[Hub] [Releases]

What is Crowdsec ?

Crowdsec is an open-source and lightweight software that allows you to detect peers with malevolent behaviors and block them (using Bouncers) from accessing your systems at various levels (infrastructural, system, applicative).

To achieve this, Crowdsec reads logs from different sources (files, streams ...) to parse, normalize and enrich them before matching them to threats patterns called scenarios.

Crowdsec is a modular and plug-able framework, it ships a large variety of well known popular scenarios; users can choose what scenarios they want to be protected from as well as easily adding new custom ones to better fit their environment.

Detected malevolent peers can then be prevented from accessing your resources by deploying bouncers at various levels (applicative, system, infrastructural) of your stack.

One of the advantages of Crowdsec when compared to other solutions is its crowd-sourced aspect : Meta information about detected attacks (source IP, time and triggered scenario) are sent to a central API and then shared amongst all users.

Thanks to this, besides detecting and stopping attacks in real time based on your logs, it allows you to preemptively block known bad actors from accessing your information system.

Components

Crowdsec ecosystem is based on the following components :

  • Crowdsec is the lightweight service that processes logs and keeps track of attacks.
  • cscli is the command line interface for humans, it allows you to view, add, or remove bans as well as to install, find, or update scenarios and parsers
  • bouncers are the components that block malevolent traffic, and can be deployed anywhere in your stack

Architecture

Architecture

Core concepts

Crowdsec relies on parsers to normalize and enrich logs, and scenarios to detect attacks, often bundled together in collections to form a coherent configuration set. For example the collection crowdsecurity/nginx contains all the necessary parsers and scenarios to deal with nginx logs and the common attacks that can be seen on http servers.

All of those are represented as YAML files, that can be found, shared and kept up-to-date thanks to the Crowdsec Hub, or easily hand-crafted to address specific needs.

Main features

Crowdsec, besides the core "detect and react" mechanism, is committed to a few other key points :

Moving forward

To learn more about Crowdsec and give it a try, please see :

Don't hesitate to reach out if you're facing issues :