AlteredCoder

Improvement/cscli: `cscli explain doesn't work with postoverflows

1

**Is your feature request related to a problem? Please describe.** Currently, `cscli explain` only work for parsers and scenarios but not for postoverflows. **Describe the solution you'd like** `cscli explain`...

**Describe the bug** Currently, when we have multiple decisions concerning an IP address (with different scenarios), and when we query the local API to get decisions with `scenarios_containing`, it will...

Bug/cscli: cscli decisions delete --range should be inverted

2

cf. https://discourse.crowdsec.net/t/bug-when-trying-to-delete-a-range-from-decisions/727/4 When we want to delete multiple decisions from the same range, we should not provide the `--contained` flag. This should be the default behavior.

- Add an option to the local API to share context to CAPI - Add a feature on the agent to choose which runtime field we want to keep in...

**Is your feature request related to a problem? Please describe.** I used the `source` feature of parsers that can download needed data for the parser, but even if the parser...

Improvment/scenarios: sequence of scenario

3

**Is your feature request related to a problem? Please describe.** I would like to trigger a scenario when a sequence of event occurs **Example of what you imagine** I think...

Improvement/cscli hub update: specify when there is a new parser/scenario/collection

1

**Is your feature request related to a problem? Please describe.** When running `cscli hub update` it says which parser/scenario/collections are outdated, but not the new one **Describe the solution you'd...

Bug/Make URL/URI coherent in config.yaml

3

**Describe the bug** URL/URI are not coherent in the configuration file. For prometheus we have `listen_addr` and `listen_port` For `api->server` we have `listen_uri` with the format: `ip:port` For lapi/capi credentials...

cscli config show: "human" mode not showing all configuration

1

### What happened? Running `cscli config show`, which is asked when creating an issue, it not up to date and doesn't show all the configuration. Example with the bucket routines,...

Alert with multiple sources: only the last source is kept

1

### What happened? I experimenting stuff with the scenario "crowdsecurity/auditd-postexploit-exec-from-net". I'm triggering this scenario and have a custom bouncer that will kill the PID of the process when an alert...