parent
57aa1c6b24
commit
d431fe9f21
|
@ -30,7 +30,7 @@ To achieve this, Crowdsec reads logs from different sources (files, streams ...)
|
||||||
|
|
||||||
Crowdsec is a modular and plug-able framework, it ships a large variety of well known popular scenarios; users can choose what scenarios they want to be protected from as well as easily add new custom ones to better fit their environment.
|
Crowdsec is a modular and plug-able framework, it ships a large variety of well known popular scenarios; users can choose what scenarios they want to be protected from as well as easily add new custom ones to better fit their environment.
|
||||||
|
|
||||||
Detected malevolent peers can then be prevented from accessing your resources by deploying [blockers](https://hub.crowdsec.net/browse/#blockers) at various levels (applicative, system, infrastructural) of your stack.
|
Detected malevolent peers can then be prevented from accessing your resources by deploying [bouncers](https://hub.crowdsec.net/browse/#blockers) at various levels (applicative, system, infrastructural) of your stack.
|
||||||
|
|
||||||
One of the advantages of Crowdsec when compared to other solutions is its crowded aspect : Meta information about detected attacks (source IP, time and triggered scenario) are sent to a central API and then shared amongst all users.
|
One of the advantages of Crowdsec when compared to other solutions is its crowded aspect : Meta information about detected attacks (source IP, time and triggered scenario) are sent to a central API and then shared amongst all users.
|
||||||
|
|
||||||
|
@ -83,10 +83,10 @@ sudo ./wizard.sh -i
|
||||||
<img src="https://github.com/crowdsecurity/crowdsec/blob/master/docs/assets/images/out-of-the-box-protection.gif">
|
<img src="https://github.com/crowdsecurity/crowdsec/blob/master/docs/assets/images/out-of-the-box-protection.gif">
|
||||||
</details>
|
</details>
|
||||||
|
|
||||||
### Easy blocker deployment
|
### Easy bouncer deployment
|
||||||
|
|
||||||
<details>
|
<details>
|
||||||
<summary>It's trivial to add blockers to enforce decisions of crowdsec (click to expand)</summary>
|
<summary>It's trivial to add bouncers to enforce decisions of crowdsec (click to expand)</summary>
|
||||||
<img src="https://github.com/crowdsecurity/crowdsec/blob/master/docs/assets/images/blocker-installation.gif">
|
<img src="https://github.com/crowdsecurity/crowdsec/blob/master/docs/assets/images/blocker-installation.gif">
|
||||||
</details>
|
</details>
|
||||||
|
|
||||||
|
|
|
@ -1,12 +0,0 @@
|
||||||
# Blockers
|
|
||||||
|
|
||||||
|
|
||||||
{{blockers.Name}} are standalone software pieces in charge of acting upon blocked IPs.
|
|
||||||
|
|
||||||
They can either within the applicative stack, or work out of band :
|
|
||||||
|
|
||||||
[nginx blocker](https://github.com/crowdsecurity/cs-nginx-blocker) will check every unknown IP against the database before letting go through or serving a *403* to the user, while a [netfilter blocker](https://github.com/crowdsecurity/cs-netfilter-blocker) will simply "add" malevolent IPs to nftables/ipset set of blacklisted IPs.
|
|
||||||
|
|
||||||
|
|
||||||
You can explore [available {{blockers.name}} on the hub]({{hub.plugins_url}}), and find below a few of the "main" {{blockers.name}}.
|
|
||||||
|
|
12
docs/bouncers/index.md
Normal file
12
docs/bouncers/index.md
Normal file
|
@ -0,0 +1,12 @@
|
||||||
|
# bouncers
|
||||||
|
|
||||||
|
|
||||||
|
{{bouncers.Name}} are standalone software pieces in charge of acting upon blocked IPs.
|
||||||
|
|
||||||
|
They can either be within the applicative stack, or work out of band :
|
||||||
|
|
||||||
|
[nginx bouncer](https://github.com/crowdsecurity/cs-nginx-bouncer) will check every unknown IP against the database before letting go through or serving a *403* to the user, while a [netfilter bouncer](https://github.com/crowdsecurity/cs-netfilter-bouncer) will simply "add" malevolent IPs to nftables/ipset set of blacklisted IPs.
|
||||||
|
|
||||||
|
|
||||||
|
You can explore [available {{bouncers.name}} on the hub]({{hub.plugins_url}}), and find below a few of the "main" {{bouncers.name}}.
|
||||||
|
|
|
@ -5,7 +5,7 @@ Crowdsec API interaction
|
||||||
### Synopsis
|
### Synopsis
|
||||||
|
|
||||||
|
|
||||||
Allow to register your machine into crowdsec API to send and receive signal.
