From 0337eb30714d4121d284c32f087ed0d6195671e7 Mon Sep 17 00:00:00 2001 From: Maxime Killinger Date: Sat, 29 Aug 2026 13:54:33 +0200 Subject: [PATCH] fix: use lowercase JSON keys matching CrowdSec's real alert schema CrowdSec's notification-http plugin serializes alerts with lowercase keys (source/ip/cn/scenario), not the PascalCase (Source/IP/Cn/Scenario) this code was reading. Every lookup silently fell through to its default value, so every notification showed 'unknown' regardless of the real IP, country or scenario. Confirmed by capturing a real payload. --- app.py | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/app.py b/app.py index c0fd9e4..dd38041 100644 --- a/app.py +++ b/app.py @@ -72,9 +72,9 @@ def handle_crowdsec(): # Group by IP ip_groups = {} for alert in alerts: - ip = alert.get("Source", {}).get("IP", "unknown") - country = alert.get("Source", {}).get("Cn", "") - scenario = alert.get("Scenario", "unknown") + ip = alert.get("source", {}).get("ip", "unknown") + country = alert.get("source", {}).get("cn", "") + scenario = alert.get("scenario", "unknown") if ip not in ip_groups: ip_groups[ip] = {"country": country, "scenarios": set()}