CrowdSec-Install.md
· 3.6 KiB · Markdown
Ham
CrowdSec terms to know before installing, configuring, and monitoring this Fail2Ban alternative service.
Core Architecture Concepts
- `LAPI` (Local API) - The local coordinate center of CrowdSec. It accepts signals from parsers and informs bouncers who to block. The air traffic control tower running on your server.
- `CAPI` (Central API) - CrowdSec’s global network. It collects anonymous attack metadata from all users and pushes down curated community blocklists. The global threat intelligence hub sharing notes with your server.
- `Watcher` (Agent) - The background service engine that actively reads logs, extracts data, and tracks local server metrics. The security guard reading the facility log books.
- `Bouncer` (Remediation) - Software plugins attached to firewalls or web servers (like Caddy, Nginx, or Cloudflare) that execute the actual blocking. The bouncer at the door physically stopping bad actors from entering.
Configuration & Data Flow
- `Acquisition` - (acquis.yaml) The configuration file where you declare exactly which log files CrowdSec should watch and what application type they belong to. A reading list telling the guard exactly which files to look at.
- `Parser` - Code configurations that translate raw text strings from application logs into clean, structured data payloads. A translator converting messy paragraphs into clean spreadsheets.
- `Scenario` - The specific behavioral heuristic rules or thresholds that define what constitutes an attack (e.g., 5 failed logins in 10 seconds). The security rulebook detailing when an activity becomes illegal.
- `Decision` - The resulting mandate generated when a scenario is broken. It contains an IP address, an action (ban/captcha), and an expiration time. The arrest warrant or temporary ban order.
- `Alert` - The formal administrative record created when a decision is triggered, containing the complete event context. The incident report filed for the archive.
Essential `cscli` Monitoring Commands
- `cscli metrics` - Shows real-time tables of log processing, API hits, parser efficiency, and active bouncer checking frequencies. Use this first to troubleshoot if logs are actually being read or if bouncers are active.
- `cscli alerts list` - Displays a historical index of triggered attacks, matching scenarios, source IPs, and timestamps. Use this to audit what malicious activity has historically hit your system.
- `cscli decisions list` - Shows the active, live ban list currently being enforced by your firewall or web bouncer. Use this to see who is currently blocked from your server right this second.
- `cscli decisions add` - Allows you to manually ban an IP address, range, or username directly from the terminal. Use this to immediately block a known rogue IP yourself (--ip 1.2.3.4).
- `cscli decisions delete` - Unbans a specific IP address or flush an active ban record completely. Use this if you accidentally ban yourself or need to whitelist a false positive.
- `cscli bouncers list` - Lists all remediation plugins connected to your system, showing their API keys and last active check-in times. Use this to verify that tools like your Caddy bouncer are successfully communicating.
Links
- CrowdSec - https://docs.crowdsec.net/
- CrowdSec - Docker Install - https://docs.crowdsec.net/u/getting_started/installation/docker/
- CrowdSec - Open-source IDS/IPS, WAF and bot detection for Linux, Windows, Docker and Kubernetes, with a crowdsourced blocklist of malicious IPs. - https://github.com/crowdsecurity/crowdsec
- CrowdSecurity/example-docker-compose - Example integration of CrowdSec in docker-compose - https://github.com/crowdsecurity/example-docker-compose
CrowdSec terms to know before installing, configuring, and monitoring this Fail2Ban alternative service.
Core Architecture Concepts
LAPI(Local API) - The local coordinate center of CrowdSec. It accepts signals from parsers and informs bouncers who to block. The air traffic control tower running on your server.CAPI(Central API) - CrowdSec’s global network. It collects anonymous attack metadata from all users and pushes down curated community blocklists. The global threat intelligence hub sharing notes with your server.Watcher(Agent) - The background service engine that actively reads logs, extracts data, and tracks local server metrics. The security guard reading the facility log books.Bouncer(Remediation) - Software plugins attached to firewalls or web servers (like Caddy, Nginx, or Cloudflare) that execute the actual blocking. The bouncer at the door physically stopping bad actors from entering.
Configuration & Data Flow
Acquisition- (acquis.yaml) The configuration file where you declare exactly which log files CrowdSec should watch and what application type they belong to. A reading list telling the guard exactly which files to look at.Parser- Code configurations that translate raw text strings from application logs into clean, structured data payloads. A translator converting messy paragraphs into clean spreadsheets.Scenario- The specific behavioral heuristic rules or thresholds that define what constitutes an attack (e.g., 5 failed logins in 10 seconds). The security rulebook detailing when an activity becomes illegal.Decision- The resulting mandate generated when a scenario is broken. It contains an IP address, an action (ban/captcha), and an expiration time. The arrest warrant or temporary ban order.Alert- The formal administrative record created when a decision is triggered, containing the complete event context. The incident report filed for the archive.
Essential cscli Monitoring Commands
cscli metrics- Shows real-time tables of log processing, API hits, parser efficiency, and active bouncer checking frequencies. Use this first to troubleshoot if logs are actually being read or if bouncers are active.cscli alerts list- Displays a historical index of triggered attacks, matching scenarios, source IPs, and timestamps. Use this to audit what malicious activity has historically hit your system.cscli decisions list- Shows the active, live ban list currently being enforced by your firewall or web bouncer. Use this to see who is currently blocked from your server right this second.cscli decisions add- Allows you to manually ban an IP address, range, or username directly from the terminal. Use this to immediately block a known rogue IP yourself (--ip 1.2.3.4).cscli decisions delete- Unbans a specific IP address or flush an active ban record completely. Use this if you accidentally ban yourself or need to whitelist a false positive.cscli bouncers list- Lists all remediation plugins connected to your system, showing their API keys and last active check-in times. Use this to verify that tools like your Caddy bouncer are successfully communicating.
