Crowdsec-Install.md
| @@ -23,6 +23,6 @@ Essential `cscli` Monitoring Commands | |||
| 23 | 23 | - `cscli bouncers list` - Lists all remediation plugins connected to your system, showing their API keys and last active check-in times. Use this to verify that tools like your Caddy bouncer are successfully communicating. | |
| 24 | 24 | ||
| 25 | 25 | Links | |
| 26 | - | - CrowdSec Docker Install - https://docs.crowdsec.net/u/getting_started/installation/docker/ | |
| 26 | + | - CrowdSec - Docker Install - https://docs.crowdsec.net/u/getting_started/installation/docker/ | |
| 27 | 27 | - CrowdSec - Open-source IDS/IPS, WAF and bot detection for Linux, Windows, Docker and Kubernetes, with a crowdsourced blocklist of malicious IPs. - https://github.com/crowdsecurity/crowdsec | |
| 28 | 28 | - CrowdSecurity/example-docker-compose - Example integration of CrowdSec in docker-compose - https://github.com/crowdsecurity/example-docker-compose | |
Crowdsec-Install.md
| @@ -20,4 +20,9 @@ Essential `cscli` Monitoring Commands | |||
| 20 | 20 | - `cscli decisions list` - Shows the active, live ban list currently being enforced by your firewall or web bouncer. Use this to see who is currently blocked from your server right this second. | |
| 21 | 21 | - `cscli decisions add` - Allows you to manually ban an IP address, range, or username directly from the terminal. Use this to immediately block a known rogue IP yourself (--ip 1.2.3.4). | |
| 22 | 22 | - `cscli decisions delete` - Unbans a specific IP address or flush an active ban record completely. Use this if you accidentally ban yourself or need to whitelist a false positive. | |
| 23 | - | - `cscli bouncers list` - Lists all remediation plugins connected to your system, showing their API keys and last active check-in times. Use this to verify that tools like your Caddy bouncer are successfully communicating. | |
| 23 | + | - `cscli bouncers list` - Lists all remediation plugins connected to your system, showing their API keys and last active check-in times. Use this to verify that tools like your Caddy bouncer are successfully communicating. | |
| 24 | + | ||
| 25 | + | Links | |
| 26 | + | - CrowdSec Docker Install - https://docs.crowdsec.net/u/getting_started/installation/docker/ | |
| 27 | + | - CrowdSec - Open-source IDS/IPS, WAF and bot detection for Linux, Windows, Docker and Kubernetes, with a crowdsourced blocklist of malicious IPs. - https://github.com/crowdsecurity/crowdsec | |
| 28 | + | - CrowdSecurity/example-docker-compose - Example integration of CrowdSec in docker-compose - https://github.com/crowdsecurity/example-docker-compose | |
Crowdsec-Install.md(файл создан)
| @@ -0,0 +1,23 @@ | |||
| 1 | + | Crowdsec terms to know before installing, configuring, and monitoring CrowdSec. | |
| 2 | + | ||
| 3 | + | Core Architecture Concepts | |
| 4 | + | - `LAPI` (Local API) - The local coordinate center of CrowdSec. It accepts signals from parsers and informs bouncers who to block. The air traffic control tower running on your server. | |
| 5 | + | - `CAPI` (Central API) - CrowdSec’s global network. It collects anonymous attack metadata from all users and pushes down curated community blocklists. The global threat intelligence hub sharing notes with your server. | |
| 6 | + | - `Watcher` (Agent) - The background service engine that actively reads logs, extracts data, and tracks local server metrics. The security guard reading the facility log books. | |
| 7 | + | - `Bouncer` (Remediation) - Software plugins attached to firewalls or web servers (like Caddy, Nginx, or Cloudflare) that execute the actual blocking. The bouncer at the door physically stopping bad actors from entering. | |
| 8 | + | ||
| 9 | + | Configuration & Data Flow | |
| 10 | + | - `Acquisition` - (acquis.yaml) The configuration file where you declare exactly which log files CrowdSec should watch and what application type they belong to. A reading list telling the guard exactly which files to look at. | |
| 11 | + | - `Parser` - Code configurations that translate raw text strings from application logs into clean, structured data payloads. A translator converting messy paragraphs into clean spreadsheets. | |
| 12 | + | - `Scenario` - The specific behavioral heuristic rules or thresholds that define what constitutes an attack (e.g., 5 failed logins in 10 seconds). The security rulebook detailing when an activity becomes illegal. | |
| 13 | + | - `Decision` - The resulting mandate generated when a scenario is broken. It contains an IP address, an action (ban/captcha), and an expiration time. The arrest warrant or temporary ban order. | |
| 14 | + | - `Alert` - The formal administrative record created when a decision is triggered, containing the complete event context. The incident report filed for the archive. | |
| 15 | + | ||
| 16 | + | ||
| 17 | + | Essential `cscli` Monitoring Commands | |
| 18 | + | - `cscli metrics` - Shows real-time tables of log processing, API hits, parser efficiency, and active bouncer checking frequencies. Use this first to troubleshoot if logs are actually being read or if bouncers are active. | |
| 19 | + | - `cscli alerts list` - Displays a historical index of triggered attacks, matching scenarios, source IPs, and timestamps. Use this to audit what malicious activity has historically hit your system. | |
| 20 | + | - `cscli decisions list` - Shows the active, live ban list currently being enforced by your firewall or web bouncer. Use this to see who is currently blocked from your server right this second. | |
| 21 | + | - `cscli decisions add` - Allows you to manually ban an IP address, range, or username directly from the terminal. Use this to immediately block a known rogue IP yourself (--ip 1.2.3.4). | |
| 22 | + | - `cscli decisions delete` - Unbans a specific IP address or flush an active ban record completely. Use this if you accidentally ban yourself or need to whitelist a false positive. | |
| 23 | + | - `cscli bouncers list` - Lists all remediation plugins connected to your system, showing their API keys and last active check-in times. Use this to verify that tools like your Caddy bouncer are successfully communicating. | |
Новее
Позже