CrowdSec CTI

Query CrowdSec threat intelligence to enrich investigations and automate lookups. Get IP reputation, attack history, and behavior data from a global sensor network.

Getting Started

Choose your access path: web console for exploration or API for automation.

📖

Introduction

Learn what the CTI API offers and how to use it.

🖥️

Console Quickstart

Use the web interface to search and explore CTI data.

🔌

API Quickstart

Integrate CTI data programmatically into your workflows.

Core Features

Explore the core capabilities available through the CTI API.

📋

IP Reports

Get full context for any IP, including reputation and activity.

🔍

Search Queries

Search CTI data with filters and query operators.

🎯

Advanced Search

Build complex queries to spot patterns at scale.

🛡️

CVE Explorer

Explore CVEs and see active exploitation by IP.

Data Taxonomy

Understand how CTI data is structured, scored, and classified.

📊

Taxonomy Overview

Learn how CTI data is structured and labeled.

⭐

Reputation Scores

See how scores are computed and what they mean.

🔬

Behaviors

Explore the behaviors we track across attacks.

🏷️

Classifications

Understand threat classifications and categories.

Integrations

Connect CTI data to your SIEM, SOAR, and security workflows.

View all integrations →

Resources

Docs to help you integrate, automate, and troubleshoot CTI.

📚

API Reference

Full API reference with endpoints and parameters.

❓

FAQ

Common questions about access, limits, and data.

🌐

Chrome Extension

Check IP reputation directly in your browser.

Need Help?

Get help in Discord or check the FAQ for quick answers.