Links
- CrowdSec - https://docs.crowdsec.net/
- CrowdSec - Docker Install - https://docs.crowdsec.net/u/getting_started/installation/docker/
- CrowdSec - Open-source IDS/IPS, WAF and bot detection for Linux, Windows, Docker and Kubernetes, with a crowdsourced blocklist of malicious IPs. - https://github.com/crowdsecurity/crowdsec
- CrowdSecurity/example-docker-compose - Example integration of CrowdSec in docker-compose - https://github.com/crowdsecurity/example-docker-compose
CrowdSec-Scenarios.md
· 8.0 KiB · Markdown
Ham
```sh
docker compose exec crowdsec cscli scenarios list
────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
SCENARIOS
────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
Name 📦 Status Version Local Path
────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
crowdsecurity/apache_log4j2_cve-2021-44228 ✔ enabled 0.7 /etc/crowdsec/scenarios/apache_log4j2_cve-2021-44228.yaml
crowdsecurity/CVE-2017-9841 ✔ enabled 0.2 /etc/crowdsec/scenarios/CVE-2017-9841.yaml
crowdsecurity/CVE-2019-18935 ✔ enabled 0.2 /etc/crowdsec/scenarios/CVE-2019-18935.yaml
crowdsecurity/CVE-2022-26134 ✔ enabled 0.4 /etc/crowdsec/scenarios/CVE-2022-26134.yaml
crowdsecurity/CVE-2022-35914 ✔ enabled 0.2 /etc/crowdsec/scenarios/CVE-2022-35914.yaml
crowdsecurity/CVE-2022-37042 ✔ enabled 0.2 /etc/crowdsec/scenarios/CVE-2022-37042.yaml
crowdsecurity/CVE-2022-40684 ✔ enabled 0.3 /etc/crowdsec/scenarios/CVE-2022-40684.yaml
crowdsecurity/CVE-2022-41082 ✔ enabled 0.4 /etc/crowdsec/scenarios/CVE-2022-41082.yaml
crowdsecurity/CVE-2022-41697 ✔ enabled 0.2 /etc/crowdsec/scenarios/CVE-2022-41697.yaml
crowdsecurity/CVE-2022-42889 ✔ enabled 0.3 /etc/crowdsec/scenarios/CVE-2022-42889.yaml
crowdsecurity/CVE-2022-44877 ✔ enabled 0.4 /etc/crowdsec/scenarios/CVE-2022-44877.yaml
crowdsecurity/CVE-2022-46169 ✔ enabled 0.3 /etc/crowdsec/scenarios/CVE-2022-46169.yaml
crowdsecurity/CVE-2023-22515 ✔ enabled 0.1 /etc/crowdsec/scenarios/CVE-2023-22515.yaml
crowdsecurity/CVE-2023-22518 ✔ enabled 0.3 /etc/crowdsec/scenarios/CVE-2023-22518.yaml
crowdsecurity/CVE-2023-49103 ✔ enabled 0.3 /etc/crowdsec/scenarios/CVE-2023-49103.yaml
crowdsecurity/CVE-2024-0012 ✔ enabled 0.1 /etc/crowdsec/scenarios/CVE-2024-0012.yaml
crowdsecurity/CVE-2024-38475 ✔ enabled 0.1 /etc/crowdsec/scenarios/CVE-2024-38475.yaml
crowdsecurity/CVE-2024-9474 ✔ enabled 0.1 /etc/crowdsec/scenarios/CVE-2024-9474.yaml
crowdsecurity/f5-big-ip-cve-2020-5902 ✔ enabled 0.3 /etc/crowdsec/scenarios/f5-big-ip-cve-2020-5902.yaml
crowdsecurity/fortinet-cve-2018-13379 ✔ enabled 0.4 /etc/crowdsec/scenarios/fortinet-cve-2018-13379.yaml
crowdsecurity/grafana-cve-2021-43798 ✔ enabled 0.3 /etc/crowdsec/scenarios/grafana-cve-2021-43798.yaml
crowdsecurity/http-admin-interface-probing ✔ enabled 0.5 /etc/crowdsec/scenarios/http-admin-interface-probing.yaml
crowdsecurity/http-backdoors-attempts ✔ enabled 0.7 /etc/crowdsec/scenarios/http-backdoors-attempts.yaml
crowdsecurity/http-bad-user-agent ✔ enabled 1.2 /etc/crowdsec/scenarios/http-bad-user-agent.yaml
crowdsecurity/http-crawl-non_statics ✔ enabled 0.7 /etc/crowdsec/scenarios/http-crawl-non_statics.yaml
crowdsecurity/http-cve-2021-41773 ✔ enabled 0.3 /etc/crowdsec/scenarios/http-cve-2021-41773.yaml
crowdsecurity/http-cve-2021-42013 ✔ enabled 0.3 /etc/crowdsec/scenarios/http-cve-2021-42013.yaml
crowdsecurity/http-cve-probing ✔ enabled 0.6 /etc/crowdsec/scenarios/http-cve-probing.yaml
crowdsecurity/http-generic-bf ✔ enabled 0.9 /etc/crowdsec/scenarios/http-generic-bf.yaml
crowdsecurity/http-generic-test ✔ enabled 0.2 /etc/crowdsec/scenarios/http-generic-test.yaml
crowdsecurity/http-open-proxy ✔ enabled 0.5 /etc/crowdsec/scenarios/http-open-proxy.yaml
crowdsecurity/http-path-traversal-probing ✔ enabled 0.4 /etc/crowdsec/scenarios/http-path-traversal-probing.yaml
