How to disable scenario like crowdsecurity/http-generic-bf

[mts-dyt]

How can we disable scenario using helm charts?
I have many false positives on crowdsecurity/http-generic-bf -> LePresidente/http-generic-*
I would like to disable the whole scenario using helm values

[github-actions]

@mts-dyt: Thanks for opening an issue, it is currently awaiting triage.

If you haven't already, please provide the following information:

• kind : bug, enhancementor documentation
• area : agent, appsec, configuration, cscli, local-api

In the meantime, you can:

1. Check Crowdsec Documentation to see if your issue can be self resolved.
2. You can also join our Discord.
3. Check Releases to make sure your agent is on the latest version.

Details

I am a bot created to help the crowdsecurity developers manage community feedback and contributions. You can check out my manifest file to understand my behavior and what I can do. If you want to use this for your project, you can check out the forked project rr404/oss-governance-bot repository.

[github-actions]

@mts-dyt: There are no 'kind' label on this issue. You need a 'kind' label to start the triage process.

• /kind bug
• /kind documentation
• /kind enhancement

Details

I am a bot created to help the crowdsecurity developers manage community feedback and contributions. You can check out my manifest file to understand my behavior and what I can do. If you want to use this for your project, you can check out the forked project rr404/oss-governance-bot repository.

[LaurenceJJones]

You can add the env of the agent

agent:
  env:
   name: "DISABLE_SCENARIOS"
   value: "crowdsecurity/http-generic-bf"

[blotus]

Hello,

You can also create a custom post-overflow if you want to disable the scenario for only specific actions.

For example, to disable the scenario only on the /foo path:

config:
  postoverflows:
    s01-whitelist:
      my-custom-postoverflow.yaml: |
       name: my/custom-postoverflow
       description: ignore any alerts from crowdsecurity/http-generic-bf 
       whitelist:
          reason: crowdsecurity/http-generic-bf gives FP
          expression:
            - evt.Overflow.Alert.Scenario == "crowdsecurity/http-generic-bf" && all(evt.Overflow.Alert.Events, {.GetMeta("http_path") startsWith "/foo"})

[mts-dyt]

Thanks a lot, you are a life saver 🙏🏾

downloading parsers:crowdsecurity/cri-logs
enabling parsers:crowdsecurity/cri-logs
Running: cscli  scenarios remove "crowdsecurity/http-generic-bf" --force
Nothing to install or remove.