Country Code (CC) in custom regex ?
Posted: 10 Mar 2023, 08:21
Hello, it's possible to read the country code in a the customer regex?
In my case, I want to block xmlrpc attacks on all countries except spain.
Something like this will run?
if (($globlogs{CUSTOM1_LOG}{$lgfile}) and ($line =~ /(\S+).*] "\w*(?:GET|POST) and ($cc != ES) \/xmlrpc\.php.*" /)) {
return ("xmlrpc attack",$1,"xmlrpc","20","80,443","3600");
}
Thanks!
In my case, I want to block xmlrpc attacks on all countries except spain.
Something like this will run?
if (($globlogs{CUSTOM1_LOG}{$lgfile}) and ($line =~ /(\S+).*] "\w*(?:GET|POST) and ($cc != ES) \/xmlrpc\.php.*" /)) {
return ("xmlrpc attack",$1,"xmlrpc","20","80,443","3600");
}
Thanks!