crowdsecurity/http-probing ✔ enabled 0.4 /etc/crowdsec/scenarios/http-probing.yaml
crowdsecurity/http-sap-interface-probing ✔ enabled 0.1 /etc/crowdsec/scenarios/http-sap-interface-probing.yaml
crowdsecurity/http-sensitive-files ✔ enabled 0.4 /etc/crowdsec/scenarios/http-sensitive-files.yaml
crowdsecurity/http-sqli-probing ✔ enabled 0.4 /etc/crowdsec/scenarios/http-sqli-probing.yaml
crowdsecurity/http-technology-probing ✔ enabled 0.1 /etc/crowdsec/scenarios/http-technology-probing.yaml
crowdsecurity/http-wordpress-scan ✔ enabled 0.4 /etc/crowdsec/scenarios/http-wordpress-scan.yaml
crowdsecurity/http-xss-probing ✔ enabled 0.4 /etc/crowdsec/scenarios/http-xss-probing.yaml
crowdsecurity/jira_cve-2021-26086 ✔ enabled 0.4 /etc/crowdsec/scenarios/jira_cve-2021-26086.yaml
crowdsecurity/netgear_rce ✔ enabled 0.4 /etc/crowdsec/scenarios/netgear_rce.yaml
crowdsecurity/pulse-secure-sslvpn-cve-2019-11510 ✔ enabled 0.4 /etc/crowdsec/scenarios/pulse-secure-sslvpn-cve-2019-11510.yaml
crowdsecurity/spring4shell_cve-2022-22965 ✔ enabled 0.3 /etc/crowdsec/scenarios/spring4shell_cve-2022-22965.yaml
crowdsecurity/ssh-bf ✔ enabled 0.3 /etc/crowdsec/scenarios/ssh-bf.yaml
crowdsecurity/ssh-cve-2024-6387 ✔ enabled 0.2 /etc/crowdsec/scenarios/ssh-cve-2024-6387.yaml
crowdsecurity/ssh-generic-test ✔ enabled 0.3 /etc/crowdsec/scenarios/ssh-generic-test.yaml
crowdsecurity/ssh-refused-conn ✔ enabled 0.1 /etc/crowdsec/scenarios/ssh-refused-conn.yaml
crowdsecurity/ssh-slow-bf ✔ enabled 0.4 /etc/crowdsec/scenarios/ssh-slow-bf.yaml
crowdsecurity/ssh-time-based-bf ✔ enabled 0.3 /etc/crowdsec/scenarios/ssh-time-based-bf.yaml
crowdsecurity/thinkphp-cve-2018-20062 ✔ enabled 0.7 /etc/crowdsec/scenarios/thinkphp-cve-2018-20062.yaml
crowdsecurity/vmware-cve-2022-22954 ✔ enabled 0.3 /etc/crowdsec/scenarios/vmware-cve-2022-22954.yaml
crowdsecurity/vmware-vcenter-vmsa-2021-0027 ✔ enabled 0.3 /etc/crowdsec/scenarios/vmware-vcenter-vmsa-2021-0027.yaml
ltsich/http-w00tw00t ✔ enabled 0.3 /etc/crowdsec/scenarios/http-w00tw00t.yaml
────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
```
docker compose exec crowdsec cscli scenarios list
────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
SCENARIOS
────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
Name 📦 Status Version Local Path
────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
crowdsecurity/apache_log4j2_cve-2021-44228 ✔ enabled 0.7 /etc/crowdsec/scenarios/apache_log4j2_cve-2021-44228.yaml
crowdsecurity/CVE-2017-9841 ✔ enabled 0.2 /etc/crowdsec/scenarios/CVE-2017-9841.yaml
crowdsecurity/CVE-2019-18935 ✔ enabled 0.2 /etc/crowdsec/scenarios/CVE-2019-18935.yaml
crowdsecurity/CVE-2022-26134 ✔ enabled 0.4 /etc/crowdsec/scenarios/CVE-2022-26134.yaml
crowdsecurity/CVE-2022-35914 ✔ enabled 0.2 /etc/crowdsec/scenarios/CVE-2022-35914.yaml
crowdsecurity/CVE-2022-37042 ✔ enabled 0.2 /etc/crowdsec/scenarios/CVE-2022-37042.yaml
crowdsecurity/CVE-2022-40684 ✔ enabled 0.3 /etc/crowdsec/scenarios/CVE-2022-40684.yaml
crowdsecurity/CVE-2022-41082 ✔ enabled 0.4 /etc/crowdsec/scenarios/CVE-2022-41082.yaml
crowdsecurity/CVE-2022-41697 ✔ enabled 0.2 /etc/crowdsec/scenarios/CVE-2022-41697.yaml
crowdsecurity/CVE-2022-42889 ✔ enabled 0.3 /etc/crowdsec/scenarios/CVE-2022-42889.yaml
crowdsecurity/CVE-2022-44877 ✔ enabled 0.4 /etc/crowdsec/scenarios/CVE-2022-44877.yaml
crowdsecurity/CVE-2022-46169 ✔ enabled 0.3 /etc/crowdsec/scenarios/CVE-2022-46169.yaml
crowdsecurity/CVE-2023-22515 ✔ enabled 0.1 /etc/crowdsec/scenarios/CVE-2023-22515.yaml
crowdsecurity/CVE-2023-22518 ✔ enabled 0.3 /etc/crowdsec/scenarios/CVE-2023-22518.yaml
crowdsecurity/CVE-2023-49103 ✔ enabled 0.3 /etc/crowdsec/scenarios/CVE-2023-49103.yaml
crowdsecurity/CVE-2024-0012 ✔ enabled 0.1 /etc/crowdsec/scenarios/CVE-2024-0012.yaml
crowdsecurity/CVE-2024-38475 ✔ enabled 0.1 /etc/crowdsec/scenarios/CVE-2024-38475.yaml
