What is Crowdsec ?¶
Crowdsec is an open-source and lightweight software that allows you to detect peers with malevolent behaviors and block them (using Bouncers) from accessing your systems at various levels (infrastructural, system, applicative).
To achieve this, Crowdsec reads logs from different sources (files, streams ...) to parse, normalize and enrich them before matching them to threats patterns called scenarios.
Crowdsec is a modular and plug-able framework, it ships a large variety of well known popular scenarios; users can choose what scenarios they want to be protected from as well as easily adding new custom ones to better fit their environment.
Detected malevolent peers can then be prevented from accessing your resources by deploying bouncers at various levels (applicative, system, infrastructural) of your stack.
One of the advantages of Crowdsec when compared to other solutions is its crowd-sourced aspect : Meta information about detected attacks (source IP, time and triggered scenario) are sent to a central API and then shared amongst all users.
Thanks to this, besides detecting and stopping attacks in real time based on your logs, it allows you to preemptively block known bad actors from accessing your information system.
Crowdsec ecosystem is based on the following components :
- Crowdsec is the lightweight service that processes logs and keeps track of attacks.
- cscli is the command line interface for humans, it allows you to view, add, or remove bans as well as to install, find, or update scenarios and parsers
- bouncers are the components that block malevolent traffic, and can be deployed anywhere in your stack
Crowdsec relies on parsers to normalize and enrich logs, and scenarios to detect attacks, often bundled together in collections to form a coherent configuration set. For example the collection
crowdsecurity/nginx contains all the necessary parsers and scenarios to deal with nginx logs and the common attacks that can be seen on http servers.
Crowdsec, besides the core "detect and react" mechanism, is committed to a few other key points :
- Easy Installation : The provided wizard allows a trivial deployment on most standard setups
- Easy daily operations : Using cscli and the Crowdsec Hub, keeping your detection mechanisms up-to-date is trivial
- Observability : Providing strongs insights on what is going on and what Crowdsec is doing :
To learn more about Crowdsec and give it a try, please see :
- How to install Crowdsec
- Take a quick tour of Crowdsec and cscli features
- Observability of Crowdsec
- Understand Crowdsec configuration
- Deploy bouncers to stop malevolent peers
- Known bugs and limitations
Don't hesitate to reach out if you're facing issues :