# SPDX-License-Identifier: AGPL-3.0-only
# A request for xmlrpc.php that the WAF refused. On this machine
# nothing uses XML-RPC, and the WAF answers 403: whoever asked was
# probing. Complements wp-xmlrpc-post, which catches the POSTs that get
# through to a host where the endpoint is not defended.
parser: wp-xmlrpc-blocked
log: http
prefilter: "xmlrpc.php"
regex: '^(?P<ip>\S+) \S+ \S+ \[(?P<time>[^\]]+)\] "(?P<method>[A-Z]+) (?P<path>[^ "?]*(?i:/xmlrpc\.php))(?:\?(?P<query>[^ "]*))? [^"]*" 403 \S+ "[^"]*" "(?P<ua>[^"]*)"'
time_field: time
time_format: nginx
