{
  "slug":             "ips",
  "properties":       {
    "slug":                  "ips",
    "load_priority":         15,
    "menu_priority":         30,
    "name":                  "Block Bad IPs/Visitors",
    "namespace":             "IPs",
    "sidebar_name":          "IP Blocking",
    "show_module_menu_item": false,
    "show_module_options":   true,
    "storage_key":           "ips",
    "tagline":               "Detect malicious bots and visitors, and block them from accessing the site.",
    "show_central":          true,
    "access_restricted":     true,
    "premium":               false,
    "run_if_whitelisted":    true,
    "run_if_verified_bot":   true,
    "run_if_wpcli":          true,
    "order":                 100
  },
  "menus":            {
    "config_menu_priority": 20
  },
  "reqs":             {
    "dbs": [
      "ips"
    ]
  },
  "wpcli":            {
    "enabled": true
  },
  "custom_redirects": [
    {
      "source_mod_page": "ips-redirect",
      "target_mod_page": "insights",
      "query_args":      {
        "inav": "ips"
      }
    }
  ],
  "sections":         [
    {
      "slug":        "section_auto_black_list",
      "primary":     true,
      "title":       "Automatic IP Black List",
      "title_short": "Auto IP Blocking Rules",
      "beacon_id":   208,
      "summary":     [
        "Purpose - The Automatic IP Black List system will block the IP addresses of naughty visitors after a specified number of transgressions.",
        "Recommendation - Keep the Automatic IP Black List feature turned on."
      ]
    },
    {
      "slug":        "section_antibot",
      "title":       "AntiBot System",
      "title_short": "AntiBot System"
    },
    {
      "slug":        "section_crowdsec",
      "title":       "CrowdSec",
      "title_short": "CrowdSec"
    },
    {
      "slug":        "section_bot_behaviours",
      "title":       "Identify Common Bot Behaviours",
      "title_short": "Bot Behaviours",
      "beacon_id":   124,
      "summary":     [
        "Recommendation - Enable to capture bots/spiders that don't honour 'nofollow' directives."
      ]
    },
    {
      "slug":        "section_user_messages",
      "title":       "Customize Messages Shown To User",
      "title_short": "Visitor Messages",
      "beacon_id":   139,
      "summary":     [
        "Purpose - Customize the messages shown to visitors.",
        "Recommendation - Be sure to change the messages to suit your audience.",
        "Hint - To reset any message to its default, enter the text exactly: default"
      ]
    },
    {
      "slug":        "section_enable_plugin_feature_ips",
      "title":       "Enable Module: IP Manager",
      "title_short": "Disable Module",
      "beacon_id":   208,
      "summary":     [
        "Purpose - The IP Manager allows you to whitelist, blacklist and configure auto-blacklist rules.",
        "Recommendation - Keep the IP Manager feature turned on. You should also carefully review the automatic black list settings."
      ]
    },
    {
      "slug":   "section_non_ui",
      "hidden": true
    }
  ],
  "options":          [
    {
      "key":         "enable_ips",
      "section":     "section_enable_plugin_feature_ips",
      "advanced":    true,
      "default":     "Y",
      "type":        "checkbox",
      "link_info":   "https://shsec.io/ea",
      "link_blog":   "https://shsec.io/wpsf26",
      "beacon_id":   208,
      "name":        "Enable IP Manager",
      "summary":     "Enable (or Disable) The IP Manager module",
      "description": "Un-Checking this option will completely disable the IP Manager module"
    },
    {
      "key":         "antibot_minimum",
      "section":     "section_antibot",
      "default":     45,
      "type":        "integer",
      "min":         0,
      "max":         99,
      "link_info":   "https://shsec.io/jy",
      "link_blog":   "https://shsec.io/jz",
      "beacon_id":   424,
      "name":        "AntiBot Threshold",
      "summary":     "AntiBot Testing Threshold (Percentage)",
      "description": "When using Shield's AntiBot system, this is the threshold used for testing (between 1 and 99)."