|
Allow to register your machine into crowdsec API to send and receive alert.
|
||||||
|
|
||||||
|
|
||||||
### Examples
|
### Examples
|
||||||
|
|
|
@ -17,7 +17,7 @@
|
||||||
|
|
||||||
Our aim is to build a strong community that can share malevolent attackers IPs, for that we need to collect the bans triggered locally by each user.
|
Our aim is to build a strong community that can share malevolent attackers IPs, for that we need to collect the bans triggered locally by each user.
|
||||||
|
|
||||||
The signal sent by your {{crowdsec.name}} to the central API only contains only meta-data about the attack :
|
The alert sent by your {{crowdsec.name}} to the central API only contains only meta-data about the attack :
|
||||||
|
|
||||||
- Attacker IP
|
- Attacker IP
|
||||||
- Scenario name
|
- Scenario name
|
||||||
|
@ -28,7 +28,7 @@ Your logs are not sent to our central API, only meta-data about blocked attacks
|
||||||
## What is the performance impact ?
|
## What is the performance impact ?
|
||||||
|
|
||||||
As {{crowdsec.name}} only works on logs, it shouldn't impact your production.
|
As {{crowdsec.name}} only works on logs, it shouldn't impact your production.
|
||||||
When it comes to {{blockers.name}}, it should perform **one** request to the database when a **new** IP is discovered thus have minimal performance impact.
|
When it comes to {{bouncers.name}}, it should perform **one** request to the database when a **new** IP is discovered thus have minimal performance impact.
|
||||||
|
|
||||||
## How fast is it ?
|
## How fast is it ?
|
||||||
|
|
||||||
|
@ -42,7 +42,7 @@ Currently (0.3.0), {{crowdsec.name}} supports SQLite (default) and MySQL databas
|
||||||
See [backend configuration](/references/output/#switching-backend-database) for relevant configuration.
|
See [backend configuration](/references/output/#switching-backend-database) for relevant configuration.
|
||||||
|
|
||||||
SQLite is the default backend as it's suitable for standalone/single-machine setups.
|
SQLite is the default backend as it's suitable for standalone/single-machine setups.
|
||||||
On the other hand, MySQL is more suitable for distributed architectures where blockers across the applicative stack need to access a centralized ban database.
|
On the other hand, MySQL is more suitable for distributed architectures where bouncers across the applicative stack need to access a centralized ban database.
|
||||||
|
|
||||||
## How to control granularity of actions ? (whitelists, learning etc.)
|
## How to control granularity of actions ? (whitelists, learning etc.)
|
||||||
|
|
||||||
|
@ -96,7 +96,7 @@ Feel free to ask for some help to the {{doc.community}}.
|
||||||
|
|
||||||
### On Configurations (Parsers, scenarios)
|
### On Configurations (Parsers, scenarios)
|
||||||
|
|
||||||
### On Blockers
|
### On bouncers
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
|
@ -65,7 +65,7 @@ To specify the logging level, available levels:
|
||||||
To enable or disable the profiling in {{crowdsec.Name}}.
|
To enable or disable the profiling in {{crowdsec.Name}}.
|
||||||
|
|
||||||
#### `apimode:`
|
#### `apimode:`
|
||||||
To enable or disable signals sending to the {{api.htmlname}}.
|
To enable or disable alerts sending to the {{api.htmlname}}.
|
||||||
|
|
||||||
#### `daemon:`
|
#### `daemon:`
|
||||||
To enable or disable {{crowdsec.Name}} daemon mode.
|
To enable or disable {{crowdsec.Name}} daemon mode.
|
||||||
|
@ -116,8 +116,8 @@ Or if you loose your credentials:
|
||||||
The profiles is what allows you to decide how do you react when a scenario is triggered :
|
The profiles is what allows you to decide how do you react when a scenario is triggered :
|
||||||
|
|
||||||
- do you notify yourself on mattermost/slack ?
|
- do you notify yourself on mattermost/slack ?
|
||||||
- do you push the signal to a database so that your blockers can stop the IP from continuing its attack ?
|
- do you push the alert to a database so that your bouncers can stop the IP from continuing its attack ?
|
||||||
- do you want to avoid pushing this signal to the API ?
|
- do you want to avoid pushing this alert to the API ?
|
||||||
|
|
||||||
Behind the scenes, the "profiles" system actually allows you to dispatch an event/overflow to various output plugins.
|
Behind the scenes, the "profiles" system actually allows you to dispatch an event/overflow to various output plugins.
