtNHZ8d2VibXxtb3Z8bXAzfG00YXx3YXZ8b2dnfG9nYXxvZ3Z8ZmxhY3xhYWN8d2VibWFuaWZlc3QpJCcgfHwKICAgICAgICByZXEuVVJMLlBhdGggaW4gWycvbWFuaWZlc3QuanNvbicsICcvYnJvd3NlcmNvbmZpZy54bWwnXQogICAgICBhcHBseToKICAgICAgICAtIEV4ZW1wdEZyb21DaGFsbGVuZ2UoKQo=", + "content": "bmFtZTogY3Jvd2RzZWN1cml0eS9hcHBzZWMtYm90LWNoYWxsZW5nZS1leGNsdWRlLXN0YXRpYwojIExldCBzdGF0aWMgYXNzZXRzIGFuZCBicm93c2VyIG1ldGFkYXRhIGZpbGVzIGZseSB0aHJvdWdoIHdpdGhvdXQgYSBjaGFsbGVuZ2UKIyBEbyBub3QgZWRpdCB0aGlzIGZpbGUgdG8gYWRkIHlvdXIgb3duIGV4Y2x1c2lvbnMsIGNyZWF0ZSBhIGN1c3RvbSBjb25maWcuCmluYmFuZDoKICBwcmVfZXZhbDoKICAgIC0gZmlsdGVyOiA+LQogICAgICAgIHJlcS5VUkwuUGF0aCBtYXRjaGVzICdcXC4oY3NzfGpzfG1qc3xtYXB8cG5nfGpwZT9nfGdpZnxzdmd8d2VicHxhdmlmfGljb3xibXB8d29mZjI/fHR0ZnxvdGZ8ZW90fG1wNHxtNHZ8d2VibXxtb3Z8bXAzfG00YXx3YXZ8b2dnfG9nYXxvZ3Z8ZmxhY3xhYWN8d2VibWFuaWZlc3QpJCcgfHwKICAgICAgICByZXEuVVJMLlBhdGggaW4gWycvbWFuaWZlc3QuanNvbicsICcvYnJvd3NlcmNvbmZpZy54bWwnXQogICAgICBhcHBseToKICAgICAgICAtIEV4ZW1wdEZyb21DaGFsbGVuZ2UoKQo=", "labels": null, "path": "appsec-configs/crowdsecurity/appsec-bot-challenge-exclude-static.yaml", - "version": "0.1", + "version": "0.2", "versions": { "0.1": { "deprecated": false, "digest": "5fec907bb30a247b55bc11e547bc967f37369957e060895c3e9a2f20e71b1867" + }, + "0.2": { + "deprecated": false, + "digest": "592e8b49dc5f7f34a73149fa5bd3a985012b6b7af0089b49678284b6d041b50a" } } }, From b70a0fbba723862c1d817adb02c8575080113dd7 Mon Sep 17 00:00:00 2001 From: Thibault Koechlin Date: Wed, 15 Jul 2026 15:38:34 +0200 Subject: [PATCH 35/36] update the branch to reflect the changes on IsKnownBot helper --- ...sec-bot-challenge-exclude-ai-crawlers.yaml | 32 ++++++++ .../appsec-bot-challenge-exclude-api.yaml | 2 +- ...c-bot-challenge-exclude-crawler-files.yaml | 2 +- .../appsec-bot-challenge-exclude-feeds.yaml | 2 +- ...psec-bot-challenge-exclude-monitoring.yaml | 32 ++++++++ ...-bot-challenge-exclude-search-engines.yaml | 74 +++++++++++++++++++ .../appsec-bot-challenge-exclude-social.yaml | 38 ++++++++++ .../appsec-bot-challenge-exclude-static.yaml | 2 +- ...appsec-bot-challenge-exclude-webhooks.yaml | 2 +- .../appsec-bot-challenge-simple.yaml | 7 +- .../appsec-bot-legit-ai-crawlers.yaml | 18 ----- .../appsec-bot-legit-monitoring.yaml | 18 ----- .../appsec-bot-legit-search-engines.yaml | 39 ---------- .../appsec-bot-legit-social.yaml | 20 ----- .../crowdsecurity/appsec-bot-challenge.md | 18 ++--- .../crowdsecurity/appsec-bot-challenge.yaml | 9 +-- 16 files changed, 198 insertions(+), 117 deletions(-) create mode 100644 appsec-configs/crowdsecurity/appsec-bot-challenge-exclude-ai-crawlers.yaml create mode 100644 appsec-configs/crowdsecurity/appsec-bot-challenge-exclude-monitoring.yaml create mode 100644 appsec-configs/crowdsecurity/appsec-bot-challenge-exclude-search-engines.yaml create mode 100644 appsec-configs/crowdsecurity/appsec-bot-challenge-exclude-social.yaml delete mode 100644 appsec-rules/crowdsecurity/appsec-bot-legit-ai-crawlers.yaml delete mode 100644 appsec-rules/crowdsecurity/appsec-bot-legit-monitoring.yaml delete mode 100644 appsec-rules/crowdsecurity/appsec-bot-legit-search-engines.yaml delete mode 100644 appsec-rules/crowdsecurity/appsec-bot-legit-social.yaml diff --git a/appsec-configs/crowdsecurity/appsec-bot-challenge-exclude-ai-crawlers.yaml b/appsec-configs/crowdsecurity/appsec-bot-challenge-exclude-ai-crawlers.yaml new file mode 100644 index 00000000000..981159ddaf6 --- /dev/null +++ b/appsec-configs/crowdsecurity/appsec-bot-challenge-exclude-ai-crawlers.yaml @@ -0,0 +1,32 @@ +name: crowdsecurity/appsec-bot-challenge-exclude-ai-crawlers +# Skip the challenge for verified AI crawlers (matched against their published IP/rDNS ranges). +# Do not edit this file to add your own exclusions, create a custom config. +inband: + pre_eval: + - filter: MatchKnownBot(req.RemoteAddr, req.UserAgent(), req.URL.Path, "legit_bots/gptbot.json") + apply: + - ExemptFromChallenge("gptbot") + - filter: MatchKnownBot(req.RemoteAddr, req.UserAgent(), req.URL.Path, "legit_bots/openai-searchbot.json") + apply: + - ExemptFromChallenge("openai-searchbot") + - filter: MatchKnownBot(req.RemoteAddr, req.UserAgent(), req.URL.Path, "legit_bots/openai-chatgpt-user.json") + apply: + - ExemptFromChallenge("openai-chatgpt-user") + - filter: MatchKnownBot(req.RemoteAddr, req.UserAgent(), req.URL.Path, "legit_bots/perplexitybot.json") + apply: + - ExemptFromChallenge("perplexitybot") + +# Declares the datafiles so crowdsec downloads them. +data: + - source_url: https://hub-data.crowdsec.net/whitelists/benign_bots/legit_bots/gptbot.json + dest_file: legit_bots/gptbot.json + type: bots + - source_url: https://hub-data.crowdsec.net/whitelists/benign_bots/legit_bots/openai-searchbot.json + dest_file: legit_bots/openai-searchbot.json + type: bots + - source_url: https://hub-data.crowdsec.net/whitelists/benign_bots/legit_bots/openai-chatgpt-user.json + dest_file: legit_bots/openai-chatgpt-user.json + type: bots + - source_url: https://hub-data.crowdsec.net/whitelists/benign_bots/legit_bots/perplexitybot.json + dest_file: legit_bots/perplexitybot.json + type: bots diff --git a/appsec-configs/crowdsecurity/appsec-bot-challenge-exclude-api.yaml b/appsec-configs/crowdsecurity/appsec-bot-challenge-exclude-api.yaml index 6756a1bdb28..bbae82e522b 100644 --- a/appsec-configs/crowdsecurity/appsec-bot-challenge-exclude-api.yaml +++ b/appsec-configs/crowdsecurity/appsec-bot-challenge-exclude-api.yaml @@ -12,4 +12,4 @@ inband: req.URL.Path startsWith '/oauth/' || req.URL.Path startsWith '/.netlify/functions/' || req.URL.Path startsWith '/_next/data/' apply: - - ExemptFromChallenge() + - ExemptFromChallenge("api") diff --git a/appsec-configs/crowdsecurity/appsec-bot-challenge-exclude-crawler-files.yaml b/appsec-configs/crowdsecurity/appsec-bot-challenge-exclude-crawler-files.yaml index 6ab9e701339..ac9bb94b574 100644 --- a/appsec-configs/crowdsecurity/appsec-bot-challenge-exclude-crawler-files.yaml +++ b/appsec-configs/crowdsecurity/appsec-bot-challenge-exclude-crawler-files.yaml @@ -7,4 +7,4 @@ inband: req.URL.Path in ['/robots.txt', '/ads.txt', '/app-ads.txt', '/sitemap.xml', '/apple-app-site-association', '/security.txt', '/humans.txt'] || req.URL.Path startsWith '/.well-known/' apply: - - ExemptFromChallenge() + - ExemptFromChallenge("crawler-files") diff --git a/appsec-configs/crowdsecurity/appsec-bot-challenge-exclude-feeds.yaml b/appsec-configs/crowdsecurity/appsec-bot-challenge-exclude-feeds.yaml index 7aa6d972fac..0561f6c49a0 100644 --- a/appsec-configs/crowdsecurity/appsec-bot-challenge-exclude-feeds.yaml +++ b/appsec-configs/crowdsecurity/appsec-bot-challenge-exclude-feeds.yaml @@ -7,4 +7,4 @@ inband: req.URL.Path in ['/feed', '/rss', '/atom.xml', '/feed.xml', '/rss.xml', '/index.xml', '/feed.atom'] || req.URL.Path startsWith '/feed/' || req.URL.Path startsWith '/rss/' apply: - - ExemptFromChallenge() + - ExemptFromChallenge("feeds") diff --git a/appsec-configs/crowdsecurity/appsec-bot-challenge-exclude-monitoring.yaml b/appsec-configs/crowdsecurity/appsec-bot-challenge-exclude-monitoring.yaml new file mode 100644 index 00000000000..43988ccce05 --- /dev/null +++ b/appsec-configs/crowdsecurity/appsec-bot-challenge-exclude-monitoring.yaml @@ -0,0 +1,32 @@ +name: crowdsecurity/appsec-bot-challenge-exclude-monitoring +# Skip the challenge for verified uptime/monitoring bots (matched against their published IP/rDNS ranges). +# Do not edit this file to add your own exclusions, create a custom config. +inband: + pre_eval: + - filter: MatchKnownBot(req.RemoteAddr, req.UserAgent(), req.URL.Path, "legit_bots/uptimerobot.json") + apply: + - ExemptFromChallenge("uptimerobot") + - filter: MatchKnownBot(req.RemoteAddr, req.UserAgent(), req.URL.Path, "legit_bots/cookiebot.json") + apply: + - ExemptFromChallenge("cookiebot") + - filter: MatchKnownBot(req.RemoteAddr, req.UserAgent(), req.URL.Path, "legit_bots/datadog.json") + apply: + - ExemptFromChallenge("datadog") + - filter: MatchKnownBot(req.RemoteAddr, req.UserAgent(), req.URL.Path, "legit_bots/pagerduty.json") + apply: + - ExemptFromChallenge("pagerduty") + +# Declares the datafiles so crowdsec downloads them. +data: + - source_url: https://hub-data.crowdsec.net/whitelists/benign_bots/legit_bots/uptimerobot.json + dest_file: legit_bots/uptimerobot.json + type: bots + - source_url: https://hub-data.crowdsec.net/whitelists/benign_bots/legit_bots/cookiebot.json + dest_file: legit_bots/cookiebot.json + type: bots + - source_url: https://hub-data.crowdsec.net/whitelists/benign_bots/legit_bots/datadog.json + dest_file: legit_bots/datadog.json + type: bots + - source_url: https://hub-data.crowdsec.net/whitelists/benign_bots/legit_bots/pagerduty.json + dest_file: legit_bots/pagerduty.json + type: