relax the 403 abuse rule to reduce FP rate [ci skip]

2025-10-18 19:02:20 +00:00 · 2025-10-18 19:02:20 +00:00 · e737b482a2
commit e737b482a2
parent 9e6b0cb6d9
1 changed files with 3 additions and 3 deletions
--- a/modules/kubernetes/crowdsec/main.tf
+++ b/modules/kubernetes/crowdsec/main.tf
@ -35,9 +35,9 @@ resource "kubernetes_config_map" "crowdsec_custom_scenarios" {
      description: "Detect IPs triggering too many HTTP 403s in NGINX ingress logs"
      filter: "evt.Meta.log_type == 'http_access-log' && evt.Parsed.status == '403'"
      groupby: "evt.Meta.source_ip"
-      leakspeed: "10s"
-      capacity: 5
-      blackhole: 1m
+      leakspeed: "30s"
+      capacity: 10
+      blackhole: 5m
      labels:
        service: http
        behavior: abusive_403