|
||||||
|
|
||||||
|
|
|
@ -9,7 +9,7 @@ You can tag some (or all) scenarios as being in **simulation mode**, which is es
|
||||||
Simulation and [Whitelists](/write_configurations/whitelist/) are not to be mixed. [Whitelists](/write_configurations/whitelist/) allows you to purely discard an overflow or a log, while simulation will only "cancel" the action against a peer, while keeping track of events and overflows.
|
Simulation and [Whitelists](/write_configurations/whitelist/) are not to be mixed. [Whitelists](/write_configurations/whitelist/) allows you to purely discard an overflow or a log, while simulation will only "cancel" the action against a peer, while keeping track of events and overflows.
|
||||||
|
|
||||||
|
|
||||||
When this happens, the scenarios are still triggered, but the action is prefixed with `simulation:`, which means that blockers won't take action against the peer(s) that triggered the scenario.
|
When this happens, the scenarios are still triggered, but the action is prefixed with `simulation:`, which means that bouncers won't take action against the peer(s) that triggered the scenario.
|
||||||
|
|
||||||
Simulation can be managed with [cscli simulation](/cscli/cscli_simulation/) command, and allows you to have settings such as _"all in simulation except scenarios X,Y,Z"_ or _"only scenarios X,Y,Z in simulation mode"_ :
|
Simulation can be managed with [cscli simulation](/cscli/cscli_simulation/) command, and allows you to have settings such as _"all in simulation except scenarios X,Y,Z"_ or _"only scenarios X,Y,Z in simulation mode"_ :
|
||||||
|
|
||||||
|
|
|
@ -8,7 +8,7 @@ To achieve this, {{crowdsec.Name}} reads logs from different sources (files, str
|
||||||
|
|
||||||
{{crowdsec.Name}} is a modular and plug-able framework, it ships a large variety of [well known popular scenarios](https://hub.crowdsec.net/browse/#configurations); users can choose what scenarios they want to be protected from as well as easily adding new custom ones to better fit their environment.
|
{{crowdsec.Name}} is a modular and plug-able framework, it ships a large variety of [well known popular scenarios](https://hub.crowdsec.net/browse/#configurations); users can choose what scenarios they want to be protected from as well as easily adding new custom ones to better fit their environment.
|
||||||
|
|
||||||
Detected malevolent peers can then be prevented from accessing your resources by deploying [blockers]({{hub.plugins_url}}) at various levels (applicative, system, infrastructural) of your stack.
|
Detected malevolent peers can then be prevented from accessing your resources by deploying [bouncers]({{hub.plugins_url}}) at various levels (applicative, system, infrastructural) of your stack.
|
||||||
|
|
||||||
One of the advantages of Crowdsec when compared to other solutions is its crowd-sourced aspect : Meta information about detected attacks (source IP, time and triggered scenario) are sent to a central API and then shared amongst all users.
|
One of the advantages of Crowdsec when compared to other solutions is its crowd-sourced aspect : Meta information about detected attacks (source IP, time and triggered scenario) are sent to a central API and then shared amongst all users.
|
||||||
|
|
||||||
|
@ -21,7 +21,7 @@ Thanks to this, besides detecting and stopping attacks in real time based on you
|
||||||
|
|
||||||
- [{{crowdsec.Name}}]({{crowdsec.url}}) is the lightweight service that processes logs and keeps track of attacks.
|
- [{{crowdsec.Name}}]({{crowdsec.url}}) is the lightweight service that processes logs and keeps track of attacks.
|
||||||
- [{{cli.name}}]({{cli.main_doc}}) is the command line interface for humans, it allows you to view, add, or remove bans as well as to install, find, or update scenarios and parsers
|
- [{{cli.name}}]({{cli.main_doc}}) is the command line interface for humans, it allows you to view, add, or remove bans as well as to install, find, or update scenarios and parsers
|
||||||
- [{{blockers.name}}]({{hub.plugins_url}}) are the components that block malevolent traffic, and can be deployed anywhere in your stack
|
- [{{bouncers.name}}]({{hub.plugins_url}}) are the components that block malevolent traffic, and can be deployed anywhere in your stack
|
||||||
|
|
||||||
## Architecture
|
## Architecture
|
||||||
|
|
||||||
|
@ -54,7 +54,7 @@ To learn more about {{crowdsec.name}} and give it a try, please see :
|
||||||
- [Take a quick tour of {{crowdsec.name}} and {{cli.name}} features](/getting_started/crowdsec-tour/)
|
- [Take a quick tour of {{crowdsec.name}} and {{cli.name}} features](/getting_started/crowdsec-tour/)
|
||||||
- [Observability of {{crowdsec.name}}](/observability/overview/)
|
- [Observability of {{crowdsec.name}}](/observability/overview/)
|
||||||
- [Understand {{crowdsec.name}} configuration](/getting_started/concepts/)
|
- [Understand {{crowdsec.name}} configuration](/getting_started/concepts/)
|
||||||
- [Deploy {{blockers.name}} to stop malevolent peers](/blockers/)
|
- [Deploy {{bouncers.name}} to stop malevolent peers](/bouncers/)
|
||||||
- [FAQ](getting_started/FAQ/)
|
- [FAQ](getting_started/FAQ/)
|
||||||
|
|
||||||
Don't hesitate to reach out if you're facing issues :
|
Don't hesitate to reach out if you're facing issues :
|
||||||
|
|
|
@ -1,11 +1,11 @@
|
||||||
# Output
|
# Output
|
||||||
|
|
||||||
The output mechanism is composed of plugins. In order to store the bans for {{blockers.htmlname}}, at least one backend plugin must be loaded. Else, bans will not be stored and decisions cannot be applied.