crowdsecurity/CVE-2024-9474 ✔ enabled 0.1 /etc/crowdsec/scenarios/CVE-2024-9474.yaml
crowdsecurity/f5-big-ip-cve-2020-5902 ✔ enabled 0.3 /etc/crowdsec/scenarios/f5-big-ip-cve-2020-5902.yaml
crowdsecurity/fortinet-cve-2018-13379 ✔ enabled 0.4 /etc/crowdsec/scenarios/fortinet-cve-2018-13379.yaml
crowdsecurity/grafana-cve-2021-43798 ✔ enabled 0.3 /etc/crowdsec/scenarios/grafana-cve-2021-43798.yaml
crowdsecurity/http-admin-interface-probing ✔ enabled 0.5 /etc/crowdsec/scenarios/http-admin-interface-probing.yaml
crowdsecurity/http-backdoors-attempts ✔ enabled 0.7 /etc/crowdsec/scenarios/http-backdoors-attempts.yaml
crowdsecurity/http-bad-user-agent ✔ enabled 1.2 /etc/crowdsec/scenarios/http-bad-user-agent.yaml
crowdsecurity/http-crawl-non_statics ✔ enabled 0.7 /etc/crowdsec/scenarios/http-crawl-non_statics.yaml
crowdsecurity/http-cve-2021-41773 ✔ enabled 0.3 /etc/crowdsec/scenarios/http-cve-2021-41773.yaml
crowdsecurity/http-cve-2021-42013 ✔ enabled 0.3 /etc/crowdsec/scenarios/http-cve-2021-42013.yaml
crowdsecurity/http-cve-probing ✔ enabled 0.6 /etc/crowdsec/scenarios/http-cve-probing.yaml
crowdsecurity/http-generic-bf ✔ enabled 0.9 /etc/crowdsec/scenarios/http-generic-bf.yaml
crowdsecurity/http-generic-test ✔ enabled 0.2 /etc/crowdsec/scenarios/http-generic-test.yaml
crowdsecurity/http-open-proxy ✔ enabled 0.5 /etc/crowdsec/scenarios/http-open-proxy.yaml
crowdsecurity/http-path-traversal-probing ✔ enabled 0.4 /etc/crowdsec/scenarios/http-path-traversal-probing.yaml
crowdsecurity/http-probing ✔ enabled 0.4 /etc/crowdsec/scenarios/http-probing.yaml
crowdsecurity/http-sap-interface-probing ✔ enabled 0.1 /etc/crowdsec/scenarios/http-sap-interface-probing.yaml
crowdsecurity/http-sensitive-files ✔ enabled 0.4 /etc/crowdsec/scenarios/http-sensitive-files.yaml
crowdsecurity/http-sqli-probing ✔ enabled 0.4 /etc/crowdsec/scenarios/http-sqli-probing.yaml
crowdsecurity/http-technology-probing ✔ enabled 0.1 /etc/crowdsec/scenarios/http-technology-probing.yaml
crowdsecurity/http-wordpress-scan ✔ enabled 0.4 /etc/crowdsec/scenarios/http-wordpress-scan.yaml
crowdsecurity/http-xss-probing ✔ enabled 0.4 /etc/crowdsec/scenarios/http-xss-probing.yaml
crowdsecurity/jira_cve-2021-26086 ✔ enabled 0.4 /etc/crowdsec/scenarios/jira_cve-2021-26086.yaml
crowdsecurity/netgear_rce ✔ enabled 0.4 /etc/crowdsec/scenarios/netgear_rce.yaml
crowdsecurity/pulse-secure-sslvpn-cve-2019-11510 ✔ enabled 0.4 /etc/crowdsec/scenarios/pulse-secure-sslvpn-cve-2019-11510.yaml
crowdsecurity/spring4shell_cve-2022-22965 ✔ enabled 0.3 /etc/crowdsec/scenarios/spring4shell_cve-2022-22965.yaml
crowdsecurity/ssh-bf ✔ enabled 0.3 /etc/crowdsec/scenarios/ssh-bf.yaml
crowdsecurity/ssh-cve-2024-6387 ✔ enabled 0.2 /etc/crowdsec/scenarios/ssh-cve-2024-6387.yaml
crowdsecurity/ssh-generic-test ✔ enabled 0.3 /etc/crowdsec/scenarios/ssh-generic-test.yaml
crowdsecurity/ssh-refused-conn ✔ enabled 0.1 /etc/crowdsec/scenarios/ssh-refused-conn.yaml
crowdsecurity/ssh-slow-bf ✔ enabled 0.4 /etc/crowdsec/scenarios/ssh-slow-bf.yaml
crowdsecurity/ssh-time-based-bf ✔ enabled 0.3 /etc/crowdsec/scenarios/ssh-time-based-bf.yaml
crowdsecurity/thinkphp-cve-2018-20062 ✔ enabled 0.7 /etc/crowdsec/scenarios/thinkphp-cve-2018-20062.yaml
crowdsecurity/vmware-cve-2022-22954 ✔ enabled 0.3 /etc/crowdsec/scenarios/vmware-cve-2022-22954.yaml
crowdsecurity/vmware-vcenter-vmsa-2021-0027 ✔ enabled 0.3 /etc/crowdsec/scenarios/vmware-vcenter-vmsa-2021-0027.yaml
ltsich/http-w00tw00t ✔ enabled 0.3 /etc/crowdsec/scenarios/http-w00tw00t.yaml
────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
cscli-decisions.md
· 13 KiB · Markdown
Ham
```
docker compose exec -it crowdsec cscli alerts list
+----+-----------------------------------------------+------------------------+---------+----+-----------+----------------------+------+