    },
    {
      "key":         "antibot_high_reputation_minimum",
      "section":     "section_antibot",
      "type":        "integer",
      "default":     200,
      "min":         0,
      "link_info":   "https://shsec.io/jy",
      "link_blog":   "https://shsec.io/jz",
      "beacon_id":   431,
      "name":        "High Reputation Bypass",
      "summary":     "Prevent IPs/Visitors With High Reputation Scores From Being Blocked",
      "description": "Ensures that visitors with a high reputation are never blocked by Shield."
    },
    {
      "key":         "force_notbot",
      "section":     "section_antibot",
      "advanced":    true,
      "default":     "Y",
      "type":        "checkbox",
      "link_info":   "https://shsec.io/jy",
      "link_blog":   "https://shsec.io/jz",
      "beacon_id":   448,
      "name":        "Force NotBot JS",
      "summary":     "Force Loading Of NotBot JS",
      "description": "Use this option if you're using an aggressive caching plugin or system to ensure NotBot JS is loaded for visitors."
    },
    {
      "key":         "transgression_limit",
      "section":     "section_auto_black_list",
      "type":        "integer",
      "default":     10,
      "min":         0,
      "link_info":   "https://shsec.io/wpsf24",
      "link_blog":   "https://shsec.io/wpsf26",
      "beacon_id":   207,
      "name":        "Offense Limit",
      "summary":     "Visitor IP address will be Black Listed after X bad actions on your site",
      "description": "A black mark is set against an IP address each time a visitor trips the defenses of the Shield plugin. When the number of these offenses exceeds specified limit, they are automatically blocked from accessing the site. Set this to 0 to turn off the Automatic IP Black List feature."
    },
    {
      "key":           "auto_expire",
      "section":       "section_auto_black_list",
      "advanced":      true,
      "default":       "day",
      "type":          "select",
      "value_options": [
        {
          "value_key": "hour",
          "text":      "Hour"
        },
        {
          "value_key": "day",
          "text":      "Day"
        },
        {
          "value_key": "week",
          "text":      "Week"
        },
        {
          "value_key": "month",
          "text":      "Month"
        }
      ],
      "link_info":     "https://shsec.io/wpsf25",
      "link_blog":     "https://shsec.io/wpsf26",
      "beacon_id":     210,
      "name":          "Auto Block Expiration",
      "summary":       "After 1 'X' a black listed IP will be removed from the black list",
      "description":   "Permanent and lengthy IP Black Lists are harmful to performance. You should allow IP addresses on the black list to be eventually removed over time. Shorter IP black lists are more efficient and a more intelligent use of an IP-based blocking system."
    },
    {
      "key":           "user_auto_recover",
      "section":       "section_auto_black_list",
      "advanced":      true,
      "premium":       true,
      "default":       [],
      "type":          "multiple_select",
      "value_options": [
        {
          "value_key": "gasp",
          "text":      "With Shield Bot Protection"
        },
        {
          "value_key": "email",
          "text":      "Magic Email Links To Unblock Logged-In Users"
        }
      ],
      "link_info":     "https://shsec.io/f8",
      "link_blog":     "",
      "beacon_id":     125,
      "name":          "User Auto Unblock",
      "summary":       "Allow Visitors To Unblock Their IP",
      "description":   "Allow visitors blocked by the plugin to automatically unblock themselves."
    },
    {
      "key":         "request_whitelist",
      "section":     "section_auto_black_list",
      "advanced":    true,
      "premium":     true,
      "default":     [],
      "type":        "array",
      "link_info":   "https://shsec.io/gd",
      "link_blog":   "",
      "beacon_id":   126,
      "name":        "Request Path Whitelist",
      "summary":     "Request Path Whitelist",
      "description": "Request Path Whitelist."
    },
    {
      "key":           "cs_block",
      "section":       "section_crowdsec",
      "advanced":      true,
      "default":       "block_with_unblock",
      "type":          "select",
      "value_options": [
        {
          "value_key": "block_with_unblock",
          "text":      "Block Request With Ability To Auto-Unblock"
        },
        {
          "value_key": "block",
          "text":      "Block Request"
        },
        {
          "value_key": "disabled",
          "text":      "Disabled"
        }
      ],
      "link_info":     "",
      "link_blog":     "",
      "beacon_id":     471,
      "name":          "CrowdSec IP Blocking",
      "summary":       "How To Handle Requests From IPs Found On CrowdSec Blocklist",
      "description":   "How should Shield block requests from IP address that are found on CrowdSec's list of malicious IP addresses."
    },
    {
      "key":         "cs_enroll_id",
      "section":     "section_crowdsec",
      "sensitive":   true,
      "premium":     false,
      "default":     "",
      "type":        "text",
      "link_info":   "",
      "link_blog":   "",
      "beacon_id":   474,
      "name":        "Enroll ID",
      "summary":     "CrowdSec Enroll ID",
      "description": "CrowdSec Enroll ID."
    },
    {
      "key":           "track_loginfailed",
      "section":       "section_bot_behaviours",
      "default":       "transgression-single",
      "type":          "select",
      "value_options": [
        {
          "value_key": "disabled",
          "text":      "Disabled"
        },
        {
          "value_key": "log",
          "text":      "Activity Log Only"
        },
        {
          "value_key": "transgression-single",
          "text":      "Increment Offense Counter"
        },
        {
          "value_key": "transgression-double",
          "text":      "Double-Increment Offense Counter"
        },
        {
          "value_key": "block",
          "text":      "Immediate Block"
        }
      ],
      "link_info":     "https://shsec.io/fn",
      "link_blog":     "https://shsec.io/f7",
      "beacon_id":     122,
      "name":          "Failed Login",
      "summary":       "Detect Failed Login Attempts By Valid Usernames",
      "description":   "Penalise a visitor who fails to login using a valid username."
    },
    {
      "key":           "track_xmlrpc",
      "section":       "section_bot_behaviours",
      "default":       "log",
      "type":          "select",
      "value_options": [
        {
          "value_key": "disabled",
          "text":      "Disabled"
        },
        {
          "value_key": "log",
          "text":      "Activity Log Only"
        },
        {
          "value_key": "transgression-single",
          "text":      "Increment Offense Counter"
        },
        {
          "value_key": "transgression-double",
          "text":      "Double-Increment Offense Counter"
        },
        {
          "value_key": "block",
          "text":      "Immediate Block"
        }
      ],
      "link_info":     "https://shsec.io/fo",
      "link_blog":     "https://shsec.io/f7",
      "beacon_id":     123,
      "name":          "XML-RPC Access",
      "summary":       "Identify A Bot When It Accesses XML-RPC",
      "description":   "If you don't use XML-RPC, why would anyone access it?"
    },
    {
      "key":           "track_logininvalid",
      "section":       "section_bot_behaviours",
      "premium":       true,
      "default":       "log",
      "type":          "select",
      "value_options": [
        {
          "value_key": "disabled",
          "text":      "Disabled"
        },
        {
          "value_key": "log",
          "text":      "Activity Log Only"
        },
        {
          "value_key": "transgression-single",
          "text":      "Increment Offense Counter",
          "premium":   true
        },
        {
          "value_key": "transgression-double",
          "text":      "Double-Increment Offense Counter",
          "premium":   true
        },
        {
          "value_key": "block",
          "text":      "Immediate Block",
          "premium":   true
        }
      ],
      "link_info":     "https://shsec.io/fn",
      "link_blog":     "https://shsec.io/f7",
      "beacon_id":     122,
      "name":          "Invalid Usernames",
      "summary":       "Detect Invalid Username Logins",
      "description":   "Identify A Bot When It Tries To Login With A Non-Existent Username."
