diff --git a/postoverflows/s00-enrich/crowdsecurity/rdns.yaml b/postoverflows/s00-enrich/crowdsecurity/rdns.yaml index 37ef849a7ca..dbd5a83cc5d 100644 --- a/postoverflows/s00-enrich/crowdsecurity/rdns.yaml +++ b/postoverflows/s00-enrich/crowdsecurity/rdns.yaml @@ -1,5 +1,5 @@ onsuccess: next_stage -filter: "evt.Overflow.Alert.Remediation == true && evt.Overflow.Alert.GetScope() == 'Ip'" +filter: "evt.Overflow.Alert.GetScope() == 'Ip'" name: crowdsecurity/rdns description: "Lookup the DNS associated to the source IP only for overflows" statics: