Skip to content

IP signalled

Available since: 1.0.0

Provided tokens

Token Description
[event] The event.
[event:crowdsec_ip] The ip address.
[event:crowdsec_scenario] The CrowdSec scenario.
[event] The event.
[event:machine_name] The machine name of the ECA event.
[session_user] The user account that dispatched the event, regardless if ECA is processing models under a different account.

Fires when an IP address is signalled upstream to the CrowdSec API.

The [event:crowdsec_ip] token contains the signalled IP address and [event:crowdsec_scenario] identifies the triggered scenario.