    },
    {
      "key":           "track_fakewebcrawler",
      "section":       "section_bot_behaviours",
      "premium":       true,
      "default":       "log",
      "type":          "select",
      "value_options": [
        {
          "value_key": "disabled",
          "text":      "Disabled"
        },
        {
          "value_key": "log",
          "text":      "Activity Log Only"
        },
        {
          "value_key": "transgression-single",
          "text":      "Increment Offense Counter",
          "premium":   true
        },
        {
          "value_key": "transgression-double",
          "text":      "Double-Increment Offense Counter",
          "premium":   true
        },
        {
          "value_key": "block",
          "text":      "Immediate Block",
          "premium":   true
        }
      ],
      "link_info":     "https://shsec.io/f5",
      "link_blog":     "https://shsec.io/f7",
      "beacon_id":     124,
      "name":          "Fake Web Crawler",
      "summary":       "Detect Fake Search Engine Crawlers",
      "description":   "Identify a Bot when it presents as an official web crawler, but analysis shows it's fake."
    },
    {
      "key":           "track_404",
      "section":       "section_bot_behaviours",
      "premium":       true,
      "default":       "log",
      "type":          "select",
      "value_options": [
        {
          "value_key": "disabled",
          "text":      "Disabled"
        },
        {
          "value_key": "log",
          "text":      "Activity Log Only"
        },
        {
          "value_key": "transgression-single",
          "text":      "Increment Offense Counter",
          "premium":   true
        },
        {
          "value_key": "transgression-double",
          "text":      "Double-Increment Offense Counter",
          "premium":   true
        },
        {
          "value_key": "block",
          "text":      "Immediate Block",
          "premium":   true
        }
      ],
      "link_info":     "https://shsec.io/fo",
      "link_blog":     "https://shsec.io/f7",
      "beacon_id":     123,
      "name":          "404 Detect",
      "summary":       "Identify A Bot When It Hits A 404",
      "description":   "Detect When A Visitor Browses To A Non-Existent Page."
    },
    {
      "key":           "track_linkcheese",
      "section":       "section_bot_behaviours",
      "premium":       true,
      "default":       "disabled",
      "type":          "select",
      "value_options": [
        {
          "value_key": "disabled",
          "text":      "Disabled"
        },
        {
          "value_key": "log",
          "text":      "Activity Log Only"
        },
        {
          "value_key": "transgression-single",
          "text":      "Increment Offense Counter",
          "premium":   true
        },
        {
          "value_key": "transgression-double",
          "text":      "Double-Increment Offense Counter",
          "premium":   true
        },
        {
          "value_key": "block",
          "text":      "Immediate Block",
          "premium":   true
        }
      ],
      "link_info":     "https://shsec.io/fo",
      "link_blog":     "https://shsec.io/f6",
      "beacon_id":     206,
      "name":          "Link Cheese",
      "summary":       "Tempt A Bot With A Fake Link To Follow",
      "description":   "Detect A Bot That Follows A 'no-follow' Link."
    },
    {
      "key":           "track_invalidscript",
      "section":       "section_bot_behaviours",
      "premium":       true,
      "default":       "log",
      "type":          "select",
      "value_options": [
        {
          "value_key": "disabled",
          "text":      "Disabled"
        },
        {
          "value_key": "log",
          "text":      "Activity Log Only"
        },
        {
          "value_key": "transgression-single",
          "text":      "Increment Offense Counter",
          "premium":   true
        },
        {
          "value_key": "transgression-double",
          "text":      "Double-Increment Offense Counter",
          "premium":   true
        },
        {
          "value_key": "block",
          "text":      "Immediate Block",
          "premium":   true
        }
      ],
      "link_info":     "https://shsec.io/fo",
      "link_blog":     "https://shsec.io/f7",
      "beacon_id":     123,
      "name":          "Invalid Script Load",
      "summary":       "Identify A Bot Attempts To Load WordPress In A Non-Standard Way",
      "description":   "WordPress should only be loaded in a limited number of ways."
