allow "cscli decisions list -a --ip"

[catharsis71]

What would you like to be added?

currently cscli decisions list -a --ip 85.208.96.212 dumps the entire decisions list instead of searching for the IP specified

it should instead search for the IP

Why is this needed?

this would be a useful feature because grepping the output of cscli decisions list -a can be unreliable unless you use regexes to filter out bad matches, i.e grepping for 85.208.96.212 can result in hits for 185.208.96.212 unless additional measures are taken

if -a and -ip could be combined then there would be no need to grep at all

[github-actions]

@catharsis71: Thanks for opening an issue, it is currently awaiting triage.

In the meantime, you can:

1. Check Crowdsec Documentation to see if your issue can be self resolved.
2. You can also join our Discord.
3. Check Releases to make sure your agent is on the latest version.

Details

I am a bot created to help the crowdsecurity developers manage community feedback and contributions. You can check out my manifest file to understand my behavior and what I can do. If you want to use this for your project, you can check out the BirthdayResearch/oss-governance-bot repository.

[github-actions]

@catharsis71: There are no 'kind' label on this issue. You need a 'kind' label to start the triage process.

• /kind feature
• /kind enhancement
• /kind refactoring
• /kind bug
• /kind packaging

Details

I am a bot created to help the crowdsecurity developers manage community feedback and contributions. You can check out my manifest file to understand my behavior and what I can do. If you want to use this for your project, you can check out the BirthdayResearch/oss-governance-bot repository.

[LaurenceJJones]

So I presume the reason you are using -a and --ip in conjunction is because the IP in question is from a blocklist (CAPI, third party)? if it is a local decision --ip should be enough, but yes using -a and --ip does not filter correctly as the flags should be used as mutually exclusive of each other.

but we agree that using --ip should search for any decisions of origin not just local.

[catharsis71]

If --ip could be made to search the entire list instead of just local, that would be great too

current behavior:

# cscli decisions list -a | grep -P ":45.157.148.187\ "
| 2251162 | lists  | Ip:45.157.148.187                         | firehol_greensnow                                            | ban    |         |    | 0      | 23h10m3s    | 464      |
# cscli decisions list --ip 45.157.148.187
No active decisions
#

when searching for a list of IPs I have to do sort | parallel cscli decisions list -a '|' grep -P ":{}\ " which is cumbersome

sort | parallel cscli decisions list --ip would be more pleasant