Include the check/unban commands directly in CrowdSec ntfy alerts

Confirmed live: a legitimate SIP device on a CGNAT ISP (Starlink, T-Mobile home internet) got collaterally banned by crowdsecurity/asterisk_bf alongside actual bad actors sharing the same carrier IP. The alert now includes the exact commands (with the banned IP substituted in) instead of just naming the ban, so recovering from this doesn't require remembering or looking up cscli syntax.
2026-07-21 12:36:02 +00:00
parent f7db82333a
commit 6dd5bbc2ce
1 changed files with 2 additions and 0 deletions
@@ -284,6 +284,8 @@ format: |
  {{range . -}}
  {{range .Decisions -}}
  {{.Value}} banned: {{.Scenario}} for {{.Duration}}
+  Check all bans:  sudo cscli decisions list
+  Unban this IP:   sudo cscli decisions delete --ip {{.Value}}
  {{end -}}
  {{end -}}
 url: $CS_NTFY_URL