feat: deduplicate CrowdSec alert scenarios per IP
All checks were successful
🚀 Docker Build and Push / build-and-push (push) Successful in 2m18s
All checks were successful
🚀 Docker Build and Push / build-and-push (push) Successful in 2m18s
- Use a set to collect scenarios for each IP address to prevent duplicate entries (e.g., multiple 'http-probing' lists). - Sort scenarios alphabetically for consistent notification output. - Improve notification readability by grouping repetitive alerts.
This commit is contained in:
6
app.py
6
app.py
@@ -77,8 +77,8 @@ def handle_crowdsec():
|
||||
scenario = alert.get("Scenario", "unknown")
|
||||
|
||||
if ip not in ip_groups:
|
||||
ip_groups[ip] = {"country": country, "scenarios": []}
|
||||
ip_groups[ip]["scenarios"].append(format_scenario(scenario))
|
||||
ip_groups[ip] = {"country": country, "scenarios": set()}
|
||||
ip_groups[ip]["scenarios"].add(format_scenario(scenario))
|
||||
|
||||
# Format message
|
||||
num_ips = len(ip_groups)
|
||||
@@ -89,7 +89,7 @@ def handle_crowdsec():
|
||||
whois_link = f"https://who.is/whois-ip/ip-address/{ip}"
|
||||
lines.append(f"🚫 {ip} ({country_name})")
|
||||
lines.append(f" 🔗 {whois_link}")
|
||||
for scenario in data["scenarios"]:
|
||||
for scenario in sorted(data["scenarios"]):
|
||||
lines.append(f" └ {scenario}")
|
||||
lines.append("")
|
||||
|
||||
|
||||
Reference in New Issue
Block a user