mirrors/crowdsec
1
0
Fork 0
mirror of https://github.com/crowdsecurity/crowdsec.git synced 2025-05-10 20:05:55 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions

Merge 2ef06e6140 into 505ad36dfd

Browse source
This commit is contained in:
mmetc 2025-05-09 15:22:41 +00:00 • committed by GitHub
commit a5c40c92ee
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 13 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

17
pkg/csprofiles/csprofiles.go
View file

@ -23,7 +23,10 @@ type Runtime struct {
Logger *log.Entry `json:"-" yaml:"-"`
}
const defaultDuration = "4h"
const (
defaultDuration = "4h"
defaultType = "ban"
)
func NewProfile(profilesCfg []*csconfig.ProfileCfg) ([]*Runtime, error) {
var err error
@ -78,7 +81,7 @@ func NewProfile(profilesCfg []*csconfig.ProfileCfg) ([]*Runtime, error) {
for _, decision := range profile.Decisions {
if runtime.RuntimeDurationExpr == nil {
var duration string
if decision.Duration != nil {
if decision.Duration != nil && *decision.Duration != "" {
duration = *decision.Duration
} else {
runtime.Logger.Warningf("No duration specified for %s, using default duration %s", profile.Name, defaultDuration)
@ -122,8 +125,10 @@ func (profile *Runtime) GenerateDecisionFromProfile(alert *models.Alert) ([]*mod
/*some fields are populated from the reference object : duration, scope, type*/
decision.Duration = new(string)
if refDecision.Duration != nil {
if refDecision.Duration != nil && *refDecision.Duration != "" {
*decision.Duration = *refDecision.Duration
} else {
*decision.Duration = defaultDuration
}
if profile.Cfg.DurationExpr != "" && profile.RuntimeDurationExpr != nil {
@ -146,7 +151,11 @@ func (profile *Runtime) GenerateDecisionFromProfile(alert *models.Alert) ([]*mod
}
decision.Type = new(string)
*decision.Type = *refDecision.Type
if refDecision.Type != nil && *refDecision.Type != "" {
*decision.Type = *refDecision.Type
} else {
*decision.Type = defaultType
}
/*for the others, let's populate it from the alert and its source*/
decision.Value = new(string)