| ID | value | reason | country | as | decisions | created_at | kind |
+----+-----------------------------------------------+------------------------+---------+----+-----------+----------------------+------+
| 3 | crowdsecurity/community-blocklist (15000 Ips) | update : +15000/-0 IPs | | | ban:15000 | 2026-10-18T09:58:17Z | capi |
| 2 | crowdsecurity/community-blocklist (80 Ips) | update : +15000/-0 IPs | | | ban:80 | 2026-10-18T07:58:17Z | capi |
| 1 | crowdsecurity/community-blocklist (78 Ips) | update : +15000/-0 IPs | | | ban:78 | 2026-10-18T05:58:17Z | capi |
+----+-----------------------------------------------+------------------------+---------+----+-----------+----------------------+------+
docker compose exec -it crowdsec cscli decisions list --all
Sample Set of 15,162 bans
+-------+--------+-----------------------------------------+-----------------+--------+---------+----+--------+------------+----------+
| ID | Source | Scope:Value | Reason | Action | Country | AS | Events | expiration | Alert ID |
+-------+--------+-----------------------------------------+-----------------+--------+---------+----+--------+------------+----------+
| 30001 | CAPI | Ip:14.29.198.130 | ssh:exploit | ban | | | 0 | 160h43m37s | 3 |
| 30002 | CAPI | Ip:221.229.218.50 | ssh:exploit | ban | | | 0 | 161h43m37s | 3 |
| 30003 | CAPI | Ip:113.137.40.250 | ssh:exploit | ban | | | 0 | 150h43m37s | 3 |
| 30004 | CAPI | Ip:121.227.152.250 | ssh:exploit | ban | | | 0 | 93h43m37s | 3 |
| 30005 | CAPI | Ip:121.229.191.90 | ssh:exploit | ban | | | 0 | 48h43m37s | 3 |
| 30006 | CAPI | Ip:61.155.106.101 | ssh:exploit | ban | | | 0 | 92h43m37s | 3 |
| 30007 | CAPI | Ip:123.131.17.131 | ssh:exploit | ban | | | 0 | 154h43m37s | 3 |
| 30008 | CAPI | Ip:61.153.184.151 | ssh:exploit | ban | | | 0 | 162h43m37s | 3 |
| 30009 | CAPI | Ip:218.78.46.81 | ssh:exploit | ban | | | 0 | 111h43m37s | 3 |
| 30010 | CAPI | Ip:175.206.113.91 | ssh:exploit | ban | | | 0 | 126h43m37s | 3 |
| 30011 | CAPI | Ip:140.246.137.102 | ssh:exploit | ban | | | 0 | 149h43m37s | 3 |
| 30012 | CAPI | Ip:58.49.26.202 | ssh:exploit | ban | | | 0 | 161h43m37s | 3 |
│ 30414 │ CAPI │ Ip:185.220.101.0 │ ssh:bruteforce │ ban │ │ │ 0 │ 157h49m46s │ 3 │
│ 30415 │ CAPI │ Ip:185.220.101.100 │ ssh:bruteforce │ ban │ │ │ 0 │ 87h49m46s │ 3 │
│ 30416 │ CAPI │ Ip:104.152.52.100 │ ssh:bruteforce │ ban │ │ │ 0 │ 42h49m46s │ 3 │
│ 30417 │ CAPI │ Ip:198.235.24.100 │ ssh:bruteforce │ ban │ │ │ 0 │ 147h49m46s │ 3 │
│ 30418 │ CAPI │ Ip:49.51.47.100 │ ssh:bruteforce │ ban │ │ │ 0 │ 87h49m46s │ 3 │
│ 30419 │ CAPI │ Ip:205.210.31.200 │ ssh:bruteforce │ ban │ │ │ 0 │ 95h49m46s │ 3 │
│ 30420 │ CAPI │ Ip:104.152.52.200 │ ssh:bruteforce │ ban │ │ │ 0 │ 44h49m46s │ 3 │
│ 30421 │ CAPI │ Ip:103.86.180.10 │ ssh:bruteforce │ ban │ │ │ 0 │ 165h49m46s │ 3 │
│ 30422 │ CAPI │ Ip:136.232.11.10 │ ssh:bruteforce │ ban │ │ │ 0 │ 164h49m46s │ 3 │
│ 30423 │ CAPI │ Ip:185.129.61.10 │ ssh:bruteforce │ ban │ │ │ 0 │ 83h49m46s │ 3 │
│ 30424 │ CAPI │ Ip:147.185.132.10 │ ssh:bruteforce │ ban │ │ │ 0 │ 105h49m46s │ 3 │
│ 30425 │ CAPI │ Ip:93.185.162.10 │ ssh:bruteforce │ ban │ │ │ 0 │ 104h49m46s │ 3 │
│ 30426 │ CAPI │ Ip:198.235.24.10 │ ssh:bruteforce │ ban │ │ │ 0 │ 155h49m46s │ 3 │
│ 30427 │ CAPI │ Ip:207.90.244.10 │ ssh:bruteforce │ ban │ │ │ 0 │ 43h49m46s │ 3 │
│ 30428 │ CAPI │ Ip:211.53.58.10 │ ssh:bruteforce │ ban │ │ │ 0 │ 72h49m46s │ 3 │
│ 30429 │ CAPI │ Ip:185.220.101.110 │ ssh:bruteforce │ ban │ │ │ 0 │ 147h49m46s │ 3 │
│ 34840 │ CAPI │ Ip:66.132.172.209 │ ssh:bruteforce │ ban │ │ │ 0 │ 165h49m46s │ 3 │
│ 34841 │ CAPI │ Ip:144.76.22.100 │ http:scan │ ban │ │ │ 0 │ 48h49m46s │ 3 │
│ 34842 │ CAPI │ Ip:147.185.132.100 │ http:scan │ ban │ │ │ 0 │ 46h49m46s │ 3 │
│ 34843 │ CAPI │ Ip:144.76.23.100 │ http:scan │ ban │ │ │ 0 │ 159h49m46s │ 3 │
