Skip to main content
Version: v1.5.0


Telegram can be integrated with CrowdSec by using the HTTP plugin. Enable it by following these instructions .

Replace chat_id within the format section so that it send the events to your Telegram chat. If you need to get your chat ID, follow the instructions here.

Replace XXX:YYY within the URL section with your Telegram BOT API key. If you need to generate a BOT API key, follow the instructions here.

An example configuration:

type: http          # Don't change
name: http_default # Must match the registered plugin in the profile

# One of "trace", "debug", "info", "warn", "error", "off"
log_level: info

# group_wait: # Time to wait collecting alerts before relaying a message to this plugin, eg "30s"
# group_threshold: # Amount of alerts that triggers a message before <group_wait> has expired, eg "10"
# max_retry: # Number of attempts to relay messages to plugins in case of error
# timeout: # Time to wait for response from the plugin before considering the attempt a failure, eg "10s"

# plugin-specific options

# The following template receives a list of models.Alert objects
# The output goes in the http request body

# Replace XXXXXXXXX with your Telegram chat ID
format: |
"chat_id": "-XXXXXXXXX",
"text": "
{{range . -}}
{{$alert := . -}}
{{range .Decisions -}}
{{.Value}} will get {{.Type}} for next {{.Duration}} for triggering {{.Scenario}}.
{{end -}}
{{end -}}
"reply_markup": {
"inline_keyboard": [
{{ $arrLength := len . -}}
{{ range $i, $value := . -}}
{{ $V := $value.Source.Value -}}
"text": "See {{ $V }} on",
"url": "{{ $V -}}"
"text": "See {{ $V }} on",
"url": "{{ $V -}}"
]{{if lt $i ( sub $arrLength 1) }},{{end }}
{{end -}}

url: # Replace XXX:YYY with your API key

method: POST
Content-Type: "application/json"

Final Steps:

Let's restart crowdsec

sudo systemctl restart crowdsec

You can verify whether the plugin is properly working by triggering scenarios using tools like wapiti, nikto.