README
¶
CrowdSec is an open-source and participative security solution offering crowdsourced server detection and protection against malicious IPs. Detect and block with our Security Engine, contribute to the network, and enjoy our real-time community blocklist.
Features & Advantages
Versatile Security Engine
CrowdSec Security Engine is an all-in-one IDS/IPS and WAF.
It detects bad behaviors by analyzing log sources and HTTP requests, and allows active remediation thanks to the Remediation Components.
Detection rules are available on our hub under MIT license.
CrowdSec Community Blocklist
The "Community Blocklist" is a curated list of IP addresses identified as malicious by CrowdSec. The Security Engine proactively blocks the IP addresses of this blocklist, preventing malevolent IPs from reaching your systems.
Console - Monitoring & Automation of your security stack
Multiple Platforms support
Outnumbering hackers all together
By sharing the threat they faced, all users are protecting each other (hence the name Crowd-Security). Crowdsec is designed for modern infrastructures, with its "Detect Here, Remedy There" approach, letting you analyze logs coming from several sources in one place and block threats at various levels (applicative, system, infrastructural) of your stack.
CrowdSec ships by default with scenarios (brute force, port scan, web scan, etc.) adapted for most contexts, but you can easily extend it by picking more of them from the HUB. It is also easy to adapt an existing one or create one yourself.
Installation
Resources
- Console: Supercharge your CrowdSec setup with visualization, management capabilities, extra blocklists and premium features.
- Documentation: Learn how to exploit your CrowdSec setup to deter more attacks.
- Discord: A question or a suggestion? This is the place.
- Hub: Improve your stack protection, find the relevant remediation components for your infrastructure.
- Public Roadmap: Vote for your favorite features and submit ideas to influence what we build next.
- CrowdSec Academy: Learn and grow with our courses.
- Corporate Website: For everything else.
Directories
¶
| Path | Synopsis |
|---|---|
|
cmd
|
|
|
crowdsec
command
|
|
|
crowdsec-cli
command
|
|
|
notification-dummy
command
|
|
|
notification-email
command
|
|
|
notification-file
command
|
|
|
notification-http
command
|
|
|
notification-sentinel
command
|
|
|
notification-slack
command
|
|
|
notification-splunk
command
|
|
|
pkg
|
|
|
appsec/challenge
Package challenge implements the AppSec WAF challenge mode: a PoW-gated landing page, a fingerprint collection bundle, and the surrounding key rotation + cookie machinery.
|
Package challenge implements the AppSec WAF challenge mode: a PoW-gated landing page, a fingerprint collection bundle, and the surrounding key rotation + cookie machinery. |
|
appsec/challenge/js/cmd/bundle
command
|
|
|
appsec/challenge/js/cmd/initialbundle
command
initialbundle is a build-time tool that produces a pre-obfuscated initial challenge bundle, embedded into the Go binary.
|
initialbundle is a build-time tool that produces a pre-obfuscated initial challenge bundle, embedded into the Go binary. |
|
csconfig
Package csconfig contains the configuration structures for crowdsec and cscli.
|
Package csconfig contains the configuration structures for crowdsec and cscli. |
|
cticlient/example
command
|
|
|
cwhub
Package cwhub is responsible for providing the state of the local hub to the security engine and cscli command.
|
Package cwhub is responsible for providing the state of the local hub to the security engine and cscli command. |
|
dnscache
Package dnscache provides process-wide cached DNS lookups: PTR records, forward (A/AAAA) records, and forward-confirmed reverse DNS (FCrDNS) composed from the two.
|
Package dnscache provides process-wide cached DNS lookups: PTR records, forward (A/AAAA) records, and forward-confirmed reverse DNS (FCrDNS) composed from the two. |
|
hubops
Package hubops is responsible for managing the local hub (items and data files) for CrowdSec.
|
Package hubops is responsible for managing the local hub (items and data files) for CrowdSec. |