CrowdSec
Free · OSSNetwork & IDS
Crowdsourced blocklist + local behavior detection at the edge.
CrowdSec homepage ↗Crowdsourced firewall. Reads logs from anything (web server, SSH, mail) and blocks attackers at the network edge based on a shared community blocklist of known bad IPs. Free to use, free to contribute.
Code complete and exposed in the dashboard, but rough edges remain. Do not pin compliance claims to this pack.
What it watches
- Behavior detections from log parsing (brute-force, scan, credential-stuffing)
- Decisions — IPs blocked locally + via the community blocklist
- Bouncer enforcement events
- Scenario triggers across web, SSH, mail
MITRE ATT&CK coverage
Tactics this connector gives CyberCLI visibility into.
Every alert this connector surfaces
2 event types
Every matrix-covered event_type on the passthrough lane — pinned by the engine's coverage matrix.
The right column shows the operator-friendly phrase the dashboard renders. High-severity
AI-lane signals are summarized in What it watches above (Warden + Herald
handle those); the rest take the substrate's passthrough lane (no AI tokens burned).
| event_type | dashboard renders |
|---|---|
| crowdsec_actor_seen | CrowdSec actor observed on crowdsec |
| crowdsec_decision_added | CrowdSec decision added on crowdsec |
What it helps you catch
What you'd see in CyberCLI
illustrativeBlocks a brute-forcer at the edge on behavior, then shares + receives the IOC across the community.
Routed to Warden (triage) → Knight (detection) → Marshal (response)
⛓ every step hash-chained · replayable
What CyberCLI reads from CrowdSec
audit our mathCrowdSec's file notification plugin emits NDJSON, one record per scenario firing — behavioral IPS detections, AppSec hits, audit events. The 33 fields we read carry the detection identity (scenario, kind, message_text, event_count), the source actor with GeoIP (src_ip, src_range, src_country, src_as_number, src_as_name), the proposed remediation (proposed_action, proposed_duration, proposed_until, decision_origin), and the attack window. Simulated + decision-less hits are marked low-signal; remediation_triggered hits land at rule_level 7.
Full field index · 33 fields ↓
.action.classifications.cybercli_class.cybercli_external_id.cybercli_low_signal.cybercli_parse_status.cybercli_wire_format.decision_origin.event_count.event_id.event_timestamp.event_type.event_window_end.event_window_start.kind.machine_id.message_text.mitre_techniques.proposed_action.proposed_duration.proposed_until.remediation_triggered.rule_id.rule_level.scenario.scenario_version.simulated.src_as_name.src_as_number.src_country.src_ip.src_range.src_scope MITRE techniques typically mapped
- T1110 ↗
Brute ForceCredential Access
- T1190 ↗
Exploit Public-Facing ApplicationInitial Access
- T1595 ↗
Active ScanningReconnaissance
- T1071.001 ↗
Application Layer Protocol: Web ProtocolsCommand and Control
- T1078 ↗
Valid AccountsInitial Access · Persistence
- T1498 ↗
Network Denial of ServiceImpact
Trust Ladder ceiling · L0 → L4
- ·L0–L2: digest the scenario firing, notify Herald on remediation_triggered hits, summarize actor + scenario + proposed decision for the case
- ·L3 (Knight verification): reputation lookup on src_ip + src_as_number, decode decision_origin (engine vs community blocklist), correlate with UniFi/Suricata flows — read-only
- ·L4 (Paladin containment, Pro+): bouncer-side decision delete via crowdsec.delete_decision + blocklist refresh — CrowdSec owns its own enforcement surface
- ·L5+: scenario/parser edits, AppSec rule changes, bouncer-policy retuning — the detection logic stays operator-owned
- ·Any decision to disable simulation mode globally or change CAPI participation posture
Full ladder semantics · /trust →
Field count + sample event auto-derived from src/cybercli/connectors/crowdsec/vector.vrl at build time. Numbers update the moment the engine's parser changes — no drift.
Close more of the kill chain
CrowdSec covers 2 of 14 ATT&CK tactics. Pair it with these to widen coverage:
How to connect
- 1 Install CrowdSec + the collections for your services.
- 2 Enable the local API + JSON log.
- 3 Run `cybercli onboard crowdsec`.
- 4 Confirm decisions + alerts in the dashboard's Connectors panel.
curl -s https://install.crowdsec.net | sudo sh && sudo apt install crowdsec
Local-first. Detection + decisions run on your box; only anonymized signals are shared with the community blocklist if you opt in.