Notifications should show, if simulation is enabled

[saz]

What would you like to be added?

Show simulation status in notifications

/kind enhancement

Why is this needed?

If an IP gets blocked, it's visible in the decision list, if a ban is just simluated or not

╭──────────┬──────────┬───────────────────┬──────────────────────────────────────┬────────────┬─────────┬────────────────────┬────────┬────────────────────┬──────────╮
│    ID    │  Source  │    Scope:Value    │                Reason                │   Action   │ Country │         AS         │ Events │     expiration     │ Alert ID │
├──────────┼──────────┼───────────────────┼──────────────────────────────────────┼────────────┼─────────┼────────────────────┼────────┼────────────────────┼──────────┤
│ 64657143 │ crowdsec │ Ip:0.0.0.0        │ crowdsecurity/http-crawl-non_statics │ (simul)ban │ DE      │ 3209 Vodafone GmbH │ 75     │ 3h34m15.891619088s │ 2992647  │
╰──────────┴──────────┴───────────────────┴──────────────────────────────────────┴────────────┴─────────┴────────────────────┴────────┴────────────────────┴──────────╯

Note the (simul)ban part.

We've got Slack notifications enabled, and this is the message posted to the channel:

:flag-DE: [0.0.0.0](https://www.whois.com/whois/0.0.0.0) will get ban for next 4h for  triggering crowdsecurity/http-crawl-non_statics. [Shodan](https://www.shodan.io/host/0.0.0.0)

This looks like, as if the IP got blocked, but it's not the case. Looking at other notifications, they seem to have the same "issue" and it would be great, if there's either no notification sent out (btw is this configurable somewhere?) for a simulation or it's shown within the notification, that it's just a simulation.

[github-actions[bot]]

@saz: Thanks for opening an issue, it is currently awaiting triage.

In the meantime, you can:

1. Check Crowdsec Documentation to see if your issue can be self resolved.
2. You can also join our Discord.
3. Check Releases to make sure your agent is on the latest version.

Details

I am a bot created to help the [crowdsecurity](https://github.com/crowdsecurity) developers manage community feedback and contributions. You can check out my [manifest file](https://github.com/crowdsecurity/crowdsec/blob/master/.github/governance.yml) to understand my behavior and what I can do. If you want to use this for your project, you can check out the [BirthdayResearch/oss-governance-bot](https://github.com/BirthdayResearch/oss-governance-bot) repository.

[github-actions[bot]]

@saz: There are no 'kind' label on this issue. You need a 'kind' label to start the triage process.

• /kind feature
• /kind enhancement
• /kind bug
• /kind packaging

Details

I am a bot created to help the [crowdsecurity](https://github.com/crowdsecurity) developers manage community feedback and contributions. You can check out my [manifest file](https://github.com/crowdsecurity/crowdsec/blob/master/.github/governance.yml) to understand my behavior and what I can do. If you want to use this for your project, you can check out the [BirthdayResearch/oss-governance-bot](https://github.com/BirthdayResearch/oss-governance-bot) repository.

[LaurenceJJones]

The alert object has the simulated flag you would need to use that within your format template. If you are using the default slack one you can see the modified versions below

format: |
  {{range . -}}
  {{$alert := . -}}
  {{range .Decisions -}}
  {{if $alert.Source.Cn -}}
  :flag-{{$alert.Source.Cn}}: <https://www.whois.com/whois/{{.Value}}|{{.Value}}>  will {{ ternary "not" "" $alert.Simulated }} get {{.Type}} for next {{.Duration}} for triggering {{.Scenario}} on machine '{{$alert.MachineID}}'. <https://app.crowdsec.net/cti/{{.Value}}|CrowdSec CTI>{{end}}
  {{if not $alert.Source.Cn -}}
  :pirate_flag: <https://www.whois.com/whois/{{.Value}}|{{.Value}}> will {{ ternary "not" "" $alert.Simulated }} get {{.Type}} for next {{.Duration}} for triggering {{.Scenario}} on machine '{{$alert.MachineID}}'.  <https://app.crowdsec.net/cti/{{.Value}}|CrowdSec CTI>{{end}}
  {{end -}}
  {{end -}}

So the end result string will be :flag-TW: 10.10.10.10 will not get ban for next 4h for triggering crowdsecurity/ssh-slow-bf on machine '<generic machine id>'.

OR if you want to prefix it will simulated infront of the alert

format: |
  {{range . -}}
  {{$alert := . -}}
  {{range .Decisions -}}
  {{if $alert.Simulated}}SIMULATED {{end -}}
  {{if $alert.Source.Cn -}}
  :flag-{{$alert.Source.Cn}}: <https://www.whois.com/whois/{{.Value}}|{{.Value}}>  will get {{.Type}} for next {{.Duration}} for triggering {{.Scenario}} on machine '{{$alert.MachineID}}'. <https://app.crowdsec.net/cti/{{.Value}}|CrowdSec CTI>{{end}}
  {{if not $alert.Source.Cn -}}
  :pirate_flag: <https://www.whois.com/whois/{{.Value}}|{{.Value}}> will get {{.Type}} for next {{.Duration}} for triggering {{.Scenario}} on machine '{{$alert.MachineID}}'.  <https://app.crowdsec.net/cti/{{.Value}}|CrowdSec CTI>{{end}}
  {{end -}}
  {{end -}}

example output SIMULATED :flag-TW: 10.10.10.10 will not get ban for next 4h for triggering crowdsecurity/ssh-slow-bf on machine '<generic machine id>'.

[saz]

I saw that I'm able to change the format, but I think it's quite confusing, to get a notification without this information in there, as it might trigger some action, even if it's not required :-)

[LaurenceJJones]

I saw that I'm able to change the format, but I think it's quite confusing, to get a notification without this information in there, as it might trigger some action, even if it's not required :-)

The format provided is just an example, we cant cover everyone use cases in an example. I do agree, making simulation events not send an notification would be beneficial. However, it could then confuse people when they expect to see an alert 🤷🏻 . This needs to explored as adding additional config to profiles is complicated, maybe, adding a global config

[LaurenceJJones]

Evaluated this with the team we have decided that if you don't want to receive a notification based on the simulated flag then you should update your profiles to cater for this.

Example below:

name: default_ip_remediation
#debug: true
filters:
 - Alert.Remediation == true && Alert.GetScope() == "Ip" && !Alert.Simulated
decisions:
 - type: ban
   duration: 4h
#duration_expr: "Sprintf('%dh', (GetDecisionsCount(Alert.GetValue()) + 1) * 4)"
notifications:
  - slack_default  # Set the webhook in /etc/crowdsec/notifications/slack.yaml before enabling this.
on_success: break

There was no need to add any configuration options as we can evaluate within the filter itself. If you do want to notify but show simulated, these example are shown above.