    },
    {
      "key":           "track_useragent",
      "section":       "section_bot_behaviours",
      "premium":       true,
      "default":       "log",
      "type":          "select",
      "value_options": [
        {
          "value_key": "disabled",
          "text":      "Disabled"
        },
        {
          "value_key": "log",
          "text":      "Activity Log Only"
        },
        {
          "value_key": "transgression-single",
          "text":      "Increment Offense Counter",
          "premium":   true
        },
        {
          "value_key": "transgression-double",
          "text":      "Double-Increment Offense Counter",
          "premium":   true
        },
        {
          "value_key": "block",
          "text":      "Immediate Block"
        }
      ],
      "link_info":     "https://shsec.io/fi",
      "link_blog":     "https://shsec.io/f7",
      "beacon_id":     124,
      "name":          "Empty User Agents",
      "summary":       "Detect Requests With Empty User Agents",
      "description":   "Identify a request as a bot if the user agent is not provided."
    },
    {
      "key":          "crowdsec_cfg",
      "section":      "section_non_ui",
      "transferable": false,
      "type":         "array",
      "default":      []
    },
    {
      "key":              "tmp_ips_started_at",
      "section":          "section_non_ui",
      "transferable":     false,
      "tracking_exclude": true,
      "type":             "integer",
      "default":          0
    }
  ],
  "definitions":      {
    "crowdsec":                  {
      "scenarios": {
        "free": [
          "crowdsecurity/http-bf-wordpress_bf",
          "crowdsecurity/http-wordpress_wpconfig",
          "crowdsecurity/http-wordpress_user-enum"
        ]
      }
    },
    "bot_signals":               {
      "allowable_ext_404s":        [
        "js",
        "css",
        "gif",
        "jpg",
        "jpeg",
        "png",
        "map",
        "ttf",
        "woff",
        "woff2"
      ],
      "allowable_invalid_scripts": [
        "index.php",
        "admin-ajax.php",
        "wp-activate.php",
        "wp-links-opml.php",
        "wp-cron.php",
        "wp-login.php",
        "wp-mail.php",
        "wp-comments-post.php",
        "wp-signup.php",
        "wp-trackback.php",
        "xmlrpc.php",
        "admin.php",
        "matomo.php",
        "umbrella-application.php"
      ]
    },
    "rest_api":                  {
      "publish":    true,
      "pro_only":   true,
      "route_defs": {
        "ips_get":     {
        },
        "lists_get":   {
        },
        "lists_getip": {
        },
        "lists_setip": {
        }
      }
    },
    "db_handler_classes":        {
      "botsignal":        "\\FernleafSystems\\Wordpress\\Plugin\\Shield\\Modules\\IPs\\DB\\BotSignal\\Ops\\Handler",
      "ip_rules":         "\\FernleafSystems\\Wordpress\\Plugin\\Shield\\Modules\\IPs\\DB\\IpRules\\Ops\\Handler",
      "crowdsec_signals": "\\FernleafSystems\\Wordpress\\Plugin\\Shield\\Modules\\IPs\\DB\\CrowdSecSignals\\Ops\\Handler"
    },
    "db_table_botsignal":        {
      "autoexpire":     0,
      "slug":           "botsignal",
      "has_updated_at": true,
      "col_older_than": "updated_at",
      "cols_custom":    {
        "ip_ref":             {
          "macro_type":  "foreign_key_id",
          "foreign_key": {
            "ref_table": "icwp_wpsf_ips"
          }
        },
        "notbot_at":          {
          "macro_type": "timestamp",
          "comment":    "NotBot"
        },
        "frontpage_at":       {
          "macro_type": "timestamp",
          "comment":    "Any Frontend Page Loaded"
        },
        "loginpage_at":       {
          "macro_type": "timestamp",
          "comment":    "Login Page Loaded"
        },
        "bt404_at":           {
          "macro_type": "timestamp",
          "comment":    "BotTrack 404"
        },
        "btfake_at":          {
          "macro_type": "timestamp",
          "comment":    "BotTrack FakeWebCrawler"
        },
        "btcheese_at":        {
          "macro_type": "timestamp",
          "comment":    "BotTrack LinkCheese"
        },
        "btloginfail_at":     {
