fix(crowdsec): drop crawl-non_statics alerts for successful bursts

Replaces the per-service Music Assistant/Immich parser whitelists with one postoverflow whitelist: http-crawl-non_statics overflows are dropped unless at least half of the requests in the alert are 4xx. Every self-ban in the alert history (MA 350/368/477, Immich 149/150) was a burst of 200s from a signed-in UI. Every scanner ban on this scenario was 404s (/.env, /.git/...). The per-service rules only covered apps that had already failed and muted all scenarios on their paths; this covers any image-heavy UI and touches only this scenario. Verified in a crowdsecurity/crowdsec:v1.8.1 replay: a 60x200 burst is whitelisted, a 60x404 burst with distinct paths still overflows and is not whitelisted. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
fix(crowdsec): whitelist Immich timeline/asset loads
2026-10-27 14:23:43 +01:00 · 2026-10-27 13:55:40 +01:00 · 2026-10-27 13:54:34 +01:00
1 changed files with 19 additions and 0 deletions
@@ -80,6 +80,25 @@ spec:
          # community blocklists.
          - 162.55.50.97/32
          - 2a01:4f8:c2c:4579::1/128
+      postoverflows:
+        s01-whitelist:
+          # http-crawl-non_statics counts requests regardless of outcome, so a
+          # signed-in user of any image-heavy UI (Immich timeline, Music
+          # Assistant covers) trips it with a burst of 200s. Scanners trip it
+          # with 404s for paths that do not exist. Drop the overflow unless at
+          # least half of its requests were client errors (the alert carries
+          # the scenario's last 5 events, cache_size: 5). Only this scenario
+          # is affected; probing/sensitive-files/cve still fire on their own.
+          crawl-non-statics-success-whitelist.yaml: |
+            name: krenner/crawl-non-statics-success-whitelist
+            description: "Ignore http-crawl-non_statics bursts that mostly succeeded"
+            whitelist:
+              reason: "crawl burst of successful requests is a UI, not a scanner"
+              expression:
+                - >-
+                  evt.Overflow.Alert.GetScenario() == 'crowdsecurity/http-crawl-non_statics' &&
+                  count(evt.Overflow.Alert.Events, {.GetMeta('http_status') startsWith '4'}) * 2
+                  < len(evt.Overflow.Alert.Events)

    # mTLS between agents and the LAPI. Do not switch back to password auth:
    # the LAPI runs without persistence, so its machine-registration DB is