│ 34844 │ CAPI │ Ip:104.219.236.100 │ http:scan │ ban │ │ │ 0 │ 163h49m46s │ 3 │
│ 34845 │ CAPI │ Ip:35.209.99.100 │ http:scan │ ban │ │ │ 0 │ 47h49m46s │ 3 │
│ 34846 │ CAPI │ Ip:193.189.100.200 │ http:scan │ ban │ │ │ 0 │ 150h49m46s │ 3 │
│ 34847 │ CAPI │ Ip:144.76.22.200 │ http:scan │ ban │ │ │ 0 │ 86h49m46s │ 3 │
│ 34848 │ CAPI │ Ip:144.76.23.200 │ http:scan │ ban │ │ │ 0 │ 162h49m46s │ 3 │
│ 34849 │ CAPI │ Ip:198.235.24.200 │ http:scan │ ban │ │ │ 0 │ 47h49m46s │ 3 │
│ 34840 │ CAPI │ Ip:66.132.172.209 │ ssh:bruteforce │ ban │ │ │ 0 │ 165h49m46s │ 3 │
│ 34841 │ CAPI │ Ip:144.76.22.100 │ http:scan │ ban │ │ │ 0 │ 48h49m46s │ 3 │
│ 34842 │ CAPI │ Ip:147.185.132.100 │ http:scan │ ban │ │ │ 0 │ 46h49m46s │ 3 │
│ 34843 │ CAPI │ Ip:144.76.23.100 │ http:scan │ ban │ │ │ 0 │ 159h49m46s │ 3 │
│ 34844 │ CAPI │ Ip:104.219.236.100 │ http:scan │ ban │ │ │ 0 │ 163h49m46s │ 3 │
│ 34845 │ CAPI │ Ip:35.209.99.100 │ http:scan │ ban │ │ │ 0 │ 47h49m46s │ 3 │
│ 34846 │ CAPI │ Ip:193.189.100.200 │ http:scan │ ban │ │ │ 0 │ 150h49m46s │ 3 │
│ 34847 │ CAPI │ Ip:144.76.22.200 │ http:scan │ ban │ │ │ 0 │ 86h49m46s │ 3 │
│ 34848 │ CAPI │ Ip:144.76.23.200 │ http:scan │ ban │ │ │ 0 │ 162h49m46s │ 3 │
│ 34849 │ CAPI │ Ip:198.235.24.200 │ http:scan │ ban │ │ │ 0 │ 47h49m46s │ 3 │
│ 44780 │ CAPI │ Ip:103.47.217.22 │ http:exploit │ ban │ │ │ 0 │ 145h49m46s │ 3 │
│ 44781 │ CAPI │ Ip:103.47.217.26 │ http:exploit │ ban │ │ │ 0 │ 140h49m46s │ 3 │
│ 44782 │ CAPI │ Ip:198.12.33.246 │ http:exploit │ ban │ │ │ 0 │ 97h49m46s │ 3 │
│ 44783 │ CAPI │ Ip:118.193.58.20 │ generic:scan │ ban │ │ │ 0 │ 47h49m46s │ 3 │
│ 44784 │ CAPI │ Ip:152.32.159.180 │ generic:scan │ ban │ │ │ 0 │ 80h49m46s │ 3 │
│ 44785 │ CAPI │ Ip:118.194.251.141 │ generic:scan │ ban │ │ │ 0 │ 45h49m46s │ 3 │
│ 44786 │ CAPI │ Ip:152.32.185.141 │ generic:scan │ ban │ │ │ 0 │ 145h49m46s │ 3 │
│ 44787 │ CAPI │ Ip:118.193.40.191 │ generic:scan │ ban │ │ │ 0 │ 78h49m46s │ 3 │
│ 44788 │ CAPI │ Ip:165.154.162.102 │ generic:scan │ ban │ │ │ 0 │ 157h49m46s │ 3 │
│ 44789 │ CAPI │ Ip:165.154.12.82 │ generic:scan │ ban │ │ │ 0 │ 45h49m46s │ 3 │
│ 44790 │ CAPI │ Ip:118.193.32.92 │ generic:scan │ ban │ │ │ 0 │ 92h49m46s │ 3 │
│ 44791 │ CAPI │ Ip:152.32.227.23 │ generic:scan │ ban │ │ │ 0 │ 96h49m46s │ 3 │
│ 44792 │ CAPI │ Ip:104.152.52.143 │ generic:scan │ ban │ │ │ 0 │ 72h49m46s │ 3 │
│ 44793 │ CAPI │ Ip:152.32.206.64 │ generic:scan │ ban │ │ │ 0 │ 44h49m46s │ 3 │
│ 44794 │ CAPI │ Ip:165.154.36.245 │ generic:scan │ ban │ │ │ 0 │ 87h49m46s │ 3 │
│ 44795 │ CAPI │ Ip:152.32.233.95 │ generic:scan │ ban │ │ │ 0 │ 135h49m46s │ 3
│ 44836 │ CAPI │ Ip:88.149.153.106 │ generic:scan │ ban │ │ │ 0 │ 57h49m46s │ 3 │
│ 44837 │ CAPI │ Ip:154.144.255.210 │ generic:scan │ ban │ │ │ 0 │ 42h49m46s │ 3 │
│ 44838 │ CAPI │ Ip:109.226.27.227 │ generic:scan │ ban │ │ │ 0 │ 158h49m46s │ 3 │
│ 44839 │ CAPI │ Ip:165.154.221.151 │ generic:scan │ ban │ │ │ 0 │ 41h49m46s │ 3 │
│ 44840 │ CAPI │ Ip:91.134.33.89 │ http:bruteforce │ ban │ │ │ 0 │ 149h49m46s │ 3 │
│ 44841 │ CAPI │ Ip:202.108.14.225 │ http:bruteforce │ ban │ │ │ 0 │ 111h49m46s │ 3 │
│ 44842 │ CAPI │ Ip:188.59.178.27 │ http:bruteforce │ ban │ │ │ 0 │ 104h49m46s │ 3 │
│ 44843 │ CAPI │ Ip:178.159.37.98 │ http:bruteforce │ ban │ │ │ 0 │ 45h49m46s │ 3 │
│ 44844 │ CAPI │ Ip:77.41.156.64 │ http:bruteforce │ ban │ │ │ 0 │ 92h49m46s │ 3 │
│ 44845 │ CAPI │ Ip:111.26.67.36 │ http:bruteforce │ ban │ │ │ 0 │ 164h49m46s │ 3 │
│ 44846 │ CAPI │ Ip:45.148.10.36 │ http:bruteforce │ ban │ │ │ 0 │ 154h49m46s │ 3 │
│ 44847 │ CAPI │ Ip:45.148.10.30 │ http:bruteforce │ ban │ │ │ 0 │ 161h49m46s │ 3 │
│ 44848 │ CAPI │ Ip:45.148.10.25 │ http:bruteforce │ ban │ │ │ 0 │ 161h49m46s │ 3 │
│ 44849 │ CAPI │ Ip:45.148.10.37 │ http:bruteforce │ ban │ │ │ 0 │ 165h49m46s │ 3 │
docker compose exec -it crowdsec cscli alerts list