bots diff --git a/appsec-configs/crowdsecurity/appsec-bot-challenge-exclude-search-engines.yaml b/appsec-configs/crowdsecurity/appsec-bot-challenge-exclude-search-engines.yaml new file mode 100644 index 00000000000..8a9ab86989e --- /dev/null +++ b/appsec-configs/crowdsecurity/appsec-bot-challenge-exclude-search-engines.yaml @@ -0,0 +1,74 @@ +name: crowdsecurity/appsec-bot-challenge-exclude-search-engines +# Skip the challenge for verified search-engine crawlers (matched against their published IP/rDNS ranges). +# Do not edit this file to add your own exclusions, create a custom config. +inband: + pre_eval: + - filter: MatchKnownBot(req.RemoteAddr, req.UserAgent(), req.URL.Path, "legit_bots/googlebot.json") + apply: + - ExemptFromChallenge("googlebot") + - filter: MatchKnownBot(req.RemoteAddr, req.UserAgent(), req.URL.Path, "legit_bots/bingbot.json") + apply: + - ExemptFromChallenge("bingbot") + - filter: MatchKnownBot(req.RemoteAddr, req.UserAgent(), req.URL.Path, "legit_bots/applebot.json") + apply: + - ExemptFromChallenge("applebot") + - filter: MatchKnownBot(req.RemoteAddr, req.UserAgent(), req.URL.Path, "legit_bots/amazonbot.json") + apply: + - ExemptFromChallenge("amazonbot") + - filter: MatchKnownBot(req.RemoteAddr, req.UserAgent(), req.URL.Path, "legit_bots/yandex.json") + apply: + - ExemptFromChallenge("yandex") + - filter: MatchKnownBot(req.RemoteAddr, req.UserAgent(), req.URL.Path, "legit_bots/baidu.json") + apply: + - ExemptFromChallenge("baidu") + - filter: MatchKnownBot(req.RemoteAddr, req.UserAgent(), req.URL.Path, "legit_bots/yahoo.json") + apply: + - ExemptFromChallenge("yahoo") + - filter: MatchKnownBot(req.RemoteAddr, req.UserAgent(), req.URL.Path, "legit_bots/sogou.json") + apply: + - ExemptFromChallenge("sogou") + - filter: MatchKnownBot(req.RemoteAddr, req.UserAgent(), req.URL.Path, "legit_bots/qwant.json") + apply: + - ExemptFromChallenge("qwant") + - filter: MatchKnownBot(req.RemoteAddr, req.UserAgent(), req.URL.Path, "legit_bots/babbar.json") + apply: + - ExemptFromChallenge("babbar") + - filter: MatchKnownBot(req.RemoteAddr, req.UserAgent(), req.URL.Path, "legit_bots/duckduckbot.json") + apply: + - ExemptFromChallenge("duckduckbot") + +# Declares the datafiles so crowdsec downloads them. +data: + - source_url: https://hub-data.crowdsec.net/whitelists/benign_bots/legit_bots/googlebot.json + dest_file: legit_bots/googlebot.json + type: bots + - source_url: https://hub-data.crowdsec.net/whitelists/benign_bots/legit_bots/bingbot.json + dest_file: legit_bots/bingbot.json + type: bots + - source_url: https://hub-data.crowdsec.net/whitelists/benign_bots/legit_bots/applebot.json + dest_file: legit_bots/applebot.json + type: bots + - source_url: https://hub-data.crowdsec.net/whitelists/benign_bots/legit_bots/amazonbot.json + dest_file: legit_bots/amazonbot.json + type: bots + - source_url: https://hub-data.crowdsec.net/whitelists/benign_bots/legit_bots/yandex.json + dest_file: legit_bots/yandex.json + type: bots + - source_url: https://hub-data.crowdsec.net/whitelists/benign_bots/legit_bots/baidu.json + dest_file: legit_bots/baidu.json + type: bots + - source_url: https://hub-data.crowdsec.net/whitelists/benign_bots/legit_bots/yahoo.json + dest_file: legit_bots/yahoo.json + type: bots + - source_url: https://hub-data.crowdsec.net/whitelists/benign_bots/legit_bots/sogou.json + dest_file: legit_bots/sogou.json + type: bots + - source_url: https://hub-data.crowdsec.net/whitelists/benign_bots/legit_bots/qwant.json + dest_file: legit_bots/qwant.json + type: bots + - source_url: https://hub-data.crowdsec.net/whitelists/benign_bots/legit_bots/babbar.json + dest_file: legit_bots/babbar.json + type: bots + - source_url: https://hub-data.crowdsec.net/whitelists/benign_bots/legit_bots/duckduckbot.json + dest_file: legit_bots/duckduckbot.json + type: bots diff --git a/appsec-configs/crowdsecurity/appsec-bot-challenge-exclude-social.yaml b/appsec-configs/crowdsecurity/appsec-bot-challenge-exclude-social.yaml new file mode 100644 index 00000000000..7f11b8573e8 --- /dev/null +++ b/appsec-configs/crowdsecurity/appsec-bot-challenge-exclude-social.yaml @@ -0,0 +1,38 @@ +name: crowdsecurity/appsec-bot-challenge-exclude-social +# Skip the challenge for verified social / link-preview bots (matched against their published IP/rDNS ranges). +# Do not edit this file to add your own exclusions, create a custom config. +inband: + pre_eval: + - filter: MatchKnownBot(req.RemoteAddr, req.UserAgent(), req.URL.Path, "legit_bots/meta.json") + apply: + - ExemptFromChallenge("meta") + - filter: MatchKnownBot(req.RemoteAddr, req.UserAgent(), req.URL.Path, "legit_bots/discord.json") + apply: + - ExemptFromChallenge("discord") + - filter: MatchKnownBot(req.RemoteAddr, req.UserAgent(), req.URL.Path, "legit_bots/telegram.json") + apply: + - ExemptFromChallenge("telegram") + - filter: MatchKnownBot(req.RemoteAddr, req.UserAgent(), req.URL.Path, "legit_bots/twitterbot.json") + apply: + - ExemptFromChallenge("twitterbot") + - filter: MatchKnownBot(req.RemoteAddr, req.UserAgent(), req.URL.Path, "legit_bots/pinterest.json") + apply: + - ExemptFromChallenge("pinterest") + +# Declares the datafiles so crowdsec downloads them. +data: + - source_url: https://hub-data.crowdsec.net/whitelists/benign_bots/legit_bots/meta.json + dest_file: legit_bots/meta.json + type: bots + - source_url: https://hub-data.crowdsec.net/whitelists/benign_bots/legit_bots/discord.json + dest_file: legit_bots/discord.json + type: bots + - source_url: https://hub-data.crowdsec.net/whitelists/benign_bots/legit_bots/telegram.json + dest_file: legit_bots/telegram.json + type: bots + - source_url: https://hub-data.crowdsec.net/whitelists/benign_bots/legit_bots/twitterbot.json + dest_file: legit_bots/twitterbot.json + type: bots + - source_url: https://hub-data.crowdsec.net/whitelists/benign_bots/legit_bots/pinterest.json + dest_file: legit_bots/pinterest.json + type: bots diff --git a/appsec-configs/crowdsecurity/appsec-bot-challenge-exclude-static.yaml b/appsec-configs/crowdsecurity/appsec-bot-challenge-exclude-static.yaml index 408d9c85e9e..6bfa5335620 100644 --- a/appsec-configs/crowdsecurity/appsec-bot-challenge-exclude-static.yaml +++ b/appsec-configs/crowdsecurity/appsec-bot-challenge-exclude-static.yaml @@ -7,4 +7,4 @@ inband: req.URL.Path matches '\\.(css|js|mjs|map|png|jpe?g|gif|svg|webp|avif|ico|bmp|woff2?|ttf|otf|eot|mp4|m4v|webm|mov|mp3|m4a|wav|ogg|oga|ogv|flac|aac|webmanifest)$' || req.URL.Path in ['/manifest.json', '/browserconfig.xml'] apply: - - ExemptFromChallenge() + - ExemptFromChallenge("static") diff --git a/appsec-configs/crowdsecurity/appsec-bot-challenge-exclude-webhooks.yaml b/appsec-configs/crowdsecurity/appsec-bot-challenge-exclude-webhooks.yaml index 483fbe6e5d6..abfbc1a62c8 100644 --- a/appsec-configs/crowdsecurity/appsec-bot-challenge-exclude-webhooks.yaml +++ b/appsec-configs/crowdsecurity/appsec-bot-challenge-exclude-webhooks.yaml @@ -5,4 +5,4 @@ inband: pre_eval: - filter: "req.URL.Path startsWith '/webhooks/'" apply: - - ExemptFromChallenge() + - ExemptFromChallenge("webhooks") diff --git a/appsec-configs/crowdsecurity/appsec-bot-challenge-simple.yaml b/appsec-configs/crowdsecurity/appsec-bot-challenge-simple.yaml index caeb889bded..73989ab0d82 100644 --- a/appsec-configs/crowdsecurity/appsec-bot-challenge-simple.yaml +++ b/appsec-configs/crowdsecurity/appsec-bot-challenge-simple.yaml @@ -1,9 +1,10 @@ name: crowdsecurity/appsec-bot-challenge-simple inband: post_eval: - # Skip the challenge for verified good bots and for requests a - # well-known-path exclusion config flagged via ExemptFromChallenge(). - - filter: "!IsLegitimateBot(req.RemoteAddr, req.UserAgent(), req.URL.Path)" + # Challenge every request. Requests a pre_eval exclusion config flagged via + # ExemptFromChallenge() (verified bots, well-known paths) are skipped by + # SendChallenge itself, so no explicit bot check is needed here. + - filter: "true" apply: - SendChallenge() on_challenge_submit: diff --git a/appsec-rules/crowdsecurity/appsec-bot-legit-ai-crawlers.yaml b/appsec-rules/crowdsecurity/appsec-bot-legit-ai-crawlers.yaml deleted file mode 100644 index 50945095051..00000000000 --- a/appsec-rules/crowdsecurity/appsec-bot-legit-ai-crawlers.yaml +++ /dev/null @@ -1,18 +0,0 @@ -name: crowdsecurity/appsec-bot-legit-ai-crawlers - -# Declares the legitimate AI-crawler datafiles so crowdsec downloads them. -# Do not edit this file to add your own exclusions, create a custom config. - -data: - - source_url: https://hub-data.crowdsec.net/whitelists/benign_bots/legit_bots/gptbot.json - dest_file: legit_bots/gptbot.json - type: bots - - source_url: https://hub-data.crowdsec.net/whitelists/benign_bots/legit_bots/openai-searchbot.json - dest_file: legit_bots/openai-searchbot.json - type: bots - - source_url: https://hub-data.crowdsec.net/whitelists/benign_bots/legit_bots/openai-chatgpt-user.json - dest_file: legit_bots/openai-chatgpt-user.json - type: bots - - source_url: https://hub-data.crowdsec.net/whitelists/benign_bots/legit_bots/perplexitybot.json - dest_file: legit_bots/perplexitybot.json - type: bots diff --git a/appsec-rules/crowdsecurity/appsec-bot-legit-monitoring.yaml b/appsec-rules/crowdsecurity/appsec-bot-legit-monitoring.yaml deleted file mode 100644 index 3758c39f2c5..00000000000 --- a/appsec-rules/crowdsecurity/appsec-bot-legit-monitoring.yaml +++ /dev/null @@ -1,18 +0,0 @@ -name: crowdsecurity/appsec-bot-legit-monitoring - -# Declares the legitimate uptime/monitoring datafiles so crowdsec downloads them -# Do not edit this file to add your own exclusions, create a custom config. - -data: - - source_url: https://hub-data.crowdsec.net/whitelists/benign_bots/legit_bots/uptimerobot.json - dest_file: legit_bots/uptimerobot.json - type: bots - - source_url: https://hub-data.crowdsec.net/whitelists/benign_bots/legit_bots/cookiebot.json - dest_file: legit_bots/cookiebot.json - type: bots - - source_url: https://hub-data.crowdsec.net/whitelists/benign_bots/legit_bots/datadog.json - dest_file: legit_bots/datadog.json - type: bots - - source_url: https://hub-data.crowdsec.net/whitelists/benign_bots/legit_bots/pagerduty.json - dest_file: legit_bots/pagerduty.json - type: bots diff --git a/appsec-rules/crowdsecurity/appsec-bot-legit-search-engines.yaml b/appsec-rules/crowdsecurity/appsec-bot-legit-search-engines.yaml deleted file mode 100644 index e49ec821dda..00000000000 --- a/appsec-rules/crowdsecurity/appsec-bot-legit-search-engines.yaml +++ /dev/null @@ -1,39 +0,0 @@ -name: crowdsecurity/appsec-bot-legit-search-engines - -# Declares the legitimate search-engine datafiles so crowdsec downloads them -# Do not edit this file to add your own exclusions, create a custom config. - -data: - - source_url: https://hub-data.crowdsec.net/whitelists/benign_bots/legit_bots/googlebot.json - dest_file: legit_bots/googlebot.json - type: bots - - source_url: https://hub-data.crowdsec.net/whitelists/benign_bots/legit_bots/bingbot.json - dest_file: legit_bots/bingbot.json - type: bots - - source_url: https://hub-data.crowdsec.net/whitelists/benign_bots/legit_bots/applebot.json - dest_file: legit_bots/applebot.json - type: bots - - source_url: https://hub-data.crowdsec.net/whitelists/benign_bots/legit_bots/amazonbot.json - dest_file: legit_bots/amazonbot.json - type: bots - - source_url: https://hub-data.crowdsec.net/whitelists/benign_bots/legit_bots/yandex.json - dest_file: legit_bots/yandex.json - type: bots - - source_url: https://hub-data.crowdsec.net/whitelists/benign_bots/legit_bots/baidu.json - dest_file: legit_bots/baidu.json - type: bots - - source_url: https://hub-data.crowdsec.net/whitelists/benign_bots/legit_bots/yahoo.json - dest_file: legit_bots/yahoo.json - type: bots - - source_url: https://hub-data.crowdsec.net/whitelists/benign_bots/legit_bots/sogou.json - dest_file: legit_bots/sogou.json - type: bots - - source_url: https://hub-data.crowdsec.net/whitelists/benign_bots/legit_bots/qwant.json - dest_file: legit_bots/qwant.json - type: bots - - source_url: https://hub-data.crowdsec.net/whitelists/benign_bots/legit_bots/babbar.json - dest_file: legit_bots/babbar.json - type: bots - - source_url: https://hub-data.crowdsec.net/whitelists/benign_bots/legit_bots/duckduckbot.json - dest_file: legit_bots/duckduckbot.json - type: bots diff --git a/appsec-rules/crowdsecurity/appsec-bot-legit-social.yaml b/appsec-rules/crowdsecurity/appsec-bot-legit-social.yaml deleted file mode 100644 index 880f40eb19a..00000000000 --- a/appsec-rules/crowdsecurity/appsec-bot-legit-social.yaml +++ /dev/null @@ -1,20 +0,0 @@ -name: crowdsecurity/appsec-bot-legit-social - -# Declares the legitimate social / link-preview datafiles so crowdsec downloads them - -data: - - source_url: https://hub-data.crowdsec.net/whitelists/benign_bots/legit_bots/meta.json - dest_file: legit_bots/meta.json - type: bots - - source_url: https://hub-data.crowdsec.net/whitelists/benign_bots/legit_bots/discord.json - dest_file: legit_bots/discord.json - type: bots - - source_url: https://hub-data.crowdsec.net/whitelists/benign_bots/legit_bots/telegram.json - dest_file: legit_bots/telegram.json - type: bots - - source_url: https://hub-data.crowdsec.net/whitelists/benign_bots/legit_bots/twitterbot.json - dest_file: legit_bots/twitterbot.json - type: bots - - source_url: https://hub-data.crowdsec.net/whitelists/benign_bots/legit_bots/pinterest.json - dest_file: legit_bots/pinterest.json - type: bots diff --git a/collections/crowdsecurity/appsec-bot-challenge.md b/collections/crowdsecurity/appsec-bot-challenge.md index 48c03f7966c..0b78d5050c5 100644 --- a/collections/crowdsecurity/appsec-bot-challenge.md +++ b/collections/crowdsecurity/appsec-bot-challenge.md @@ -6,16 +6,16 @@ fast bot detection are rejected. What it ships: - - `crowdsecurity/appsec-bot-challenge-simple`: challenges incoming requests, skips verified good bots - and rejects challenge submissions whose fingerprint trips the bot detection. - - Verified-good-bot datafiles that back the exclusion above, split by family so you can enable only the - ones you need: - - `crowdsecurity/appsec-bot-legit-search-engines`: googlebot, bingbot, applebot, amazonbot, yandex, - baidu, yahoo, sogou, qwant, babbar, duckduckbot - - `crowdsecurity/appsec-bot-legit-ai-crawlers`: gptbot, openai-searchbot, openai-chatgpt-user, + - `crowdsecurity/appsec-bot-challenge-simple`: challenges incoming requests and rejects challenge + submissions whose fingerprint trips the bot detection. + - Verified-good-bot exclusion configs that exempt known bots from the challenge, split by family so you + can enable only the ones you need. Each config both declares the datafiles and exempts a match: + - `crowdsecurity/appsec-bot-challenge-exclude-search-engines`: googlebot, bingbot, applebot, amazonbot, + yandex, baidu, yahoo, sogou, qwant, babbar, duckduckbot + - `crowdsecurity/appsec-bot-challenge-exclude-ai-crawlers`: gptbot, openai-searchbot, openai-chatgpt-user, perplexitybot - - `crowdsecurity/appsec-bot-legit-social`: meta, discord, telegram, twitterbot, pinterest - - `crowdsecurity/appsec-bot-legit-monitoring`: uptimerobot, cookiebot, datadog, pagerduty + - `crowdsecurity/appsec-bot-challenge-exclude-social`: meta, discord, telegram, twitterbot, pinterest + - `crowdsecurity/appsec-bot-challenge-exclude-monitoring`: uptimerobot, cookiebot, datadog, pagerduty A bot is exempted **only** when it can be network-verified (dns or ip range). - Path exclusion configs that let machine-facing or non-navigational requests through without a diff --git a/collections/crowdsecurity/appsec-bot-challenge.yaml b/collections/crowdsecurity/appsec-bot-challenge.yaml index a8392688855..7269d2cd676 100644 --- a/collections/crowdsecurity/appsec-bot-challenge.yaml +++ b/collections/crowdsecurity/appsec-bot-challenge.yaml @@ -9,11 +9,10 @@ appsec-configs: - crowdsecurity/appsec-bot-challenge-exclude-webhooks - crowdsecurity/appsec-bot-challenge-exclude-static - crowdsecurity/appsec-bot-challenge-exclude-api -appsec-rules: - - crowdsecurity/appsec-bot-legit-search-engines - - crowdsecurity/appsec-bot-legit-ai-crawlers - - crowdsecurity/appsec-bot-legit-social - - crowdsecurity/appsec-bot-legit-monitoring + - crowdsecurity/appsec-bot-challenge-exclude-search-engines + - crowdsecurity/appsec-bot-challenge-exclude-ai-crawlers + - crowdsecurity/appsec-bot-challenge-exclude-social + - crowdsecurity/appsec-bot-challenge-exclude-monitoring scenarios: - crowdsecurity/appsec-bot-detected - crowdsecurity/appsec-bot-challenge-too-many-requests From 034df7ea95368b823e2188af5e2ee5002104bbb7 Mon Sep 17 00:00:00 2001 From: GitHub Action Date: Wed, 15 Jul 2026 13:44:36 +0000 Subject: [PATCH 36/36] Update index --- .index.json | 194 +++++++++++++++++++++++++++------------------------- 1 file changed, 100 insertions(+), 94 deletions(-) diff --git a/.index.json b/.index.json index 17f4f6b5c8a..8e4401a4f20 100644 --- a/.index.json +++ b/.index.json @@ -1,24 +1,41 @@ { "appsec-configs": { + "crowdsecurity/appsec-bot-challenge-exclude-ai-crawlers": { + "author": "crowdsecurity", + "content": "bmFtZTogY3Jvd2RzZWN1cml0eS9hcHBzZWMtYm90LWNoYWxsZW5nZS1leGNsdWRlLWFpLWNyYXdsZXJzCiMgU2tpcCB0aGUgY2hhbGxlbmdlIGZvciB2ZXJpZmllZCBBSSBjcmF3bGVycyAobWF0Y2hlZCBhZ2FpbnN0IHRoZWlyIHB1Ymxpc2hlZCBJUC9yRE5TIHJhbmdlcykuCiMgRG8gbm90IGVkaXQgdGhpcyBmaWxlIHRvIGFkZCB5b3VyIG93biBleGNsdXNpb25zLCBjcmVhdGUgYSBjdXN0b20gY29uZmlnLgppbmJhbmQ6CiAgcHJlX2V2YWw6CiAgICAtIGZpbHRlcjogTWF0Y2hLbm93bkJvdChyZXEuUmVtb3RlQWRkciwgcmVxLlVzZXJBZ2VudCgpLCByZXEuVVJMLlBhdGgsICJsZWdpdF9ib3RzL2dwdGJvdC5qc29uIikKICAgICAgYXBwbHk6CiAgICAgICAgLSBFeGVtcHRGcm9tQ2hhbGxlbmdlKCJncHRib3QiKQogICAgLSBmaWx0ZXI6IE1hdGNoS25vd25Cb3QocmVxLlJlbW90ZUFkZHIsIHJlcS5Vc2VyQWdlbnQoKSwgcmVxLlVSTC5QYXRoLCAibGVnaXRfYm90cy9vcGVuYWktc2VhcmNoYm90Lmpzb24iKQogICAgICBhcHBseToKICAgICAgICAtIEV4ZW1wdEZyb21DaGFsbGVuZ2UoIm9wZW5haS1zZWFyY2hib3QiKQogICAgLSBmaWx0ZXI6IE1hdGNoS25vd25Cb3QocmVxLlJlbW90ZUFkZHIsIHJlcS5Vc2VyQWdlbnQoKSwgcmVxLlVSTC5QYXRoLCAibGVnaXRfYm90cy9vcGVuYWktY2hhdGdwdC11c2VyLmpzb24iKQogICAgICBhcHBseToKICAgICAgICAtIEV4ZW1wdEZyb21DaGFsbGVuZ2UoIm9wZW5haS1jaGF0Z3B0LXVzZXIiKQogICAgLSBmaWx0ZXI6IE1hdGNoS25vd25Cb3QocmVxLlJlbW90ZUFkZHIsIHJlcS5Vc2VyQWdlbnQoKSwgcmVxLlVSTC5QYXRoLCAibGVnaXRfYm90cy9wZXJwbGV4aXR5Ym90Lmpzb24iKQogICAgICBhcHBseToKICAgICAgICAtIEV4ZW1wdEZyb21DaGFsbGVuZ2UoInBlcnBsZXhpdHlib3QiKQoKIyBEZWNsYXJlcyB0aGUgZGF0YWZpbGVzIHNvIGNyb3dkc2VjIGRvd25sb2FkcyB0aGVtLgpkYXRhOgogIC0gc291cmNlX3VybDogaHR0cHM6Ly9odWItZGF0YS5jcm93ZHNlYy5uZXQvd2hpdGVsaXN0cy9iZW5pZ25fYm90cy9sZWdpdF9ib3RzL2dwdGJvdC5qc29uCiAgICBkZXN0X2ZpbGU6IGxlZ2l0X2JvdHMvZ3B0Ym90Lmpzb24KICAgIHR5cGU6IGJvdHMKICAtIHNvdXJjZV91cmw6IGh0dHBzOi8vaHViLWRhdGEuY3Jvd2RzZWMubmV0L3doaXRlbGlzdHMvYmVuaWduX2JvdHMvbGVnaXRfYm90cy9vcGVuYWktc2VhcmNoYm90Lmpzb24KICAgIGRlc3RfZmlsZTogbGVnaXRfYm90cy9vcGVuYWktc2VhcmNoYm90Lmpzb24KICAgIHR5cGU6IGJvdHMKICAtIHNvdXJjZV91cmw6IGh0dHBzOi8vaHViLWRhdGEuY3Jvd2RzZWMubmV0L3doaXRlbGlzdHMvYmVuaWduX2JvdHMvbGVnaXRfYm90cy9vcGVuYWktY2hhdGdwdC11c2VyLmpzb24KICAgIGRlc3RfZmlsZTogbGVnaXRfYm90cy9vcGVuYWktY2hhdGdwdC11c2VyLmpzb24KICAgIHR5cGU6IGJvdHMKICAtIHNvdXJjZV91cmw6IGh0dHBzOi8vaHViLWRhdGEuY3Jvd2RzZWMubmV0L3doaXRlbGlzdHMvYmVuaWduX2JvdHMvbGVnaXRfYm90cy9wZXJwbGV4aXR5Ym90Lmpzb24KICAgIGRlc3RfZmlsZTogbGVnaXRfYm90cy9wZXJwbGV4aXR5Ym90Lmpzb24KICAgIHR5cGU6IGJvdHMK", + "labels": null, + "path": "appsec-configs/crowdsecurity/appsec-bot-challenge-exclude-ai-crawlers.yaml", + "version": "0.1", + "versions": { + "0.1": { + "deprecated": false, + "digest": "0b618c73571b13e2aff599de1f24a7bffb6b0f45a6e31a94b54574091b783e36" + } + } + }, "crowdsecurity/appsec-bot-challenge-exclude-api": { "author": "crowdsecurity", - "content": "bmFtZTogY3Jvd2RzZWN1cml0eS9hcHBzZWMtYm90LWNoYWxsZW5nZS1leGNsdWRlLWFwaQojIExldCBwcm9ncmFtbWF0aWMvQVBJIGVuZHBvaW50cyB0aHJvdWdoIHdpdGhvdXQgYSBjaGFsbGVuZ2U6IGl0IHdvdWxkIGJyZWFrIHdpdGggbGVnaXRpbWF0ZSBjbGllbnRzIAojIHRoYXQgY2Fubm90IHNvbHZlIHRoZSBjaGFsbGVuZ2UuCiMgRG8gbm90IGVkaXQgdGhpcyBmaWxlIHRvIGFkZCB5b3VyIG93biBleGNsdXNpb25zLCBjcmVhdGUgYSBjdXN0b20gY29uZmlnLgppbmJhbmQ6CiAgcHJlX2V2YWw6CiAgICAtIGZpbHRlcjogPi0KICAgICAgICByZXEuVVJMLlBhdGggaW4gWycvYXBpJywgJy9ncmFwaHFsJ10gfHwKICAgICAgICByZXEuVVJMLlBhdGggc3RhcnRzV2l0aCAnL2FwaS8nIHx8IHJlcS5VUkwuUGF0aCBzdGFydHNXaXRoICcvd3AtanNvbi8nIHx8CiAgICAgICAgcmVxLlVSTC5QYXRoIHN0YXJ0c1dpdGggJy9ncmFwaHFsLycgfHwgcmVxLlVSTC5QYXRoIHN0YXJ0c1dpdGggJy9yZXN0LycgfHwKICAgICAgICByZXEuVVJMLlBhdGggc3RhcnRzV2l0aCAnL3YxLycgfHwgcmVxLlVSTC5QYXRoIHN0YXJ0c1dpdGggJy92Mi8nIHx8CiAgICAgICAgcmVxLlVSTC5QYXRoIHN0YXJ0c1dpdGggJy9vYXV0aC8nIHx8IHJlcS5VUkwuUGF0aCBzdGFydHNXaXRoICcvLm5ldGxpZnkvZnVuY3Rpb25zLycgfHwKICAgICAgICByZXEuVVJMLlBhdGggc3RhcnRzV2l0aCAnL19uZXh0L2RhdGEvJwogICAgICBhcHBseToKICAgICAgICAtIEV4ZW1wdEZyb21DaGFsbGVuZ2UoKQo=", + "content": "bmFtZTogY3Jvd2RzZWN1cml0eS9hcHBzZWMtYm90LWNoYWxsZW5nZS1leGNsdWRlLWFwaQojIExldCBwcm9ncmFtbWF0aWMvQVBJIGVuZHBvaW50cyB0aHJvdWdoIHdpdGhvdXQgYSBjaGFsbGVuZ2U6IGl0IHdvdWxkIGJyZWFrIHdpdGggbGVnaXRpbWF0ZSBjbGllbnRzIAojIHRoYXQgY2Fubm90IHNvbHZlIHRoZSBjaGFsbGVuZ2UuCiMgRG8gbm90IGVkaXQgdGhpcyBmaWxlIHRvIGFkZCB5b3VyIG93biBleGNsdXNpb25zLCBjcmVhdGUgYSBjdXN0b20gY29uZmlnLgppbmJhbmQ6CiAgcHJlX2V2YWw6CiAgICAtIGZpbHRlcjogPi0KICAgICAgICByZXEuVVJMLlBhdGggaW4gWycvYXBpJywgJy9ncmFwaHFsJ10gfHwKICAgICAgICByZXEuVVJMLlBhdGggc3RhcnRzV2l0aCAnL2FwaS8nIHx8IHJlcS5VUkwuUGF0aCBzdGFydHNXaXRoICcvd3AtanNvbi8nIHx8CiAgICAgICAgcmVxLlVSTC5QYXRoIHN0YXJ0c1dpdGggJy9ncmFwaHFsLycgfHwgcmVxLlVSTC5QYXRoIHN0YXJ0c1dpdGggJy9yZXN0LycgfHwKICAgICAgICByZXEuVVJMLlBhdGggc3RhcnRzV2l0aCAnL3YxLycgfHwgcmVxLlVSTC5QYXRoIHN0YXJ0c1dpdGggJy92Mi8nIHx8CiAgICAgICAgcmVxLlVSTC5QYXRoIHN0YXJ0c1dpdGggJy9vYXV0aC8nIHx8IHJlcS5VUkwuUGF0aCBzdGFydHNXaXRoICcvLm5ldGxpZnkvZnVuY3Rpb25zLycgfHwKICAgICAgICByZXEuVVJMLlBhdGggc3RhcnRzV2l0aCAnL19uZXh0L2RhdGEvJwogICAgICBhcHBseToKICAgICAgICAtIEV4ZW1wdEZyb21DaGFsbGVuZ2UoImFwaSIpCg==", "labels": null, "path": "appsec-configs/crowdsecurity/appsec-bot-challenge-exclude-api.yaml", - "version": "0.1", + "version": "0.2", "versions": { "0.1": { "deprecated": false, "digest": "197d83f7991eb04490a492c1a100bc0fa6efb0fb85f3ae107bad3d576fbe916e" + }, + "0.2": { + "deprecated": false, + "digest": "be87312554fb67d3918646441419b1918b7af8bb2cd031f4adae6643102342e1" } } }, "crowdsecurity/appsec-bot-challenge-exclude-crawler-files": { "author": "crowdsecurity", - "content": "bmFtZTogY3Jvd2RzZWN1cml0eS9hcHBzZWMtYm90LWNoYWxsZW5nZS1leGNsdWRlLWNyYXdsZXItZmlsZXMKIyBMZXQgd2VsbC1rbm93biBjcmF3bGVyIGZpbGVzIGZseSB0aHJvdWdoIHdpdGhvdXQgYSBjaGFsbGVuZ2UuCiMgRG8gbm90IGVkaXQgdGhpcyBmaWxlIHRvIGFkZCB5b3VyIG93biBleGNsdXNpb25zLCBjcmVhdGUgYSBjdXN0b20gY29uZmlnLgppbmJhbmQ6CiAgcHJlX2V2YWw6CiAgICAtIGZpbHRlcjogPi0KICAgICAgICByZXEuVVJMLlBhdGggaW4gWycvcm9ib3RzLnR4dCcsICcvYWRzLnR4dCcsICcvYXBwLWFkcy50eHQnLCAnL3NpdGVtYXAueG1sJywgJy9hcHBsZS1hcHAtc2l0ZS1hc3NvY2lhdGlvbicsICcvc2VjdXJpdHkudHh0JywgJy9odW1hbnMudHh0J10gfHwKICAgICAgICByZXEuVVJMLlBhdGggc3RhcnRzV2l0aCAnLy53ZWxsLWtub3duLycKICAgICAgYXBwbHk6CiAgICAgICAgLSBFeGVtcHRGcm9tQ2hhbGxlbmdlKCkK", + "content": "bmFtZTogY3Jvd2RzZWN1cml0eS9hcHBzZWMtYm90LWNoYWxsZW5nZS1leGNsdWRlLWNyYXdsZXItZmlsZXMKIyBMZXQgd2VsbC1rbm93biBjcmF3bGVyIGZpbGVzIGZseSB0aHJvdWdoIHdpdGhvdXQgYSBjaGFsbGVuZ2UuCiMgRG8gbm90IGVkaXQgdGhpcyBmaWxlIHRvIGFkZCB5b3VyIG93biBleGNsdXNpb25zLCBjcmVhdGUgYSBjdXN0b20gY29uZmlnLgppbmJhbmQ6CiAgcHJlX2V2YWw6CiAgICAtIGZpbHRlcjogPi0KICAgICAgICByZXEuVVJMLlBhdGggaW4gWycvcm9ib3RzLnR4dCcsICcvYWRzLnR4dCcsICcvYXBwLWFkcy50eHQnLCAnL3NpdGVtYXAueG1sJywgJy9hcHBsZS1hcHAtc2l0ZS1hc3NvY2lhdGlvbicsICcvc2VjdXJpdHkudHh0JywgJy9odW1hbnMudHh0J10gfHwKICAgICAgICByZXEuVVJMLlBhdGggc3RhcnRzV2l0aCAnLy53ZWxsLWtub3duLycKICAgICAgYXBwbHk6CiAgICAgICAgLSBFeGVtcHRGcm9tQ2hhbGxlbmdlKCJjcmF3bGVyLWZpbGVzIikK", "labels": null, "path": "appsec-configs/crowdsecurity/appsec-bot-challenge-exclude-crawler-files.yaml", - "version": "0.3", + "version": "0.4", "versions": { "0.1": { "deprecated": false, @@ -31,15 +48,19 @@ "0.3": { "deprecated": false, "digest": "2141075edbc3fa56f5f9daa2dd4026d4707c79ac9feb6cd5bb42c5ca0f0794d5" + }, + "0.4": { + "deprecated": false, + "digest": "21c72e5fcc8d28ccd5f02131693ea61d18f52335114d9f3fb22dda840eb6b61c" } } }, "crowdsecurity/appsec-bot-challenge-exclude-feeds": { "author": "crowdsecurity", - "content": "bmFtZTogY3Jvd2RzZWN1cml0eS9hcHBzZWMtYm90LWNoYWxsZW5nZS1leGNsdWRlLWZlZWRzCiMgTGV0IHN5bmRpY2F0aW9uIGZlZWQgZW5kcG9pbnRzIGZseSB0aHJvdWdoIHdpdGhvdXQgYSBjaGFsbGVuZ2UuCiMgRG8gbm90IGVkaXQgdGhpcyBmaWxlIHRvIGFkZCB5b3VyIG93biBleGNsdXNpb25zLCBjcmVhdGUgYSBjdXN0b20gY29uZmlnLgppbmJhbmQ6CiAgcHJlX2V2YWw6CiAgICAtIGZpbHRlcjogPi0KICAgICAgICByZXEuVVJMLlBhdGggaW4gWycvZmVlZCcsICcvcnNzJywgJy9hdG9tLnhtbCcsICcvZmVlZC54bWwnLCAnL3Jzcy54bWwnLCAnL2luZGV4LnhtbCcsICcvZmVlZC5hdG9tJ10gfHwKICAgICAgICByZXEuVVJMLlBhdGggc3RhcnRzV2l0aCAnL2ZlZWQvJyB8fCByZXEuVVJMLlBhdGggc3RhcnRzV2l0aCAnL3Jzcy8nCiAgICAgIGFwcGx5OgogICAgICAgIC0gRXhlbXB0RnJvbUNoYWxsZW5nZSgpCg==", + "content": "bmFtZTogY3Jvd2RzZWN1cml0eS9hcHBzZWMtYm90LWNoYWxsZW5nZS1leGNsdWRlLWZlZWRzCiMgTGV0IHN5bmRpY2F0aW9uIGZlZWQgZW5kcG9pbnRzIGZseSB0aHJvdWdoIHdpdGhvdXQgYSBjaGFsbGVuZ2UuCiMgRG8gbm90IGVkaXQgdGhpcyBmaWxlIHRvIGFkZCB5b3VyIG93biBleGNsdXNpb25zLCBjcmVhdGUgYSBjdXN0b20gY29uZmlnLgppbmJhbmQ6CiAgcHJlX2V2YWw6CiAgICAtIGZpbHRlcjogPi0KICAgICAgICByZXEuVVJMLlBhdGggaW4gWycvZmVlZCcsICcvcnNzJywgJy9hdG9tLnhtbCcsICcvZmVlZC54bWwnLCAnL3Jzcy54bWwnLCAnL2luZGV4LnhtbCcsICcvZmVlZC5hdG9tJ10gfHwKICAgICAgICByZXEuVVJMLlBhdGggc3RhcnRzV2l0aCAnL2ZlZWQvJyB8fCByZXEuVVJMLlBhdGggc3RhcnRzV2l0aCAnL3Jzcy8nCiAgICAgIGFwcGx5OgogICAgICAgIC0gRXhlbXB0RnJvbUNoYWxsZW5nZSgiZmVlZHMiKQo=", "labels": null, "path": "appsec-configs/crowdsecurity/appsec-bot-challenge-exclude-feeds.yaml", - "version": "0.3", + "version": "0.4", "versions": { "0.1": { "deprecated": false, @@ -52,15 +73,58 @@ "0.3": { "deprecated": false, "digest": "b1d32602201d25e4e58b29d5769dd7238f28848bf35eec5a8ee7df34060b42ac" + }, + "0.4": { + "deprecated": false, + "digest": "b5e1cf24f314948f3b84c219bc77d1ec719e1a8c7d06813b3789107dd6e1eea7" + } + } + }, + "crowdsecurity/appsec-bot-challenge-exclude-monitoring": { + "author": "crowdsecurity", + "content": "bmFtZTogY3Jvd2RzZWN1cml0eS9hcHBzZWMtYm90LWNoYWxsZW5nZS1leGNsdWRlLW1vbml0b3JpbmcKIyBTa2lwIHRoZSBjaGFsbGVuZ2UgZm9yIHZlcmlmaWVkIHVwdGltZS9tb25pdG9yaW5nIGJvdHMgKG1hdGNoZWQgYWdhaW5zdCB0aGVpciBwdWJsaXNoZWQgSVAvckROUyByYW5nZXMpLgojIERvIG5vdCBlZGl0IHRoaXMgZmlsZSB0byBhZGQgeW91ciBvd24gZXhjbHVzaW9ucywgY3JlYXRlIGEgY3VzdG9tIGNvbmZpZy4KaW5iYW5kOgogIHByZV9ldmFsOgogICAgLSBmaWx0ZXI6IE1hdGNoS25vd25Cb3QocmVxLlJlbW90ZUFkZHIsIHJlcS5Vc2VyQWdlbnQoKSwgcmVxLlVSTC5QYXRoLCAibGVnaXRfYm90cy91cHRpbWVyb2JvdC5qc29uIikKICAgICAgYXBwbHk6CiAgICAgICAgLSBFeGVtcHRGcm9tQ2hhbGxlbmdlKCJ1cHRpbWVyb2JvdCIpCiAgICAtIGZpbHRlcjogTWF0Y2hLbm93bkJvdChyZXEuUmVtb3RlQWRkciwgcmVxLlVzZXJBZ2VudCgpLCByZXEuVVJMLlBhdGgsICJsZWdpdF9ib3RzL2Nvb2tpZWJvdC5qc29uIikKICAgICAgYXBwbHk6CiAgICAgICAgLSBFeGVtcHRGcm9tQ2hhbGxlbmdlKCJjb29raWVib3QiKQogICAgLSBmaWx0ZXI6IE1hdGNoS25vd25Cb3QocmVxLlJlbW90ZUFkZHIsIHJlcS5Vc2VyQWdlbnQoKSwgcmVxLlVSTC5QYXRoLCAibGVnaXRfYm90cy9kYXRhZG9nLmpzb24iKQogICAgICBhcHBseToKICAgICAgICAtIEV4ZW1wdEZyb21DaGFsbGVuZ2UoImRhdGFkb2ciKQogICAgLSBmaWx0ZXI6IE1hdGNoS25vd25Cb3QocmVxLlJlbW90ZUFkZHIsIHJlcS5Vc2VyQWdlbnQoKSwgcmVxLlVSTC5QYXRoLCAibGVnaXRfYm90cy9wYWdlcmR1dHkuanNvbiIpCiAgICAgIGFwcGx5OgogICAgICAgIC0gRXhlbXB0RnJvbUNoYWxsZW5nZSgicGFnZXJkdXR5IikKCiMgRGVjbGFyZXMgdGhlIGRhdGFmaWxlcyBzbyBjcm93ZHNlYyBkb3dubG9hZHMgdGhlbS4KZGF0YToKICAtIHNvdXJjZV91cmw6IGh0dHBzOi8vaHViLWRhdGEuY3Jvd2RzZWMubmV0L3doaXRlbGlzdHMvYmVuaWduX2JvdHMvbGVnaXRfYm90cy91cHRpbWVyb2JvdC5qc29uCiAgICBkZXN0X2ZpbGU6IGxlZ2l0X2JvdHMvdXB0aW1lcm9ib3QuanNvbgogICAgdHlwZTogYm90cwogIC0gc291cmNlX3VybDogaHR0cHM6Ly9odWItZGF0YS5jcm93ZHNlYy5uZXQvd2hpdGVsaXN0cy9iZW5pZ25fYm90cy9sZWdpdF9ib3RzL2Nvb2tpZWJvdC5qc29uCiAgICBkZXN0X2ZpbGU6IGxlZ2l0X2JvdHMvY29va2llYm90Lmpzb24KICAgIHR5cGU6IGJvdHMKICAtIHNvdXJjZV91cmw6IGh0dHBzOi8vaHViLWRhdGEuY3Jvd2RzZWMubmV0L3doaXRlbGlzdHMvYmVuaWduX2JvdHMvbGVnaXRfYm90cy9kYXRhZG9nLmpzb24KICAgIGRlc3RfZmlsZTogbGVnaXRfYm90cy9kYXRhZG9nLmpzb24KICAgIHR5cGU6IGJvdHMKICAtIHNvdXJjZV91cmw6IGh0dHBzOi8vaHViLWRhdGEuY3Jvd2RzZWMubmV0L3doaXRlbGlzdHMvYmVuaWduX2JvdHMvbGVnaXRfYm90cy9wYWdlcmR1dHkuanNvbgogICAgZGVzdF9maWxlOiBsZWdpdF9ib3RzL3BhZ2VyZHV0eS5qc29uCiAgICB0eXBlOiBib3RzCg==", + "labels": null, + "path": "appsec-configs/crowdsecurity/appsec-bot-challenge-exclude-monitoring.yaml", + "version": "0.1", + "versions": { + "0.1": { + "deprecated": false, + "digest": "f1ef0ba521f3fc4b9e617d57379150a9e0f7ce600d3b5d0b35d46bd91ce814db" + } + } + }, + "crowdsecurity/appsec-bot-challenge-exclude-search-engines": { + "author": "crowdsecurity", + "content": "bmFtZTogY3Jvd2RzZWN1cml0eS9hcHBzZWMtYm90LWNoYWxsZW5nZS1leGNsdWRlLXNlYXJjaC1lbmdpbmVzCiMgU2tpcCB0aGUgY2hhbGxlbmdlIGZvciB2ZXJpZmllZCBzZWFyY2gtZW5naW5lIGNyYXdsZXJzIChtYXRjaGVkIGFnYWluc3QgdGhlaXIgcHVibGlzaGVkIElQL3JETlMgcmFuZ2VzKS4KIyBEbyBub3QgZWRpdCB0aGlzIGZpbGUgdG8gYWRkIHlvdXIgb3duIGV4Y2x1c2lvbnMsIGNyZWF0ZSBhIGN1c3RvbSBjb25maWcuCmluYmFuZDoKICBwcmVfZXZhbDoKICAgIC0gZmlsdGVyOiBNYXRjaEtub3duQm90KHJlcS5SZW1vdGVBZGRyLCByZXEuVXNlckFnZW50KCksIHJlcS5VUkwuUGF0aCwgImxlZ2l0X2JvdHMvZ29vZ2xlYm90Lmpzb24iKQogICAgICBhcHBseToKICAgICAgICAtIEV4ZW1wdEZyb21DaGFsbGVuZ2UoImdvb2dsZWJvdCIpCiAgICAtIGZpbHRlcjogTWF0Y2hLbm93bkJvdChyZXEuUmVtb3RlQWRkciwgcmVxLlVzZXJBZ2VudCgpLCByZXEuVVJMLlBhdGgsICJsZWdpdF9ib3RzL2Jpbmdib3QuanNvbiIpCiAgICAgIGFwcGx5OgogICAgICAgIC0gRXhlbXB0RnJvbUNoYWxsZW5nZSgiYmluZ2JvdCIpCiAgICAtIGZpbHRlcjogTWF0Y2hLbm93bkJvdChyZXEuUmVtb3RlQWRkciwgcmVxLlVzZXJBZ2VudCgpLCByZXEuVVJMLlBhdGgsICJsZWdpdF9ib3RzL2FwcGxlYm90Lmpzb24iKQogICAgICBhcHBseToKICAgICAgICAtIEV4ZW1wdEZyb21DaGFsbGVuZ2UoImFwcGxlYm90IikKICAgIC0gZmlsdGVyOiBNYXRjaEtub3duQm90KHJlcS5SZW1vdGVBZGRyLCByZXEuVXNlckFnZW50KCksIHJlcS5VUkwuUGF0aCwgImxlZ2l0X2JvdHMvYW1hem9uYm90Lmpzb24iKQogICAgICBhcHBseToKICAgICAgICAtIEV4ZW1wdEZyb21DaGFsbGVuZ2UoImFtYXpvbmJvdCIpCiAgICAtIGZpbHRlcjogTWF0Y2hLbm93bkJvdChyZXEuUmVtb3RlQWRkciwgcmVxLlVzZXJBZ2VudCgpLCByZXEuVVJMLlBhdGgsICJsZWdpdF9ib3RzL3lhbmRleC5qc29uIikKICAgICAgYXBwbHk6CiAgICAgICAgLSBFeGVtcHRGcm9tQ2hhbGxlbmdlKCJ5YW5kZXgiKQogICAgLSBmaWx0ZXI6IE1hdGNoS25vd25Cb3QocmVxLlJlbW90ZUFkZHIsIHJlcS5Vc2VyQWdlbnQoKSwgcmVxLlVSTC5QYXRoLCAibGVnaXRfYm90cy9iYWlkdS5qc29uIikKICAgICAgYXBwbHk6CiAgICAgICAgLSBFeGVtcHRGcm9tQ2hhbGxlbmdlKCJiYWlkdSIpCiAgICAtIGZpbHRlcjogTWF0Y2hLbm93bkJvdChyZXEuUmVtb3RlQWRkciwgcmVxLlVzZXJBZ2VudCgpLCByZXEuVVJMLlBhdGgsICJsZWdpdF9ib3RzL3lhaG9vLmpzb24iKQogICAgICBhcHBseToKICAgICAgICAtIEV4ZW1wdEZyb21DaGFsbGVuZ2UoInlhaG9vIikKICAgIC0gZmlsdGVyOiBNYXRjaEtub3duQm90KHJlcS5SZW1vdGVBZGRyLCByZXEuVXNlckFnZW50KCksIHJlcS5VUkwuUGF0aCwgImxlZ2l0X2JvdHMvc29nb3UuanNvbiIpCiAgICAgIGFwcGx5OgogICAgICAgIC0gRXhlbXB0RnJvbUNoYWxsZW5nZSgic29nb3UiKQogICAgLSBmaWx0ZXI6IE1hdGNoS25vd25Cb3QocmVxLlJlbW90ZUFkZHIsIHJlcS5Vc2VyQWdlbnQoKSwgcmVxLlVSTC5QYXRoLCAibGVnaXRfYm90cy9xd2FudC5qc29uIikKICAgICAgYXBwbHk6CiAgICAgICAgLSBFeGVtcHRGcm9tQ2hhbGxlbmdlKCJxd2FudCIpCiAgICAtIGZpbHRlcjogTWF0Y2hLbm93bkJvdChyZXEuUmVtb3RlQWRkciwgcmVxLlVzZXJBZ2VudCgpLCByZXEuVVJMLlBhdGgsICJsZWdpdF9ib3RzL2JhYmJhci5qc29uIikKICAgICAgYXBwbHk6CiAgICAgICAgLSBFeGVtcHRGcm9tQ2hhbGxlbmdlKCJiYWJiYXIiKQogICAgLSBmaWx0ZXI6IE1hdGNoS25vd25Cb3QocmVxLlJlbW90ZUFkZHIsIHJlcS5Vc2VyQWdlbnQoKSwgcmVxLlVSTC5QYXRoLCAibGVnaXRfYm90cy9kdWNrZHVja2JvdC5qc29uIikKICAgICAgYXBwbHk6CiAgICAgICAgLSBFeGVtcHRGcm9tQ2hhbGxlbmdlKCJkdWNrZHVja2JvdCIpCgojIERlY2xhcmVzIHRoZSBkYXRhZmlsZXMgc28gY3Jvd2RzZWMgZG93bmxvYWRzIHRoZW0uCmRhdGE6CiAgLSBzb3VyY2VfdXJsOiBodHRwczovL2h1Yi1kYXRhLmNyb3dkc2VjLm5ldC93aGl0ZWxpc3RzL2Jlbmlnbl9ib3RzL2xlZ2l0X2JvdHMvZ29vZ2xlYm90Lmpzb24KICAgIGRlc3RfZmlsZTogbGVnaXRfYm90cy9nb29nbGVib3QuanNvbgogICAgdHlwZTogYm90cwogIC0gc291cmNlX3VybDogaHR0cHM6Ly9odWItZGF0YS5jcm93ZHNlYy5uZXQvd2hpdGVsaXN0cy9iZW5pZ25fYm90cy9sZWdpdF9ib3RzL2Jpbmdib3QuanNvbgogICAgZGVzdF9maWxlOiBsZWdpdF9ib3RzL2Jpbmdib3QuanNvbgogICAgdHlwZTogYm90cwogIC0gc291cmNlX3VybDogaHR0cHM6Ly9odWItZGF0YS5jcm93ZHNlYy5uZXQvd2hpdGVsaXN0cy9iZW5pZ25fYm90cy9sZWdpdF9ib3RzL2FwcGxlYm90Lmpzb24KICAgIGRlc3RfZmlsZTogbGVnaXRfYm90cy9hcHBsZWJvdC5qc29uCiAgICB0eXBlOiBib3RzCiAgLSBzb3VyY2VfdXJsOiBodHRwczovL2h1Yi1kYXRhLmNyb3dkc2VjLm5ldC93aGl0ZWxpc3RzL2Jlbmlnbl9ib3RzL2xlZ2l0X2JvdHMvYW1hem9uYm90Lmpzb24KICAgIGRlc3RfZmlsZTogbGVnaXRfYm90cy9hbWF6b25ib3QuanNvbgogICAgdHlwZTogYm90cwogIC0gc291cmNlX3VybDogaHR0cHM6Ly9odWItZGF0YS5jcm93ZHNlYy5uZXQvd2hpdGVsaXN0cy9iZW5pZ25fYm90cy9sZWdpdF9ib3RzL3lhbmRleC5qc29uCiAgICBkZXN0X2ZpbGU6IGxlZ2l0X2JvdHMveWFuZGV4Lmpzb24KICAgIHR5cGU6IGJvdHMKICAtIHNvdXJjZV91cmw6IGh0dHBzOi8vaHViLWRhdGEuY3Jvd2RzZWMubmV0L3doaXRlbGlzdHMvYmVuaWduX2JvdHMvbGVnaXRfYm90cy9iYWlkdS5qc29uCiAgICBkZXN0X2ZpbGU6IGxlZ2l0X2JvdHMvYmFpZHUuanNvbgogICAgdHlwZTogYm90cwogIC0gc291cmNlX3VybDogaHR0cHM6Ly9odWItZGF0YS5jcm93ZHNlYy5uZXQvd2hpdGVsaXN0cy9iZW5pZ25fYm90cy9sZWdpdF9ib3RzL3lhaG9vLmpzb24KICAgIGRlc3RfZmlsZTogbGVnaXRfYm90cy95YWhvby5qc29uCiAgICB0eXBlOiBib3RzCiAgLSBzb3VyY2VfdXJsOiBodHRwczovL2h1Yi1kYXRhLmNyb3dkc2VjLm5ldC93aGl0ZWxpc3RzL2Jlbmlnbl9ib3RzL2xlZ2l0X2JvdHMvc29nb3UuanNvbgogICAgZGVzdF9maWxlOiBsZWdpdF9ib3RzL3NvZ291Lmpzb24KICAgIHR5cGU6IGJvdHMKICAtIHNvdXJjZV91cmw6IGh0dHBzOi8vaHViLWRhdGEuY3Jvd2RzZWMubmV0L3doaXRlbGlzdHMvYmVuaWduX2JvdHMvbGVnaXRfYm90cy9xd2FudC5qc29uCiAgICBkZXN0X2ZpbGU6IGxlZ2l0X2JvdHMvcXdhbnQuanNvbgogICAgdHlwZTogYm90cwogIC0gc291cmNlX3VybDogaHR0cHM6Ly9odWItZGF0YS5jcm93ZHNlYy5uZXQvd2hpdGVsaXN0cy9iZW5pZ25fYm90cy9sZWdpdF9ib3RzL2JhYmJhci5qc29uCiAgICBkZXN0X2ZpbGU6IGxlZ2l0X2JvdHMvYmFiYmFyLmpzb24KICAgIHR5cGU6IGJvdHMKICAtIHNvdXJjZV91cmw6IGh0dHBzOi8vaHViLWRhdGEuY3Jvd2RzZWMubmV0L3doaXRlbGlzdHMvYmVuaWduX2JvdHMvbGVnaXRfYm90cy9kdWNrZHVja2JvdC5qc29uCiAgICBkZXN0X2ZpbGU6IGxlZ2l0X2JvdHMvZHVja2R1Y2tib3QuanNvbgogICAgdHlwZTogYm90cwo=", + "labels": null, + "path": "appsec-configs/crowdsecurity/appsec-bot-challenge-exclude-search-engines.yaml", + "version": "0.1", + "versions": { + "0.1": { + "deprecated": false, + "digest": "49d4e8bca7730713899b83d7185bc710730c399740a3fda23f7a1009356b1863" + } + } + }, + "crowdsecurity/appsec-bot-challenge-exclude-social": { + "author": "crowdsecurity", + "content": "bmFtZTogY3Jvd2RzZWN1cml0eS9hcHBzZWMtYm90LWNoYWxsZW5nZS1leGNsdWRlLXNvY2lhbAojIFNraXAgdGhlIGNoYWxsZW5nZSBmb3IgdmVyaWZpZWQgc29jaWFsIC8gbGluay1wcmV2aWV3IGJvdHMgKG1hdGNoZWQgYWdhaW5zdCB0aGVpciBwdWJsaXNoZWQgSVAvckROUyByYW5nZXMpLgojIERvIG5vdCBlZGl0IHRoaXMgZmlsZSB0byBhZGQgeW91ciBvd24gZXhjbHVzaW9ucywgY3JlYXRlIGEgY3VzdG9tIGNvbmZpZy4KaW5iYW5kOgogIHByZV9ldmFsOgogICAgLSBmaWx0ZXI6IE1hdGNoS25vd25Cb3QocmVxLlJlbW90ZUFkZHIsIHJlcS5Vc2VyQWdlbnQoKSwgcmVxLlVSTC5QYXRoLCAibGVnaXRfYm90cy9tZXRhLmpzb24iKQogICAgICBhcHBseToKICAgICAgICAtIEV4ZW1wdEZyb21DaGFsbGVuZ2UoIm1ldGEiKQogICAgLSBmaWx0ZXI6IE1hdGNoS25vd25Cb3QocmVxLlJlbW90ZUFkZHIsIHJlcS5Vc2VyQWdlbnQoKSwgcmVxLlVSTC5QYXRoLCAibGVnaXRfYm90cy9kaXNjb3JkLmpzb24iKQogICAgICBhcHBseToKICAgICAgICAtIEV4ZW1wdEZyb21DaGFsbGVuZ2UoImRpc2NvcmQiKQogICAgLSBmaWx0ZXI6IE1hdGNoS25vd25Cb3QocmVxLlJlbW90ZUFkZHIsIHJlcS5Vc2VyQWdlbnQoKSwgcmVxLlVSTC5QYXRoLCAibGVnaXRfYm90cy90ZWxlZ3JhbS5qc29uIikKICAgICAgYXBwbHk6CiAgICAgICAgLSBFeGVtcHRGcm9tQ2hhbGxlbmdlKCJ0ZWxlZ3JhbSIpCiAgICAtIGZpbHRlcjogTWF0Y2hLbm93bkJvdChyZXEuUmVtb3RlQWRkciwgcmVxLlVzZXJBZ2VudCgpLCByZXEuVVJMLlBhdGgsICJsZWdpdF9ib3RzL3R3aXR0ZXJib3QuanNvbiIpCiAgICAgIGFwcGx5OgogICAgICAgIC0gRXhlbXB0RnJvbUNoYWxsZW5nZSgidHdpdHRlcmJvdCIpCiAgICAtIGZpbHRlcjogTWF0Y2hLbm93bkJvdChyZXEuUmVtb3RlQWRkciwgcmVxLlVzZXJBZ2VudCgpLCByZXEuVVJMLlBhdGgsICJsZWdpdF9ib3RzL3BpbnRlcmVzdC5qc29uIikKICAgICAgYXBwbHk6CiAgICAgICAgLSBFeGVtcHRGcm9tQ2hhbGxlbmdlKCJwaW50ZXJlc3QiKQoKIyBEZWNsYXJlcyB0aGUgZGF0YWZpbGVzIHNvIGNyb3dkc2VjIGRvd25sb2FkcyB0aGVtLgpkYXRhOgogIC0gc291cmNlX3VybDogaHR0cHM6Ly9odWItZGF0YS5jcm93ZHNlYy5uZXQvd2hpdGVsaXN0cy9iZW5pZ25fYm90cy9sZWdpdF9ib3RzL21ldGEuanNvbgogICAgZGVzdF9maWxlOiBsZWdpdF9ib3RzL21ldGEuanNvbgogICAgdHlwZTogYm90cwogIC0gc291cmNlX3VybDogaHR0cHM6Ly9odWItZGF0YS5jcm93ZHNlYy5uZXQvd2hpdGVsaXN0cy9iZW5pZ25fYm90cy9sZWdpdF9ib3RzL2Rpc2NvcmQuanNvbgogICAgZGVzdF9maWxlOiBsZWdpdF9ib3RzL2Rpc2NvcmQuanNvbgogICAgdHlwZTogYm90cwogIC0gc291cmNlX3VybDogaHR0cHM6Ly9odWItZGF0YS5jcm93ZHNlYy5uZXQvd2hpdGVsaXN0cy9iZW5pZ25fYm90cy9sZWdpdF9ib3RzL3RlbGVncmFtLmpzb24KICAgIGRlc3RfZmlsZTogbGVnaXRfYm90cy90ZWxlZ3JhbS5qc29uCiAgICB0eXBlOiBib3RzCiAgLSBzb3VyY2VfdXJsOiBodHRwczovL2h1Yi1kYXRhLmNyb3dkc2VjLm5ldC93aGl0ZWxpc3RzL2Jlbmlnbl9ib3RzL2xlZ2l0X2JvdHMvdHdpdHRlcmJvdC5qc29uCiAgICBkZXN0X2ZpbGU6IGxlZ2l0X2JvdHMvdHdpdHRlcmJvdC5qc29uCiAgICB0eXBlOiBib3RzCiAgLSBzb3VyY2VfdXJsOiBodHRwczovL2h1Yi1kYXRhLmNyb3dkc2VjLm5ldC93aGl0ZWxpc3RzL2Jlbmlnbl9ib3RzL2xlZ2l0X2JvdHMvcGludGVyZXN0Lmpzb24KICAgIGRlc3RfZmlsZTogbGVnaXRfYm90cy9waW50ZXJlc3QuanNvbgogICAgdHlwZTogYm90cwo=", + "labels": null, + "path": "appsec-configs/crowdsecurity/appsec-bot-challenge-exclude-social.yaml", + "version": "0.1", + "versions": { + "0.1": { + "deprecated": false, + "digest": "861087333ba09b87ec1aea01cff11dd82707e1a0a6b700ea84c3129901d4fbdf" } } }, "crowdsecurity/appsec-bot-challenge-exclude-static": { "author": "crowdsecurity", - "content": "bmFtZTogY3Jvd2RzZWN1cml0eS9hcHBzZWMtYm90LWNoYWxsZW5nZS1leGNsdWRlLXN0YXRpYwojIExldCBzdGF0aWMgYXNzZXRzIGFuZCBicm93c2VyIG1ldGFkYXRhIGZpbGVzIGZseSB0aHJvdWdoIHdpdGhvdXQgYSBjaGFsbGVuZ2UKIyBEbyBub3QgZWRpdCB0aGlzIGZpbGUgdG8gYWRkIHlvdXIgb3duIGV4Y2x1c2lvbnMsIGNyZWF0ZSBhIGN1c3RvbSBjb25maWcuCmluYmFuZDoKICBwcmVfZXZhbDoKICAgIC0gZmlsdGVyOiA+LQogICAgICAgIHJlcS5VUkwuUGF0aCBtYXRjaGVzICdcXC4oY3NzfGpzfG1qc3xtYXB8cG5nfGpwZT9nfGdpZnxzdmd8d2VicHxhdmlmfGljb3xibXB8d29mZjI/fHR0ZnxvdGZ8ZW90fG1wNHxtNHZ8d2VibXxtb3Z8bXAzfG00YXx3YXZ8b2dnfG9nYXxvZ3Z8ZmxhY3xhYWN8d2VibWFuaWZlc3QpJCcgfHwKICAgICAgICByZXEuVVJMLlBhdGggaW4gWycvbWFuaWZlc3QuanNvbicsICcvYnJvd3NlcmNvbmZpZy54bWwnXQogICAgICBhcHBseToKICAgICAgICAtIEV4ZW1wdEZyb21DaGFsbGVuZ2UoKQo=", + "content": "bmFtZTogY3Jvd2RzZWN1cml0eS9hcHBzZWMtYm90LWNoYWxsZW5nZS1leGNsdWRlLXN0YXRpYwojIExldCBzdGF0aWMgYXNzZXRzIGFuZCBicm93c2VyIG1ldGFkYXRhIGZpbGVzIGZseSB0aHJvdWdoIHdpdGhvdXQgYSBjaGFsbGVuZ2UKIyBEbyBub3QgZWRpdCB0aGlzIGZpbGUgdG8gYWRkIHlvdXIgb3duIGV4Y2x1c2lvbnMsIGNyZWF0ZSBhIGN1c3RvbSBjb25maWcuCmluYmFuZDoKICBwcmVfZXZhbDoKICAgIC0gZmlsdGVyOiA+LQogICAgICAgIHJlcS5VUkwuUGF0aCBtYXRjaGVzICdcXC4oY3NzfGpzfG1qc3xtYXB8cG5nfGpwZT9nfGdpZnxzdmd8d2VicHxhdmlmfGljb3xibXB8d29mZjI/fHR0ZnxvdGZ8ZW90fG1wNHxtNHZ8d2VibXxtb3Z8bXAzfG00YXx3YXZ8b2dnfG9nYXxvZ3Z8ZmxhY3xhYWN8d2VibWFuaWZlc3QpJCcgfHwKICAgICAgICByZXEuVVJMLlBhdGggaW4gWycvbWFuaWZlc3QuanNvbicsICcvYnJvd3NlcmNvbmZpZy54bWwnXQogICAgICBhcHBseToKICAgICAgICAtIEV4ZW1wdEZyb21DaGFsbGVuZ2UoInN0YXRpYyIpCg==", "labels": null, "path": "appsec-configs/crowdsecurity/appsec-bot-challenge-exclude-static.yaml", - "version": "0.2", + "version": "0.3", "versions": { "0.1": { "deprecated": false, @@ -69,15 +133,19 @@ "0.2": { "deprecated": false, "digest": "592e8b49dc5f7f34a73149fa5bd3a985012b6b7af0089b49678284b6d041b50a" + }, + "0.3": { + "deprecated": false, + "digest": "e50eebefcdba3d34e21e49ed4f9316cc593ceb9aebff0e837cab1c766ff14285" } } }, "crowdsecurity/appsec-bot-challenge-exclude-webhooks": { "author": "crowdsecurity", - "content": "bmFtZTogY3Jvd2RzZWN1cml0eS9hcHBzZWMtYm90LWNoYWxsZW5nZS1leGNsdWRlLXdlYmhvb2tzCiMgTGV0IHRoaXJkLXBhcnR5IHdlYmhvb2sgY2FsbGJhY2tzIGZseSB0aHJvdWdoIHdpdGhvdXQgYSBjaGFsbGVuZ2UuCiMgRG8gbm90IGVkaXQgdGhpcyBmaWxlIHRvIGFkZCB5b3VyIG93biBleGNsdXNpb25zLCBjcmVhdGUgYSBjdXN0b20gY29uZmlnLgppbmJhbmQ6CiAgcHJlX2V2YWw6CiAgICAtIGZpbHRlcjogInJlcS5VUkwuUGF0aCBzdGFydHNXaXRoICcvd2ViaG9va3MvJyIKICAgICAgYXBwbHk6CiAgICAgICAgLSBFeGVtcHRGcm9tQ2hhbGxlbmdlKCkK", + "content": "bmFtZTogY3Jvd2RzZWN1cml0eS9hcHBzZWMtYm90LWNoYWxsZW5nZS1leGNsdWRlLXdlYmhvb2tzCiMgTGV0IHRoaXJkLXBhcnR5IHdlYmhvb2sgY2FsbGJhY2tzIGZseSB0aHJvdWdoIHdpdGhvdXQgYSBjaGFsbGVuZ2UuCiMgRG8gbm90IGVkaXQgdGhpcyBmaWxlIHRvIGFkZCB5b3VyIG93biBleGNsdXNpb25zLCBjcmVhdGUgYSBjdXN0b20gY29uZmlnLgppbmJhbmQ6CiAgcHJlX2V2YWw6CiAgICAtIGZpbHRlcjogInJlcS5VUkwuUGF0aCBzdGFydHNXaXRoICcvd2ViaG9va3MvJyIKICAgICAgYXBwbHk6CiAgICAgICAgLSBFeGVtcHRGcm9tQ2hhbGxlbmdlKCJ3ZWJob29rcyIpCg==", "labels": null, "path": "appsec-configs/crowdsecurity/appsec-bot-challenge-exclude-webhooks.yaml", - "version": "0.3", + "version": "0.4", "versions": { "0.1": { "deprecated": false, @@ -90,15 +158,19 @@ "0.3": { "deprecated": false, "digest": "02d6640898ab358d1b8c53ced8db57071f0f6a735c9a2983093a46a508befeb7" + }, + "0.4": { + "deprecated": false, + "digest": "c8fe5051b49396889faadce17858dc445755b5961b1708e00d723e3ac49a2bc2" } } }, "crowdsecurity/appsec-bot-challenge-simple": { "author": "crowdsecurity", - "content": "bmFtZTogY3Jvd2RzZWN1cml0eS9hcHBzZWMtYm90LWNoYWxsZW5nZS1zaW1wbGUKaW5iYW5kOgogIHBvc3RfZXZhbDoKICAgICMgU2tpcCB0aGUgY2hhbGxlbmdlIGZvciB2ZXJpZmllZCBnb29kIGJvdHMgYW5kIGZvciByZXF1ZXN0cyBhCiAgICAjIHdlbGwta25vd24tcGF0aCBleGNsdXNpb24gY29uZmlnIGZsYWdnZWQgdmlhIEV4ZW1wdEZyb21DaGFsbGVuZ2UoKS4KICAgIC0gZmlsdGVyOiAiIUlzTGVnaXRpbWF0ZUJvdChyZXEuUmVtb3RlQWRkciwgcmVxLlVzZXJBZ2VudCgpLCByZXEuVVJMLlBhdGgpIgogICAgICBhcHBseToKICAgICAgICAtIFNlbmRDaGFsbGVuZ2UoKQogIG9uX2NoYWxsZW5nZV9zdWJtaXQ6CiAgICAjIFJlamVjdCBzdWJtaXNzaW9ucyB3aG9zZSBmaW5nZXJwcmludCBmYXN0LWRldGVjdCBmbGFncyBhIGtub3duIGJvdC4KICAgIC0gZmlsdGVyOiAiZmluZ2VycHJpbnQuSXNCb3QoKSIKICAgICAgYXBwbHk6CiAgICAgICAgLSBSZWplY3RTdWJtaXNzaW9uKCJrbm93biBib3QgKGZhc3QgYm90IGRldGVjdGlvbikiKQo=", + "content": "bmFtZTogY3Jvd2RzZWN1cml0eS9hcHBzZWMtYm90LWNoYWxsZW5nZS1zaW1wbGUKaW5iYW5kOgogIHBvc3RfZXZhbDoKICAgICMgQ2hhbGxlbmdlIGV2ZXJ5IHJlcXVlc3QuIFJlcXVlc3RzIGEgcHJlX2V2YWwgZXhjbHVzaW9uIGNvbmZpZyBmbGFnZ2VkIHZpYQogICAgIyBFeGVtcHRGcm9tQ2hhbGxlbmdlKCkgKHZlcmlmaWVkIGJvdHMsIHdlbGwta25vd24gcGF0aHMpIGFyZSBza2lwcGVkIGJ5CiAgICAjIFNlbmRDaGFsbGVuZ2UgaXRzZWxmLCBzbyBubyBleHBsaWNpdCBib3QgY2hlY2sgaXMgbmVlZGVkIGhlcmUuCiAgICAtIGZpbHRlcjogInRydWUiCiAgICAgIGFwcGx5OgogICAgICAgIC0gU2VuZENoYWxsZW5nZSgpCiAgb25fY2hhbGxlbmdlX3N1Ym1pdDoKICAgICMgUmVqZWN0IHN1Ym1pc3Npb25zIHdob3NlIGZpbmdlcnByaW50IGZhc3QtZGV0ZWN0IGZsYWdzIGEga25vd24gYm90LgogICAgLSBmaWx0ZXI6ICJmaW5nZXJwcmludC5Jc0JvdCgpIgogICAgICBhcHBseToKICAgICAgICAtIFJlamVjdFN1Ym1pc3Npb24oImtub3duIGJvdCAoZmFzdCBib3QgZGV0ZWN0aW9uKSIpCg==", "labels": null, "path": "appsec-configs/crowdsecurity/appsec-bot-challenge-simple.yaml", - "version": "0.2", + "version": "0.3", "versions": { "0.1": { "deprecated": false, @@ -107,6 +179,10 @@ "0.2": { "deprecated": false, "digest": "f6913f2f3244dc62e0f1a9a519038eac6d9300d3e3221aa5e8fdbd628e0c279d" + }, + "0.3": { + "deprecated": false, + "digest": "c52e73110f6559b32b11af565f20dee79ad5e98217331b5d87c8b6f45ed7a5f6" } } }, @@ -229,78 +305,6 @@ } }, "appsec-rules": { - "crowdsecurity/appsec-bot-legit-ai-crawlers": { - "author": "crowdsecurity", - "content": "bmFtZTogY3Jvd2RzZWN1cml0eS9hcHBzZWMtYm90LWxlZ2l0LWFpLWNyYXdsZXJzCgojIERlY2xhcmVzIHRoZSBsZWdpdGltYXRlIEFJLWNyYXdsZXIgZGF0YWZpbGVzIHNvIGNyb3dkc2VjIGRvd25sb2FkcyB0aGVtLgojIERvIG5vdCBlZGl0IHRoaXMgZmlsZSB0byBhZGQgeW91ciBvd24gZXhjbHVzaW9ucywgY3JlYXRlIGEgY3VzdG9tIGNvbmZpZy4KCmRhdGE6CiAgLSBzb3VyY2VfdXJsOiBodHRwczovL2h1Yi1kYXRhLmNyb3dkc2VjLm5ldC93aGl0ZWxpc3RzL2Jlbmlnbl9ib3RzL2xlZ2l0X2JvdHMvZ3B0Ym90Lmpzb24KICAgIGRlc3RfZmlsZTogbGVnaXRfYm90cy9ncHRib3QuanNvbgogICAgdHlwZTogYm90cwogIC0gc291cmNlX3VybDogaHR0cHM6Ly9odWItZGF0YS5jcm93ZHNlYy5uZXQvd2hpdGVsaXN0cy9iZW5pZ25fYm90cy9sZWdpdF9ib3RzL29wZW5haS1zZWFyY2hib3QuanNvbgogICAgZGVzdF9maWxlOiBsZWdpdF9ib3RzL29wZW5haS1zZWFyY2hib3QuanNvbgogICAgdHlwZTogYm90cwogIC0gc291cmNlX3VybDogaHR0cHM6Ly9odWItZGF0YS5jcm93ZHNlYy5uZXQvd2hpdGVsaXN0cy9iZW5pZ25fYm90cy9sZWdpdF9ib3RzL29wZW5haS1jaGF0Z3B0LXVzZXIuanNvbgogICAgZGVzdF9maWxlOiBsZWdpdF9ib3RzL29wZW5haS1jaGF0Z3B0LXVzZXIuanNvbgogICAgdHlwZTogYm90cwogIC0gc291cmNlX3VybDogaHR0cHM6Ly9odWItZGF0YS5jcm93ZHNlYy5uZXQvd2hpdGVsaXN0cy9iZW5pZ25fYm90cy9sZWdpdF9ib3RzL3BlcnBsZXhpdHlib3QuanNvbgogICAgZGVzdF9maWxlOiBsZWdpdF9ib3RzL3BlcnBsZXhpdHlib3QuanNvbgogICAgdHlwZTogYm90cwo=", - "labels": null, - "path": "appsec-rules/crowdsecurity/appsec-bot-legit-ai-crawlers.yaml", - "version": "0.2", - "versions": { - "0.1": { - "deprecated": false, - "digest": "dee256dafa5c404651a5ae8e4b92931e145bca67ae6c6f2d991d371f96183c18" - }, - "0.2": { - "deprecated": false, - "digest": "179b1183274191e142abd72a7632a0fd5fd6c312f69a7db5ed00893be3282156" - } - } - }, - "crowdsecurity/appsec-bot-legit-monitoring": { - "author": "crowdsecurity", - "content": "bmFtZTogY3Jvd2RzZWN1cml0eS9hcHBzZWMtYm90LWxlZ2l0LW1vbml0b3JpbmcKCiMgRGVjbGFyZXMgdGhlIGxlZ2l0aW1hdGUgdXB0aW1lL21vbml0b3JpbmcgZGF0YWZpbGVzIHNvIGNyb3dkc2VjIGRvd25sb2FkcyB0aGVtCiMgRG8gbm90IGVkaXQgdGhpcyBmaWxlIHRvIGFkZCB5b3VyIG93biBleGNsdXNpb25zLCBjcmVhdGUgYSBjdXN0b20gY29uZmlnLgoKZGF0YToKICAtIHNvdXJjZV91cmw6IGh0dHBzOi8vaHViLWRhdGEuY3Jvd2RzZWMubmV0L3doaXRlbGlzdHMvYmVuaWduX2JvdHMvbGVnaXRfYm90cy91cHRpbWVyb2JvdC5qc29uCiAgICBkZXN0X2ZpbGU6IGxlZ2l0X2JvdHMvdXB0aW1lcm9ib3QuanNvbgogICAgdHlwZTogYm90cwogIC0gc291cmNlX3VybDogaHR0cHM6Ly9odWItZGF0YS5jcm93ZHNlYy5uZXQvd2hpdGVsaXN0cy9iZW5pZ25fYm90cy9sZWdpdF9ib3RzL2Nvb2tpZWJvdC5qc29uCiAgICBkZXN0X2ZpbGU6IGxlZ2l0X2JvdHMvY29va2llYm90Lmpzb24KICAgIHR5cGU6IGJvdHMKICAtIHNvdXJjZV91cmw6IGh0dHBzOi8vaHViLWRhdGEuY3Jvd2RzZWMubmV0L3doaXRlbGlzdHMvYmVuaWduX2JvdHMvbGVnaXRfYm90cy9kYXRhZG9nLmpzb24KICAgIGRlc3RfZmlsZTogbGVnaXRfYm90cy9kYXRhZG9nLmpzb24KICAgIHR5cGU6IGJvdHMKICAtIHNvdXJjZV91cmw6IGh0dHBzOi8vaHViLWRhdGEuY3Jvd2RzZWMubmV0L3doaXRlbGlzdHMvYmVuaWduX2JvdHMvbGVnaXRfYm90cy9wYWdlcmR1dHkuanNvbgogICAgZGVzdF9maWxlOiBsZWdpdF9ib3RzL3BhZ2VyZHV0eS5qc29uCiAgICB0eXBlOiBib3RzCg==", - "labels": null, - "path": "appsec-rules/crowdsecurity/appsec-bot-legit-monitoring.yaml", - "version": "0.3", - "versions": { - "0.1": { - "deprecated": false, - "digest": "e08498be5b24f43ee79dba7bfa3810cc7424737ac0d4930470a34a53754f4b9b" - }, - "0.2": { - "deprecated": false, - "digest": "c4ea8155feb02a9a622e88072637e6eaf1ec5fd404ecb2f46a271d1af1b70cd2" - }, - "0.3": { - "deprecated": false, - "digest": "269a526cf439cb6b4f21c56820b933e0bae19cca4a3c1581915b6b57e085507a" - } - } - }, - "crowdsecurity/appsec-bot-legit-search-engines": { - "author": "crowdsecurity", - "content": "bmFtZTogY3Jvd2RzZWN1cml0eS9hcHBzZWMtYm90LWxlZ2l0LXNlYXJjaC1lbmdpbmVzCgojIERlY2xhcmVzIHRoZSBsZWdpdGltYXRlIHNlYXJjaC1lbmdpbmUgZGF0YWZpbGVzIHNvIGNyb3dkc2VjIGRvd25sb2FkcyB0aGVtCiMgRG8gbm90IGVkaXQgdGhpcyBmaWxlIHRvIGFkZCB5b3VyIG93biBleGNsdXNpb25zLCBjcmVhdGUgYSBjdXN0b20gY29uZmlnLgoKZGF0YToKICAtIHNvdXJjZV91cmw6IGh0dHBzOi8vaHViLWRhdGEuY3Jvd2RzZWMubmV0L3doaXRlbGlzdHMvYmVuaWduX2JvdHMvbGVnaXRfYm90cy9nb29nbGVib3QuanNvbgogICAgZGVzdF9maWxlOiBsZWdpdF9ib3RzL2dvb2dsZWJvdC5qc29uCiAgICB0eXBlOiBib3RzCiAgLSBzb3VyY2VfdXJsOiBodHRwczovL2h1Yi1kYXRhLmNyb3dkc2VjLm5ldC93aGl0ZWxpc3RzL2Jlbmlnbl9ib3RzL2xlZ2l0X2JvdHMvYmluZ2JvdC5qc29uCiAgICBkZXN0X2ZpbGU6IGxlZ2l0X2JvdHMvYmluZ2JvdC5qc29uCiAgICB0eXBlOiBib3RzCiAgLSBzb3VyY2VfdXJsOiBodHRwczovL2h1Yi1kYXRhLmNyb3dkc2VjLm5ldC93aGl0ZWxpc3RzL2Jlbmlnbl9ib3RzL2xlZ2l0X2JvdHMvYXBwbGVib3QuanNvbgogICAgZGVzdF9maWxlOiBsZWdpdF9ib3RzL2FwcGxlYm90Lmpzb24KICAgIHR5cGU6IGJvdHMKICAtIHNvdXJjZV91cmw6IGh0dHBzOi8vaHViLWRhdGEuY3Jvd2RzZWMubmV0L3doaXRlbGlzdHMvYmVuaWduX2JvdHMvbGVnaXRfYm90cy9hbWF6b25ib3QuanNvbgogICAgZGVzdF9maWxlOiBsZWdpdF9ib3RzL2FtYXpvbmJvdC5qc29uCiAgICB0eXBlOiBib3RzCiAgLSBzb3VyY2VfdXJsOiBodHRwczovL2h1Yi1kYXRhLmNyb3dkc2VjLm5ldC93aGl0ZWxpc3RzL2Jlbmlnbl9ib3RzL2xlZ2l0X2JvdHMveWFuZGV4Lmpzb24KICAgIGRlc3RfZmlsZTogbGVnaXRfYm90cy95YW5kZXguanNvbgogICAgdHlwZTogYm90cwogIC0gc291cmNlX3VybDogaHR0cHM6Ly9odWItZGF0YS5jcm93ZHNlYy5uZXQvd2hpdGVsaXN0cy9iZW5pZ25fYm90cy9sZWdpdF9ib3RzL2JhaWR1Lmpzb24KICAgIGRlc3RfZmlsZTogbGVnaXRfYm90cy9iYWlkdS5qc29uCiAgICB0eXBlOiBib3RzCiAgLSBzb3VyY2VfdXJsOiBodHRwczovL2h1Yi1kYXRhLmNyb3dkc2VjLm5ldC93aGl0ZWxpc3RzL2Jlbmlnbl9ib3RzL2xlZ2l0X2JvdHMveWFob28uanNvbgogICAgZGVzdF9maWxlOiBsZWdpdF9ib3RzL3lhaG9vLmpzb24KICAgIHR5cGU6IGJvdHMKICAtIHNvdXJjZV91cmw6IGh0dHBzOi8vaHViLWRhdGEuY3Jvd2RzZWMubmV0L3doaXRlbGlzdHMvYmVuaWduX2JvdHMvbGVnaXRfYm90cy9zb2dvdS5qc29uCiAgICBkZXN0X2ZpbGU6IGxlZ2l0X2JvdHMvc29nb3UuanNvbgogICAgdHlwZTogYm90cwogIC0gc291cmNlX3VybDogaHR0cHM6Ly9odWItZGF0YS5jcm93ZHNlYy5uZXQvd2hpdGVsaXN0cy9iZW5pZ25fYm90cy9sZWdpdF9ib3RzL3F3YW50Lmpzb24KICAgIGRlc3RfZmlsZTogbGVnaXRfYm90cy9xd2FudC5qc29uCiAgICB0eXBlOiBib3RzCiAgLSBzb3VyY2VfdXJsOiBodHRwczovL2h1Yi1kYXRhLmNyb3dkc2VjLm5ldC93aGl0ZWxpc3RzL2Jlbmlnbl9ib3RzL2xlZ2l0X2JvdHMvYmFiYmFyLmpzb24KICAgIGRlc3RfZmlsZTogbGVnaXRfYm90cy9iYWJiYXIuanNvbgogICAgdHlwZTogYm90cwogIC0gc291cmNlX3VybDogaHR0cHM6Ly9odWItZGF0YS5jcm93ZHNlYy5uZXQvd2hpdGVsaXN0cy9iZW5pZ25fYm90cy9sZWdpdF9ib3RzL2R1Y2tkdWNrYm90Lmpzb24KICAgIGRlc3RfZmlsZTogbGVnaXRfYm90cy9kdWNrZHVja2JvdC5qc29uCiAgICB0eXBlOiBib3RzCg==", - "labels": null, - "path": "appsec-rules/crowdsecurity/appsec-bot-legit-search-engines.yaml", - "version": "0.2", - "versions": { - "0.1": { - "deprecated": false, - "digest": "fff7199c8e8a1e86460baf7e9cb251d1906b18103d41eaa7440ea476d9d5c0ed" - }, - "0.2": { - "deprecated": false, - "digest": "a32201657fb0a675f4ca089902def79a6b4cce641218a56ead2f124f6311298d" - } - } - }, - "crowdsecurity/appsec-bot-legit-social": { - "author": "crowdsecurity", - "content": "bmFtZTogY3Jvd2RzZWN1cml0eS9hcHBzZWMtYm90LWxlZ2l0LXNvY2lhbAoKIyBEZWNsYXJlcyB0aGUgbGVnaXRpbWF0ZSBzb2NpYWwgLyBsaW5rLXByZXZpZXcgZGF0YWZpbGVzIHNvIGNyb3dkc2VjIGRvd25sb2FkcyB0aGVtCgpkYXRhOgogIC0gc291cmNlX3VybDogaHR0cHM6Ly9odWItZGF0YS5jcm93ZHNlYy5uZXQvd2hpdGVsaXN0cy9iZW5pZ25fYm90cy9sZWdpdF9ib3RzL21ldGEuanNvbgogICAgZGVzdF9maWxlOiBsZWdpdF9ib3RzL21ldGEuanNvbgogICAgdHlwZTogYm90cwogIC0gc291cmNlX3VybDogaHR0cHM6Ly9odWItZGF0YS5jcm93ZHNlYy5uZXQvd2hpdGVsaXN0cy9iZW5pZ25fYm90cy9sZWdpdF9ib3RzL2Rpc2NvcmQuanNvbgogICAgZGVzdF9maWxlOiBsZWdpdF9ib3RzL2Rpc2NvcmQuanNvbgogICAgdHlwZTogYm90cwogIC0gc291cmNlX3VybDogaHR0cHM6Ly9odWItZGF0YS5jcm93ZHNlYy5uZXQvd2hpdGVsaXN0cy9iZW5pZ25fYm90cy9sZWdpdF9ib3RzL3RlbGVncmFtLmpzb24KICAgIGRlc3RfZmlsZTogbGVnaXRfYm90cy90ZWxlZ3JhbS5qc29uCiAgICB0eXBlOiBib3RzCiAgLSBzb3VyY2VfdXJsOiBodHRwczovL2h1Yi1kYXRhLmNyb3dkc2VjLm5ldC93aGl0ZWxpc3RzL2Jlbmlnbl9ib3RzL2xlZ2l0X2JvdHMvdHdpdHRlcmJvdC5qc29uCiAgICBkZXN0X2ZpbGU6IGxlZ2l0X2JvdHMvdHdpdHRlcmJvdC5qc29uCiAgICB0eXBlOiBib3RzCiAgLSBzb3VyY2VfdXJsOiBodHRwczovL2h1Yi1kYXRhLmNyb3dkc2VjLm5ldC93aGl0ZWxpc3RzL2Jlbmlnbl9ib3RzL2xlZ2l0X2JvdHMvcGludGVyZXN0Lmpzb24KICAgIGRlc3RfZmlsZTogbGVnaXRfYm90cy9waW50ZXJlc3QuanNvbgogICAgdHlwZTogYm90cwo=", - "labels": null, - "path": "appsec-rules/crowdsecurity/appsec-bot-legit-social.yaml", - "version": "0.2", - "versions": { - "0.1": { - "deprecated": false, - "digest": "7de6aab1a2cfcd0b3d1dc0d7b1eaa2ece6e2bd65488075d37f3cc9840ad33d65" - }, - "0.2": { - "deprecated": false, - "digest": "5e5787ee1cdb337ef7fa13bbb3f281e224d24b877879f53f7adae08045db02c3" - } - } - }, "crowdsecurity/appsec-generic-test": { "author": "crowdsecurity", "content": "bmFtZTogY3Jvd2RzZWN1cml0eS9hcHBzZWMtZ2VuZXJpYy10ZXN0CmRlc2NyaXB0aW9uOiAiQXBwU2VjIEdlbmVyaWMgVGVzdDogdHJpZ2dlciBvbiBHRVQgL2Nyb3dkc2VjLXRlc3QtTnRrdGxKSFY0VGZCU0szd3ZsaGlPQm5sYCIKcnVsZXM6CiAgLSBhbmQ6CiAgICAgICMgMSkgTWF0Y2ggdGhlIEhUVFAgdmVyYgogICAgICAtIHpvbmVzOgogICAgICAgICAgLSBNRVRIT0QKICAgICAgICBtYXRjaDoKICAgICAgICAgIHR5cGU6IHJlZ2V4CiAgICAgICAgICB2YWx1ZTogKEdFVHxIRUFEKQogICAgICAjIDIpIE1hdGNoIGV4YWN0bHkgdGhlIHRlc3QgcGF0aAogICAgICAtIHpvbmVzOgogICAgICAgICAgLSBVUkkKICAgICAgICBtYXRjaDoKICAgICAgICAgIHR5cGU6IGVxdWFscwogICAgICAgICAgdmFsdWU6IC9jcm93ZHNlYy10ZXN0LU50a3RsSkhWNFRmQlNLM3d2bGhpT0JubApsYWJlbHM6CiAgc2VydmljZTogaHR0cAogIHR5cGU6IHRlc3QKICBjb25maWRlbmNlOiAwCiAgc3Bvb2ZhYmxlOiAzCiAgYmVoYXZpb3I6ICJodHRwOnRlc3QiCiAgbGFiZWw6ICJBcHBTZWMgR2VuZXJpYyBUZXN0IgogIGNsYXNzaWZpY2F0aW9uOgogICAgLSBhdHRhY2suVDExOTAK", @@ -7933,16 +7937,14 @@ "crowdsecurity/appsec-bot-challenge-exclude-feeds", "crowdsecurity/appsec-bot-challenge-exclude-webhooks", "crowdsecurity/appsec-bot-challenge-exclude-static", - "crowdsecurity/appsec-bot-challenge-exclude-api" - ], - "appsec-rules": [ - "crowdsecurity/appsec-bot-legit-search-engines", - "crowdsecurity/appsec-bot-legit-ai-crawlers", - "crowdsecurity/appsec-bot-legit-social", - "crowdsecurity/appsec-bot-legit-monitoring" + "crowdsecurity/appsec-bot-challenge-exclude-api", + "crowdsecurity/appsec-bot-challenge-exclude-search-engines", + "crowdsecurity/appsec-bot-challenge-exclude-ai-crawlers", + "crowdsecurity/appsec-bot-challenge-exclude-social", + "crowdsecurity/appsec-bot-challenge-exclude-monitoring" ], "author": "crowdsecurity", - "content": "bmFtZTogY3Jvd2RzZWN1cml0eS9hcHBzZWMtYm90LWNoYWxsZW5nZQpwYXJzZXJzOgogIC0gY3Jvd2RzZWN1cml0eS9hcHBzZWMtbG9ncwogIC0gY3Jvd2RzZWN1cml0eS9hcHBzZWMtYm90LWRldGVjdGlvbi1sb2dzCmFwcHNlYy1jb25maWdzOgogIC0gY3Jvd2RzZWN1cml0eS9hcHBzZWMtYm90LWNoYWxsZW5nZS1zaW1wbGUKICAtIGNyb3dkc2VjdXJpdHkvYXBwc2VjLWJvdC1jaGFsbGVuZ2UtZXhjbHVkZS1jcmF3bGVyLWZpbGVzCiAgLSBjcm93ZHNlY3VyaXR5L2FwcHNlYy1ib3QtY2hhbGxlbmdlLWV4Y2x1ZGUtZmVlZHMKICAtIGNyb3dkc2VjdXJpdHkvYXBwc2VjLWJvdC1jaGFsbGVuZ2UtZXhjbHVkZS13ZWJob29rcwogIC0gY3Jvd2RzZWN1cml0eS9hcHBzZWMtYm90LWNoYWxsZW5nZS1leGNsdWRlLXN0YXRpYwogIC0gY3Jvd2RzZWN1cml0eS9hcHBzZWMtYm90LWNoYWxsZW5nZS1leGNsdWRlLWFwaQphcHBzZWMtcnVsZXM6CiAgLSBjcm93ZHNlY3VyaXR5L2FwcHNlYy1ib3QtbGVnaXQtc2VhcmNoLWVuZ2luZXMKICAtIGNyb3dkc2VjdXJpdHkvYXBwc2VjLWJvdC1sZWdpdC1haS1jcmF3bGVycwogIC0gY3Jvd2RzZWN1cml0eS9hcHBzZWMtYm90LWxlZ2l0LXNvY2lhbAogIC0gY3Jvd2RzZWN1cml0eS9hcHBzZWMtYm90LWxlZ2l0LW1vbml0b3JpbmcKc2NlbmFyaW9zOgogIC0gY3Jvd2RzZWN1cml0eS9hcHBzZWMtYm90LWRldGVjdGVkCiAgLSBjcm93ZHNlY3VyaXR5L2FwcHNlYy1ib3QtY2hhbGxlbmdlLXRvby1tYW55LXJlcXVlc3RzCiAgLSBjcm93ZHNlY3VyaXR5L2FwcHNlYy1ib3QtY2hhbGxlbmdlLXRvby1tYW55LXN1Ym1pc3Npb25zCiAgLSBjcm93ZHNlY3VyaXR5L2FwcHNlYy1ib3QtY2hhbGxlbmdlLXJlcXVlc3Qtd2l0aC1uby1zdWJtaXNzaW9uCmNvbnRleHRzOgogIC0gY3Jvd2RzZWN1cml0eS9hcHBzZWNfYmFzZQogIC0gY3Jvd2RzZWN1cml0eS9hcHBzZWMtYm90LWRldGVjdGlvbgpkZXNjcmlwdGlvbjogIkFwcFNlYyBib3QgZGV0ZWN0aW9uOiBjaGFsbGVuZ2UgbW9kZSB3aXRoIGZhc3QtZGV0ZWN0IGJvdCByZWplY3Rpb24gYW5kIHdlbGwta25vd24tcGF0aCBleGNsdXNpb25zIgpsYWJlbHM6CiAgbGFiZWw6ICJXQUYgLSBCb3QgQ2hhbGxlbmdlIgphdXRob3I6IGNyb3dkc2VjdXJpdHkKdGFnczoKICAtIHdhZgogIC0gYXBwc2VjCiAgLSBodHRwCiAgLSBib3QK", + "content": "bmFtZTogY3Jvd2RzZWN1cml0eS9hcHBzZWMtYm90LWNoYWxsZW5nZQpwYXJzZXJzOgogIC0gY3Jvd2RzZWN1cml0eS9hcHBzZWMtbG9ncwogIC0gY3Jvd2RzZWN1cml0eS9hcHBzZWMtYm90LWRldGVjdGlvbi1sb2dzCmFwcHNlYy1jb25maWdzOgogIC0gY3Jvd2RzZWN1cml0eS9hcHBzZWMtYm90LWNoYWxsZW5nZS1zaW1wbGUKICAtIGNyb3dkc2VjdXJpdHkvYXBwc2VjLWJvdC1jaGFsbGVuZ2UtZXhjbHVkZS1jcmF3bGVyLWZpbGVzCiAgLSBjcm93ZHNlY3VyaXR5L2FwcHNlYy1ib3QtY2hhbGxlbmdlLWV4Y2x1ZGUtZmVlZHMKICAtIGNyb3dkc2VjdXJpdHkvYXBwc2VjLWJvdC1jaGFsbGVuZ2UtZXhjbHVkZS13ZWJob29rcwogIC0gY3Jvd2RzZWN1cml0eS9hcHBzZWMtYm90LWNoYWxsZW5nZS1leGNsdWRlLXN0YXRpYwogIC0gY3Jvd2RzZWN1cml0eS9hcHBzZWMtYm90LWNoYWxsZW5nZS1leGNsdWRlLWFwaQogIC0gY3Jvd2RzZWN1cml0eS9hcHBzZWMtYm90LWNoYWxsZW5nZS1leGNsdWRlLXNlYXJjaC1lbmdpbmVzCiAgLSBjcm93ZHNlY3VyaXR5L2FwcHNlYy1ib3QtY2hhbGxlbmdlLWV4Y2x1ZGUtYWktY3Jhd2xlcnMKICAtIGNyb3dkc2VjdXJpdHkvYXBwc2VjLWJvdC1jaGFsbGVuZ2UtZXhjbHVkZS1zb2NpYWwKICAtIGNyb3dkc2VjdXJpdHkvYXBwc2VjLWJvdC1jaGFsbGVuZ2UtZXhjbHVkZS1tb25pdG9yaW5nCnNjZW5hcmlvczoKICAtIGNyb3dkc2VjdXJpdHkvYXBwc2VjLWJvdC1kZXRlY3RlZAogIC0gY3Jvd2RzZWN1cml0eS9hcHBzZWMtYm90LWNoYWxsZW5nZS10b28tbWFueS1yZXF1ZXN0cwogIC0gY3Jvd2RzZWN1cml0eS9hcHBzZWMtYm90LWNoYWxsZW5nZS10b28tbWFueS1zdWJtaXNzaW9ucwogIC0gY3Jvd2RzZWN1cml0eS9hcHBzZWMtYm90LWNoYWxsZW5nZS1yZXF1ZXN0LXdpdGgtbm8tc3VibWlzc2lvbgpjb250ZXh0czoKICAtIGNyb3dkc2VjdXJpdHkvYXBwc2VjX2Jhc2UKICAtIGNyb3dkc2VjdXJpdHkvYXBwc2VjLWJvdC1kZXRlY3Rpb24KZGVzY3JpcHRpb246ICJBcHBTZWMgYm90IGRldGVjdGlvbjogY2hhbGxlbmdlIG1vZGUgd2l0aCBmYXN0LWRldGVjdCBib3QgcmVqZWN0aW9uIGFuZCB3ZWxsLWtub3duLXBhdGggZXhjbHVzaW9ucyIKbGFiZWxzOgogIGxhYmVsOiAiV0FGIC0gQm90IENoYWxsZW5nZSIKYXV0aG9yOiBjcm93ZHNlY3VyaXR5CnRhZ3M6CiAgLSB3YWYKICAtIGFwcHNlYwogIC0gaHR0cAogIC0gYm90Cg==", "contexts": [ "crowdsecurity/appsec_base", "crowdsecurity/appsec-bot-detection" @@ -7951,7 +7953,7 @@ "labels": { "label": "WAF - Bot Challenge" }, - "long_description": "IyBBcHBTZWMgQm90IENoYWxsZW5nZQoKVGhpcyBjb2xsZWN0aW9uIGVuYWJsZXMgQ3Jvd2RTZWMgQXBwU2VjICoqY2hhbGxlbmdlIG1vZGUqKiBmb3IgYm90IGRldGVjdGlvbjogdmlzaXRvcnMgYXJlIHNlcnZlZCBhCmxpZ2h0d2VpZ2h0IHByb29mLW9mLXdvcmsgKyBicm93c2VyLWZpbmdlcnByaW50IGNoYWxsZW5nZSwgYW5kIGNsaWVudHMgZmxhZ2dlZCBhcyBrbm93biBib3RzIGJ5IHRoZQpmYXN0IGJvdCBkZXRlY3Rpb24gYXJlIHJlamVjdGVkLgoKV2hhdCBpdCBzaGlwczoKCiAtIGBjcm93ZHNlY3VyaXR5L2FwcHNlYy1ib3QtY2hhbGxlbmdlLXNpbXBsZWA6IGNoYWxsZW5nZXMgaW5jb21pbmcgcmVxdWVzdHMsIHNraXBzIHZlcmlmaWVkIGdvb2QgYm90cwogICBhbmQgcmVqZWN0cyBjaGFsbGVuZ2Ugc3VibWlzc2lvbnMgd2hvc2UgZmluZ2VycHJpbnQgdHJpcHMgdGhlIGJvdCBkZXRlY3Rpb24uCiAtIFZlcmlmaWVkLWdvb2QtYm90IGRhdGFmaWxlcyB0aGF0IGJhY2sgdGhlIGV4Y2x1c2lvbiBhYm92ZSwgc3BsaXQgYnkgZmFtaWx5IHNvIHlvdSBjYW4gZW5hYmxlIG9ubHkgdGhlCiAgIG9uZXMgeW91IG5lZWQ6CiAgIC0gYGNyb3dkc2VjdXJpdHkvYXBwc2VjLWJvdC1sZWdpdC1zZWFyY2gtZW5naW5lc2A6IGdvb2dsZWJvdCwgYmluZ2JvdCwgYXBwbGVib3QsIGFtYXpvbmJvdCwgeWFuZGV4LAogICAgIGJhaWR1LCB5YWhvbywgc29nb3UsIHF3YW50LCBiYWJiYXIsIGR1Y2tkdWNrYm90CiAgIC0gYGNyb3dkc2VjdXJpdHkvYXBwc2VjLWJvdC1sZWdpdC1haS1jcmF3bGVyc2A6IGdwdGJvdCwgb3BlbmFpLXNlYXJjaGJvdCwgb3BlbmFpLWNoYXRncHQtdXNlciwKICAgICBwZXJwbGV4aXR5Ym90CiAgIC0gYGNyb3dkc2VjdXJpdHkvYXBwc2VjLWJvdC1sZWdpdC1zb2NpYWxgOiBtZXRhLCBkaXNjb3JkLCB0ZWxlZ3JhbSwgdHdpdHRlcmJvdCwgcGludGVyZXN0CiAgIC0gYGNyb3dkc2VjdXJpdHkvYXBwc2VjLWJvdC1sZWdpdC1tb25pdG9yaW5nYDogdXB0aW1lcm9ib3QsIGNvb2tpZWJvdCwgZGF0YWRvZywgcGFnZXJkdXR5CgogICBBIGJvdCBpcyBleGVtcHRlZCAqKm9ubHkqKiB3aGVuIGl0IGNhbiBiZSBuZXR3b3JrLXZlcmlmaWVkIChkbnMgb3IgaXAgcmFuZ2UpLgogLSBQYXRoIGV4Y2x1c2lvbiBjb25maWdzIHRoYXQgbGV0IG1hY2hpbmUtZmFjaW5nIG9yIG5vbi1uYXZpZ2F0aW9uYWwgcmVxdWVzdHMgdGhyb3VnaCB3aXRob3V0IGEKICAgY2hhbGxlbmdlOgogICAtIGBhcHBzZWMtYm90LWNoYWxsZW5nZS1leGNsdWRlLWNyYXdsZXItZmlsZXNgIOKAlCBgL3JvYm90cy50eHRgLCBgLy53ZWxsLWtub3duLypgLCBgL3NlY3VyaXR5LnR4dGAsIOKApgogICAtIGBhcHBzZWMtYm90LWNoYWxsZW5nZS1leGNsdWRlLWZlZWRzYCDigJQgUlNTL0F0b20gZmVlZCBwYXRocwogICAtIGBhcHBzZWMtYm90LWNoYWxsZW5nZS1leGNsdWRlLXdlYmhvb2tzYCDigJQgdGhpcmQtcGFydHkgd2ViaG9vayBwYXRocwogICAtIGBhcHBzZWMtYm90LWNoYWxsZW5nZS1leGNsdWRlLXN0YXRpY2Ag4oCUIHN0YXRpYyBhc3NldHMgYW5kIG1lZGlhCiAgIC0gYGFwcHNlYy1ib3QtY2hhbGxlbmdlLWV4Y2x1ZGUtYXBpYCDigJQgcHJvZ3JhbW1hdGljIGVuZHBvaW50cwogLSBTY2VuYXJpb3MgdGhhdCBhbGVydCBvbiBkZXRlY3RlZCBib3RzIGFuZCBvbiBjaGFsbGVuZ2UgYWJ1c2UuCiAtIEEgdXNlci1mcmllbmRseSBhbGVydCBjb250ZXh0IGV4cG9zaW5nIGBmc2lkYCwgT1MsIGFuZCB0aGUgYm90IHNpZ25hbHMgdGhhdCBmaXJlZC4KCiMjIEVuYWJsaW5nIGJvdCBjaGFsbGVuZ2UKCkFkZCB0aGUgYGNyb3dkc2VjdXJpdHkvYXBwc2VjLWJvdC0qYCBhcHBzZWMtY29uZmlncyB0byB5b3VyIFdBRiBhY3F1aXNpdGlvbiwgcGx1cyBhbnkgb2YgdGhlCndlbGwta25vd24tcGF0aCBleGNsdXNpb24gY29uZmlncyB5b3UgbmVlZDoKCmBgYHlhbWwKYXBwc2VjX2NvbmZpZ3M6CiAtIGNyb3dkc2VjdXJpdHkvYXBwc2VjLWJvdC0qCmxhYmVsczoKICB0eXBlOiBhcHBzZWMKbGlzdGVuX2FkZHI6IDEyNy4wLjAuMTo3NDIyCnNvdXJjZTogYXBwc2VjCmBgYAo=", + "long_description": "IyBBcHBTZWMgQm90IENoYWxsZW5nZQoKVGhpcyBjb2xsZWN0aW9uIGVuYWJsZXMgQ3Jvd2RTZWMgQXBwU2VjICoqY2hhbGxlbmdlIG1vZGUqKiBmb3IgYm90IGRldGVjdGlvbjogdmlzaXRvcnMgYXJlIHNlcnZlZCBhCmxpZ2h0d2VpZ2h0IHByb29mLW9mLXdvcmsgKyBicm93c2VyLWZpbmdlcnByaW50IGNoYWxsZW5nZSwgYW5kIGNsaWVudHMgZmxhZ2dlZCBhcyBrbm93biBib3RzIGJ5IHRoZQpmYXN0IGJvdCBkZXRlY3Rpb24gYXJlIHJlamVjdGVkLgoKV2hhdCBpdCBzaGlwczoKCiAtIGBjcm93ZHNlY3VyaXR5L2FwcHNlYy1ib3QtY2hhbGxlbmdlLXNpbXBsZWA6IGNoYWxsZW5nZXMgaW5jb21pbmcgcmVxdWVzdHMgYW5kIHJlamVjdHMgY2hhbGxlbmdlCiAgIHN1Ym1pc3Npb25zIHdob3NlIGZpbmdlcnByaW50IHRyaXBzIHRoZSBib3QgZGV0ZWN0aW9uLgogLSBWZXJpZmllZC1nb29kLWJvdCBleGNsdXNpb24gY29uZmlncyB0aGF0IGV4ZW1wdCBrbm93biBib3RzIGZyb20gdGhlIGNoYWxsZW5nZSwgc3BsaXQgYnkgZmFtaWx5IHNvIHlvdQogICBjYW4gZW5hYmxlIG9ubHkgdGhlIG9uZXMgeW91IG5lZWQuIEVhY2ggY29uZmlnIGJvdGggZGVjbGFyZXMgdGhlIGRhdGFmaWxlcyBhbmQgZXhlbXB0cyBhIG1hdGNoOgogICAtIGBjcm93ZHNlY3VyaXR5L2FwcHNlYy1ib3QtY2hhbGxlbmdlLWV4Y2x1ZGUtc2VhcmNoLWVuZ2luZXNgOiBnb29nbGVib3QsIGJpbmdib3QsIGFwcGxlYm90LCBhbWF6b25ib3QsCiAgICAgeWFuZGV4LCBiYWlkdSwgeWFob28sIHNvZ291LCBxd2FudCwgYmFiYmFyLCBkdWNrZHVja2JvdAogICAtIGBjcm93ZHNlY3VyaXR5L2FwcHNlYy1ib3QtY2hhbGxlbmdlLWV4Y2x1ZGUtYWktY3Jhd2xlcnNgOiBncHRib3QsIG9wZW5haS1zZWFyY2hib3QsIG9wZW5haS1jaGF0Z3B0LXVzZXIsCiAgICAgcGVycGxleGl0eWJvdAogICAtIGBjcm93ZHNlY3VyaXR5L2FwcHNlYy1ib3QtY2hhbGxlbmdlLWV4Y2x1ZGUtc29jaWFsYDogbWV0YSwgZGlzY29yZCwgdGVsZWdyYW0sIHR3aXR0ZXJib3QsIHBpbnRlcmVzdAogICAtIGBjcm93ZHNlY3VyaXR5L2FwcHNlYy1ib3QtY2hhbGxlbmdlLWV4Y2x1ZGUtbW9uaXRvcmluZ2A6IHVwdGltZXJvYm90LCBjb29raWVib3QsIGRhdGFkb2csIHBhZ2VyZHV0eQoKICAgQSBib3QgaXMgZXhlbXB0ZWQgKipvbmx5Kiogd2hlbiBpdCBjYW4gYmUgbmV0d29yay12ZXJpZmllZCAoZG5zIG9yIGlwIHJhbmdlKS4KIC0gUGF0aCBleGNsdXNpb24gY29uZmlncyB0aGF0IGxldCBtYWNoaW5lLWZhY2luZyBvciBub24tbmF2aWdhdGlvbmFsIHJlcXVlc3RzIHRocm91Z2ggd2l0aG91dCBhCiAgIGNoYWxsZW5nZToKICAgLSBgYXBwc2VjLWJvdC1jaGFsbGVuZ2UtZXhjbHVkZS1jcmF3bGVyLWZpbGVzYCDigJQgYC9yb2JvdHMudHh0YCwgYC8ud2VsbC1rbm93bi8qYCwgYC9zZWN1cml0eS50eHRgLCDigKYKICAgLSBgYXBwc2VjLWJvdC1jaGFsbGVuZ2UtZXhjbHVkZS1mZWVkc2Ag4oCUIFJTUy9BdG9tIGZlZWQgcGF0aHMKICAgLSBgYXBwc2VjLWJvdC1jaGFsbGVuZ2UtZXhjbHVkZS13ZWJob29rc2Ag4oCUIHRoaXJkLXBhcnR5IHdlYmhvb2sgcGF0aHMKICAgLSBgYXBwc2VjLWJvdC1jaGFsbGVuZ2UtZXhjbHVkZS1zdGF0aWNgIOKAlCBzdGF0aWMgYXNzZXRzIGFuZCBtZWRpYQogICAtIGBhcHBzZWMtYm90LWNoYWxsZW5nZS1leGNsdWRlLWFwaWAg4oCUIHByb2dyYW1tYXRpYyBlbmRwb2ludHMKIC0gU2NlbmFyaW9zIHRoYXQgYWxlcnQgb24gZGV0ZWN0ZWQgYm90cyBhbmQgb24gY2hhbGxlbmdlIGFidXNlLgogLSBBIHVzZXItZnJpZW5kbHkgYWxlcnQgY29udGV4dCBleHBvc2luZyBgZnNpZGAsIE9TLCBhbmQgdGhlIGJvdCBzaWduYWxzIHRoYXQgZmlyZWQuCgojIyBFbmFibGluZyBib3QgY2hhbGxlbmdlCgpBZGQgdGhlIGBjcm93ZHNlY3VyaXR5L2FwcHNlYy1ib3QtKmAgYXBwc2VjLWNvbmZpZ3MgdG8geW91ciBXQUYgYWNxdWlzaXRpb24sIHBsdXMgYW55IG9mIHRoZQp3ZWxsLWtub3duLXBhdGggZXhjbHVzaW9uIGNvbmZpZ3MgeW91IG5lZWQ6CgpgYGB5YW1sCmFwcHNlY19jb25maWdzOgogLSBjcm93ZHNlY3VyaXR5L2FwcHNlYy1ib3QtKgpsYWJlbHM6CiAgdHlwZTogYXBwc2VjCmxpc3Rlbl9hZGRyOiAxMjcuMC4wLjE6NzQyMgpzb3VyY2U6IGFwcHNlYwpgYGAK", "parsers": [ "crowdsecurity/appsec-logs", "crowdsecurity/appsec-bot-detection-logs" @@ -7963,7 +7965,7 @@ "crowdsecurity/appsec-bot-challenge-too-many-submissions", "crowdsecurity/appsec-bot-challenge-request-with-no-submission" ], - "version": "0.5", + "version": "0.6", "versions": { "0.1": { "deprecated": false, @@ -7984,6 +7986,10 @@ "0.5": { "deprecated": false, "digest": "3f99fdceabb67f9ad3d3708e9025b0cf02b422fc86572ac2ec1146864d587a90" + }, + "0.6": { + "deprecated": false, + "digest": "82120b9aa9ec7983344eda0a9fc1d852fe34eddba774b363cbf37bc0dc980dfd" } } },