CTI helpers

CTI Helpers

CTI Helper allows to query Crowdsec's CTI API to enhance the engine capabilities. It requires creating a CTI API Key in the console, as described here.

The CTI API Key must be present in the api.cti section of the configuration file:

api:
  cti:
    #The API key you got from the console
    key: <API CTI KEY>
    #How long should CTI lookups be kept in cache
    cache_timeout: 60m
    #How many items can we keep in cache
    cache_size: 50
    enabled: true
    log_level: info|debug|trace
  client:
    insecure_skip_verify: false
    ...
  server:
    listen_uri: 127.0.0.1:8080
    ...

CrowdsecCTI(string) SmokeItem

Returns the CTI information associated with the provided IP address. The returned object is of type SmokeItem, and exposes a few convenience helpers:

SmokeItem.GetAttackDetails() []string

Returns the list of the scenarios most triggered by the given IP.

"crowdsecurity/ssh-bf" in CrowdsecCTI("X.X.X.X").GetAttackDetails()

SmokeItem.GetBackgroundNoiseScore() int

Returns the background noise score associated to the given IP, from a scale of 0 (not noisy) to 10 (extremely noisy).

SmokeItem.GetBehaviors() []string

Returns the list of behaviors associated to the IP. The list of behaviors is derived from the scenarios the IP triggered.

SmokeItem.GetFalsePositives() []string

Returns the list of eventual false positive categories associatted to the IP.

SmokeItem.GetMaliciousnessScore() float32

Returns the maliciousness score of the IP, from a scale of 1 (very malicious) to 0 (unknown). If the IP is part of the fire blocklist, the score is "1", otherwise it is computed based on the activity score of the IP over the previous day.

SmokeItem.IsFalsePositive() bool

Returns true if the IP is flagged as being a false positive.

SmokeItem.IsPartOfCommunityBlocklist() bool

Returns true if the IP is currently in the community blocklist.