          "macro_type": "timestamp",
          "comment":    "BotTrack LoginFailed"
        },
        "btua_at":            {
          "macro_type": "timestamp",
          "comment":    "BotTrack Useragent Fail"
        },
        "btxml_at":           {
          "macro_type": "timestamp",
          "comment":    "BotTrack XMLRPC Access"
        },
        "btlogininvalid_at":  {
          "macro_type": "timestamp",
          "comment":    "BotTrack LoginInvalid"
        },
        "btinvalidscript_at": {
          "macro_type": "timestamp",
          "comment":    "BotTrack InvalidScript"
        },
        "btauthorfishing_at": {
          "macro_type": "timestamp",
          "comment":    "BotTrack Author Username Fishing"
        },
        "cooldown_at":        {
          "macro_type": "timestamp",
          "comment":    "Cooldown Triggered"
        },
        "humanspam_at":       {
          "macro_type": "timestamp",
          "comment":    "Comment Marked As Human SPAM"
        },
        "markspam_at":        {
          "macro_type": "timestamp",
          "comment":    "Mark Comment As SPAM"
        },
        "unmarkspam_at":      {
          "macro_type": "timestamp",
          "comment":    "Unmark Comment As SPAM"
        },
        "captchapass_at":     {
          "macro_type": "timestamp",
          "comment":    "Captcha Passed"
        },
        "captchafail_at":     {
          "macro_type": "timestamp",
          "comment":    "Captcha Failed"
        },
        "auth_at":            {
          "macro_type": "timestamp",
          "comment":    "Successful Login"
        },
        "firewall_at":        {
          "macro_type": "timestamp",
          "comment":    "Triggered Firewall"
        },
        "ratelimit_at":       {
          "macro_type": "timestamp",
          "comment":    "Rate Limit Exceeded"
        },
        "offense_at":         {
          "macro_type": "timestamp",
          "comment":    "Last Offense"
        },
        "blocked_at":         {
          "macro_type": "timestamp",
          "comment":    "Last Block"
        },
        "unblocked_at":       {
          "macro_type": "timestamp",
          "comment":    "Unblocked"
        },
        "bypass_at":          {
          "macro_type": "timestamp",
          "comment":    "Bypass"
        },
        "snsent_at":          {
          "macro_type": "timestamp",
          "comment":    "Sent To ShieldNET"
        }
      }
    },
    "db_table_ip_rules":         {
      "autoexpire":      0,
      "slug":            "ip_rules",
      "has_updated_at":  true,
      "col_older_than":  "updated_at",
      "cols_custom":     {
        "ip_ref":     {
          "macro_type":  "foreign_key_id",
          "foreign_key": {
            "ref_table": "icwp_wpsf_ips"
          }
        },
        "cidr":       {
          "macro_type": "unsigned_int",
          "length":     3,
          "comment":    "CIDR"
        },
        "is_range":   {
          "macro_type": "bool",
          "default":    0,
          "comment":    "Is IP Range"
        },
        "offenses":   {
          "macro_type": "unsigned_int",
          "length":     3,
          "comment":    "Offenses Count"
        },
        "type":       {
          "macro_type": "char",
          "length":     2,
          "comment":    "List"
        },
        "label":      {
          "macro_type": "varchar",
          "length":     255,
          "comment":    "IP Description"
        },
        "can_export": {
          "macro_type": "bool",
          "default":    0,
          "comment":    "Can This IP Be Exported"
        }
      },
      "cols_timestamps": {
        "last_access_at":          {
          "comment": "Last Access"
        },
        "blocked_at":              {
          "comment": "IP Blocked"
        },
        "unblocked_at":            {
          "comment": "Visitor Requested Unblock"
        },
        "last_unblock_attempt_at": {
          "comment": "Last Time An Auto-Unblock Attempt Was Made"
        },
        "expires_at":              {
          "comment": "The IP Rule on this lists expires at this time."
        },
        "imported_at":             {
          "comment": "This IP rule was imported from a master site."