+----+-----------------------------------------------+------------------------+---------+----+-----------+----------------------+------+
| ID | value | reason | country | as | decisions | created_at | kind |
+----+-----------------------------------------------+------------------------+---------+----+-----------+----------------------+------+
| 3 | crowdsecurity/community-blocklist (15000 Ips) | update : +15000/-0 IPs | | | ban:15000 | 2026-10-18T09:58:17Z | capi |
| 2 | crowdsecurity/community-blocklist (80 Ips) | update : +15000/-0 IPs | | | ban:80 | 2026-10-18T07:58:17Z | capi |
| 1 | crowdsecurity/community-blocklist (78 Ips) | update : +15000/-0 IPs | | | ban:78 | 2026-10-18T05:58:17Z | capi |
+----+-----------------------------------------------+------------------------+---------+----+-----------+----------------------+------+
docker compose exec -it crowdsec cscli decisions list --all
Sample Set of 15,162 bans
+-------+--------+-----------------------------------------+-----------------+--------+---------+----+--------+------------+----------+
| ID | Source | Scope:Value | Reason | Action | Country | AS | Events | expiration | Alert ID |
+-------+--------+-----------------------------------------+-----------------+--------+---------+----+--------+------------+----------+
| 30001 | CAPI | Ip:14.29.198.130 | ssh:exploit | ban | | | 0 | 160h43m37s | 3 |
| 30002 | CAPI | Ip:221.229.218.50 | ssh:exploit | ban | | | 0 | 161h43m37s | 3 |
| 30003 | CAPI | Ip:113.137.40.250 | ssh:exploit | ban | | | 0 | 150h43m37s | 3 |
| 30004 | CAPI | Ip:121.227.152.250 | ssh:exploit | ban | | | 0 | 93h43m37s | 3 |
| 30005 | CAPI | Ip:121.229.191.90 | ssh:exploit | ban | | | 0 | 48h43m37s | 3 |
| 30006 | CAPI | Ip:61.155.106.101 | ssh:exploit | ban | | | 0 | 92h43m37s | 3 |
| 30007 | CAPI | Ip:123.131.17.131 | ssh:exploit | ban | | | 0 | 154h43m37s | 3 |
| 30008 | CAPI | Ip:61.153.184.151 | ssh:exploit | ban | | | 0 | 162h43m37s | 3 |
| 30009 | CAPI | Ip:218.78.46.81 | ssh:exploit | ban | | | 0 | 111h43m37s | 3 |
| 30010 | CAPI | Ip:175.206.113.91 | ssh:exploit | ban | | | 0 | 126h43m37s | 3 |
| 30011 | CAPI | Ip:140.246.137.102 | ssh:exploit | ban | | | 0 | 149h43m37s | 3 |
| 30012 | CAPI | Ip:58.49.26.202 | ssh:exploit | ban | | | 0 | 161h43m37s | 3 |
│ 30414 │ CAPI │ Ip:185.220.101.0 │ ssh:bruteforce │ ban │ │ │ 0 │ 157h49m46s │ 3 │
│ 30415 │ CAPI │ Ip:185.220.101.100 │ ssh:bruteforce │ ban │ │ │ 0 │ 87h49m46s │ 3 │
│ 30416 │ CAPI │ Ip:104.152.52.100 │ ssh:bruteforce │ ban │ │ │ 0 │ 42h49m46s │ 3 │
│ 30417 │ CAPI │ Ip:198.235.24.100 │ ssh:bruteforce │ ban │ │ │ 0 │ 147h49m46s │ 3 │
│ 30418 │ CAPI │ Ip:49.51.47.100 │ ssh:bruteforce │ ban │ │ │ 0 │ 87h49m46s │ 3 │
│ 30419 │ CAPI │ Ip:205.210.31.200 │ ssh:bruteforce │ ban │ │ │ 0 │ 95h49m46s │ 3 │
│ 30420 │ CAPI │ Ip:104.152.52.200 │ ssh:bruteforce │ ban │ │ │ 0 │ 44h49m46s │ 3 │
│ 30421 │ CAPI │ Ip:103.86.180.10 │ ssh:bruteforce │ ban │ │ │ 0 │ 165h49m46s │ 3 │
│ 30422 │ CAPI │ Ip:136.232.11.10 │ ssh:bruteforce │ ban │ │ │ 0 │ 164h49m46s │ 3 │
│ 30423 │ CAPI │ Ip:185.129.61.10 │ ssh:bruteforce │ ban │ │ │ 0 │ 83h49m46s │ 3 │
│ 30424 │ CAPI │ Ip:147.185.132.10 │ ssh:bruteforce │ ban │ │ │ 0 │ 105h49m46s │ 3 │
│ 30425 │ CAPI │ Ip:93.185.162.10 │ ssh:bruteforce │ ban │ │ │ 0 │ 104h49m46s │ 3 │
│ 30426 │ CAPI │ Ip:198.235.24.10 │ ssh:bruteforce │ ban │ │ │ 0 │ 155h49m46s │ 3 │
│ 30427 │ CAPI │ Ip:207.90.244.10 │ ssh:bruteforce │ ban │ │ │ 0 │ 43h49m46s │ 3 │
│ 30428 │ CAPI │ Ip:211.53.58.10 │ ssh:bruteforce │ ban │ │ │ 0 │ 72h49m46s │ 3 │
│ 30429 │ CAPI │ Ip:185.220.101.110 │ ssh:bruteforce │ ban │ │ │ 0 │ 147h49m46s │ 3 │
│ 34840 │ CAPI │ Ip:66.132.172.209 │ ssh:bruteforce │ ban │ │ │ 0 │ 165h49m46s │ 3 │
│ 34841 │ CAPI │ Ip:144.76.22.100 │ http:scan │ ban │ │ │ 0 │ 48h49m46s │ 3 │
│ 34842 │ CAPI │ Ip:147.185.132.100 │ http:scan │ ban │ │ │ 0 │ 46h49m46s │ 3 │
