Key by ip, ua

Ruben van Vreeland · Ruben van Vreeland · commit 7d6c0e106780 · 2017-12-29T18:17:56.000+01:00
diff --git a/rule_templates/relevant_attack_template.yaml b/rule_templates/relevant_attack_template.yaml
@@ -15,6 +15,11 @@ filter:
 index: bitsensor-detections-*
 timestamp_field: endpoint.localtime
 
+# Key per profile
+query_key:
+  - context.ip
+  - context.http.userAgent
+
 # When the attacker continues, send a new alert after x minutes
 realert:
   minutes: 10