        }
      }
    },
    "db_table_crowdsec_signals": {
      "autoexpire":      0,
      "slug":            "crowdsec_signals",
      "has_updated_at":  false,
      "has_created_at":  true,
      "has_deleted_at":  false,
      "col_older_than":  "created_at",
      "cols_custom":     {
        "scenario": {
          "macro_type": "varchar",
          "length":     32,
          "attr":       []
        },
        "scope":    {
          "macro_type": "varchar",
          "length":     16,
          "attr":       []
        },
        "value":    {
          "macro_type": "varchar",
          "length":     256,
          "attr":       []
        }
      },
      "cols_timestamps": {
        "milli_at": {
          "comment": "Milliseconds"
        }
      }
    },
    "events":                    {
      "conn_kill":                   {
        "level":           "warning",
        "audit_countable": true
      },
      "conn_kill_crowdsec":          {
        "level":           "warning",
        "audit_countable": true
      },
      "conn_not_kill_high_rep":      {
        "level": "debug"
      },
      "ip_offense":                  {
        "level":        "warning",
        "audit_params": [
          "from",
          "to"
        ]
      },
      "ip_blocked":                  {
        "audit_params": [
          "from",
          "to"
        ],
        "level":        "alert"
      },
      "ip_unblock":                  {
        "audit_params": [
          "ip",
          "type"
        ],
        "level":        "notice",
        "offense":      false,
        "stat":         false
      },
      "ip_block_auto":               {
        "audit_params": [
          "ip"
        ],
        "level":        "alert",
        "offense":      false,
        "stat":         false
      },
      "ip_block_manual":             {
        "audit_params": [
          "ip"
        ],
        "level":        "alert",
        "offense":      false,
        "stat":         false
      },
      "ip_bypass_add":               {
        "audit_params": [
          "ip"
        ],
        "level":        "alert",
        "offense":      false,
        "stat":         false
      },
      "ip_bypass_remove":            {
        "audit_params": [
          "ip"
        ],
        "level":        "alert",
        "offense":      false,
        "stat":         false
      },
      "ip_unblock_auto":             {
        "audit_params": [
          "ip",
          "method"
        ],
        "level":        "alert"
      },
      "ip_unblock_flag":             {
        "audit_params": [
          "ip"
        ],
        "level":        "alert"
      },
      "bottrack_notbot":             {
        "offense": false,
        "stat":    false,
        "level":   "debug"
      },
      "bottrack_404":                {
        "audit_params": [
          "path"
        ],
        "offense":      true
      },
      "bottrack_fakewebcrawler":     {
        "audit_params": [
          "path",
          "crawler"
        ],
        "offense":      true
      },
      "bottrack_linkcheese":         {
        "audit_params": [
          "path"
        ],
        "offense":      true
      },
      "bottrack_loginfailed":        {
        "audit_params": [
          "user_login"
        ],
        "level":        "alert",
        "offense":      true
      },
      "bottrack_logininvalid":       {
        "audit_params": [
          "user_login"
        ],
        "level":        "alert",
        "offense":      true
      },
      "bottrack_xmlrpc":             {
        "audit_params": [
          "path"
        ],
        "offense":      true
      },
      "ade_check_option_disabled":   {
        "level":   "notice",
        "audit":   true,
        "offense": false
      },
      "ade_check_module_disabled":   {
        "level":   "notice",
        "audit":   true,
        "offense": false
      },
      "bottrack_invalidscript":      {
        "audit_params": [
          "script"
        ],
        "offense":      true
      },
      "comment_markspam":            {
        "level":   "notice",
        "offense": true
      },
      "comment_unmarkspam":          {
        "level":   "info",
        "offense": false,
        "stat":    false
      },
      "crowdsec_decisions_acquired": {
        "level":        "info",
        "audit_params": [
          "count_new",
          "count_deleted",
          "scope",
          "time_taken"
        ]
      },
      "crowdsec_signals_pushed":     {
        "level":        "info",
        "audit_params": [
          "count"
        ]
      },
      "crowdsec_mach_register":      {
        "level":        "notice",
        "audit_params": [
          "machine_id",
          "url"
        ]
      },
      "crowdsec_auth_acquire":       {
        "level":        "notice",
        "audit_params": [
          "expiration"
        ]
      },
      "crowdsec_mach_enroll":        {
        "level":        "notice",
        "audit_params": [
          "id",
          "name"
        ]
      }
    }
  }
}