│ 34843 │ CAPI │ Ip:144.76.23.100 │ http:scan │ ban │ │ │ 0 │ 159h49m46s │ 3 │
│ 34844 │ CAPI │ Ip:104.219.236.100 │ http:scan │ ban │ │ │ 0 │ 163h49m46s │ 3 │
│ 34845 │ CAPI │ Ip:35.209.99.100 │ http:scan │ ban │ │ │ 0 │ 47h49m46s │ 3 │
│ 34846 │ CAPI │ Ip:193.189.100.200 │ http:scan │ ban │ │ │ 0 │ 150h49m46s │ 3 │
│ 34847 │ CAPI │ Ip:144.76.22.200 │ http:scan │ ban │ │ │ 0 │ 86h49m46s │ 3 │
│ 34848 │ CAPI │ Ip:144.76.23.200 │ http:scan │ ban │ │ │ 0 │ 162h49m46s │ 3 │
│ 34849 │ CAPI │ Ip:198.235.24.200 │ http:scan │ ban │ │ │ 0 │ 47h49m46s │ 3 │
│ 34840 │ CAPI │ Ip:66.132.172.209 │ ssh:bruteforce │ ban │ │ │ 0 │ 165h49m46s │ 3 │
│ 34841 │ CAPI │ Ip:144.76.22.100 │ http:scan │ ban │ │ │ 0 │ 48h49m46s │ 3 │
│ 34842 │ CAPI │ Ip:147.185.132.100 │ http:scan │ ban │ │ │ 0 │ 46h49m46s │ 3 │
│ 34843 │ CAPI │ Ip:144.76.23.100 │ http:scan │ ban │ │ │ 0 │ 159h49m46s │ 3 │
│ 34844 │ CAPI │ Ip:104.219.236.100 │ http:scan │ ban │ │ │ 0 │ 163h49m46s │ 3 │
│ 34845 │ CAPI │ Ip:35.209.99.100 │ http:scan │ ban │ │ │ 0 │ 47h49m46s │ 3 │
│ 34846 │ CAPI │ Ip:193.189.100.200 │ http:scan │ ban │ │ │ 0 │ 150h49m46s │ 3 │
│ 34847 │ CAPI │ Ip:144.76.22.200 │ http:scan │ ban │ │ │ 0 │ 86h49m46s │ 3 │
│ 34848 │ CAPI │ Ip:144.76.23.200 │ http:scan │ ban │ │ │ 0 │ 162h49m46s │ 3 │
│ 34849 │ CAPI │ Ip:198.235.24.200 │ http:scan │ ban │ │ │ 0 │ 47h49m46s │ 3 │
│ 44780 │ CAPI │ Ip:103.47.217.22 │ http:exploit │ ban │ │ │ 0 │ 145h49m46s │ 3 │
│ 44781 │ CAPI │ Ip:103.47.217.26 │ http:exploit │ ban │ │ │ 0 │ 140h49m46s │ 3 │
│ 44782 │ CAPI │ Ip:198.12.33.246 │ http:exploit │ ban │ │ │ 0 │ 97h49m46s │ 3 │
│ 44783 │ CAPI │ Ip:118.193.58.20 │ generic:scan │ ban │ │ │ 0 │ 47h49m46s │ 3 │
│ 44784 │ CAPI │ Ip:152.32.159.180 │ generic:scan │ ban │ │ │ 0 │ 80h49m46s │ 3 │
│ 44785 │ CAPI │ Ip:118.194.251.141 │ generic:scan │ ban │ │ │ 0 │ 45h49m46s │ 3 │
│ 44786 │ CAPI │ Ip:152.32.185.141 │ generic:scan │ ban │ │ │ 0 │ 145h49m46s │ 3 │
│ 44787 │ CAPI │ Ip:118.193.40.191 │ generic:scan │ ban │ │ │ 0 │ 78h49m46s │ 3 │
│ 44788 │ CAPI │ Ip:165.154.162.102 │ generic:scan │ ban │ │ │ 0 │ 157h49m46s │ 3 │
│ 44789 │ CAPI │ Ip:165.154.12.82 │ generic:scan │ ban │ │ │ 0 │ 45h49m46s │ 3 │
│ 44790 │ CAPI │ Ip:118.193.32.92 │ generic:scan │ ban │ │ │ 0 │ 92h49m46s │ 3 │
│ 44791 │ CAPI │ Ip:152.32.227.23 │ generic:scan │ ban │ │ │ 0 │ 96h49m46s │ 3 │
│ 44792 │ CAPI │ Ip:104.152.52.143 │ generic:scan │ ban │ │ │ 0 │ 72h49m46s │ 3 │
│ 44793 │ CAPI │ Ip:152.32.206.64 │ generic:scan │ ban │ │ │ 0 │ 44h49m46s │ 3 │
│ 44794 │ CAPI │ Ip:165.154.36.245 │ generic:scan │ ban │ │ │ 0 │ 87h49m46s │ 3 │
│ 44795 │ CAPI │ Ip:152.32.233.95 │ generic:scan │ ban │ │ │ 0 │ 135h49m46s │ 3
│ 44836 │ CAPI │ Ip:88.149.153.106 │ generic:scan │ ban │ │ │ 0 │ 57h49m46s │ 3 │
│ 44837 │ CAPI │ Ip:154.144.255.210 │ generic:scan │ ban │ │ │ 0 │ 42h49m46s │ 3 │
│ 44838 │ CAPI │ Ip:109.226.27.227 │ generic:scan │ ban │ │ │ 0 │ 158h49m46s │ 3 │
│ 44839 │ CAPI │ Ip:165.154.221.151 │ generic:scan │ ban │ │ │ 0 │ 41h49m46s │ 3 │
│ 44840 │ CAPI │ Ip:91.134.33.89 │ http:bruteforce │ ban │ │ │ 0 │ 149h49m46s │ 3 │
│ 44841 │ CAPI │ Ip:202.108.14.225 │ http:bruteforce │ ban │ │ │ 0 │ 111h49m46s │ 3 │
│ 44842 │ CAPI │ Ip:188.59.178.27 │ http:bruteforce │ ban │ │ │ 0 │ 104h49m46s │ 3 │
│ 44843 │ CAPI │ Ip:178.159.37.98 │ http:bruteforce │ ban │ │ │ 0 │ 45h49m46s │ 3 │
│ 44844 │ CAPI │ Ip:77.41.156.64 │ http:bruteforce │ ban │ │ │ 0 │ 92h49m46s │ 3 │
│ 44845 │ CAPI │ Ip:111.26.67.36 │ http:bruteforce │ ban │ │ │ 0 │ 164h49m46s │ 3 │
│ 44846 │ CAPI │ Ip:45.148.10.36 │ http:bruteforce │ ban │ │ │ 0 │ 154h49m46s │ 3 │
│ 44847 │ CAPI │ Ip:45.148.10.30 │ http:bruteforce │ ban │ │ │ 0 │ 161h49m46s │ 3 │
│ 44848 │ CAPI │ Ip:45.148.10.25 │ http:bruteforce │ ban │ │ │ 0 │ 161h49m46s │ 3 │
│ 44849 │ CAPI │ Ip:45.148.10.37 │ http:bruteforce │ ban │ │ │ 0 │ 165h49m46s │ 3 │