|
The output mechanism is composed of plugins. In order to store the bans for {{bouncers.htmlname}}, at least one backend plugin must be loaded. Else, bans will not be stored and decisions cannot be applied.
|
||||||
|
|
||||||
|
|
||||||
Currently the supported backends are SQLite (default) and MySQL.
|
Currently the supported backends are SQLite (default) and MySQL.
|
||||||
|
|
||||||
In order to filter which signals will be sent to which plugin, {{crowdsec.name}} use a system of `profile` that can allow to granularly process your bans and signals.
|
In order to filter which alerts will be sent to which plugin, {{crowdsec.name}} use a system of `profile` that can allow to granularly process your bans and alerts.
|
||||||
|
|
||||||
## Profile
|
## Profile
|
||||||
|
|
||||||
|
@ -14,7 +14,7 @@ Here is a sample of a profile configuration:
|
||||||
```yaml
|
```yaml
|
||||||
profile: <profile_name>
|
profile: <profile_name>
|
||||||
filter: "<filter_expression>"
|
filter: "<filter_expression>"
|
||||||
api: true # default true : send signal to crowdsec API
|
api: true # default true : send alert to crowdsec API
|
||||||
outputs: # here choose your output plugins for this profile
|
outputs: # here choose your output plugins for this profile
|
||||||
- plugin: plugin1
|
- plugin: plugin1
|
||||||
custom_config: <config>
|
custom_config: <config>
|
||||||
|
@ -44,7 +44,7 @@ outputs:
|
||||||
store: false
|
store: false
|
||||||
```
|
```
|
||||||
|
|
||||||
Here we can use {{filter.htmlname}} like in parsers and scenarios with the {{signal.htmlname}} object to choose which signal will be process by which plugin.
|
Here we can use {{filter.htmlname}} like in parsers and scenarios with the {{signal.htmlname}} object to choose which alert will be process by which plugin.
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
22
mkdocs.yml
22
mkdocs.yml
|
@ -37,8 +37,8 @@ nav:
|
||||||
- Scenarios: write_configurations/scenarios.md
|
- Scenarios: write_configurations/scenarios.md
|
||||||
- Whitelists: write_configurations/whitelist.md
|
- Whitelists: write_configurations/whitelist.md
|
||||||
- Expressions: write_configurations/expressions.md
|
- Expressions: write_configurations/expressions.md
|
||||||
- Blockers:
|
- Bouncers:
|
||||||
- Overview : blockers/index.md
|
- Overview : bouncers/index.md
|
||||||
- Nginx:
|
- Nginx:
|
||||||
- Installation : "https://github.com/crowdsecurity/cs-nginx-blocker#installation"
|
- Installation : "https://github.com/crowdsecurity/cs-nginx-blocker#installation"
|
||||||
- Configuration : "https://github.com/crowdsecurity/cs-nginx-blocker#configuration"
|
- Configuration : "https://github.com/crowdsecurity/cs-nginx-blocker#configuration"
|
||||||
|
@ -141,12 +141,12 @@ extra:
|
||||||
cli_dir: /etc/crowdsec/cscli/
|
cli_dir: /etc/crowdsec/cscli/
|
||||||
crowdsec_dir: "/etc/crowdsec/config/"
|
crowdsec_dir: "/etc/crowdsec/config/"
|
||||||
acquis_path: "/etc/crowdsec/config/acquis.yaml"
|
acquis_path: "/etc/crowdsec/config/acquis.yaml"
|
||||||
blockers:
|
bouncers:
|
||||||
name: blockers
|
name: bouncers
|
||||||
Name: Blockers
|
Name: Bouncers
|
||||||
url: "https://hub.crowdsec.net/browse/#blockers"
|
url: "https://hub.crowdsec.net/browse/#blockers"
|
||||||
htmlname: "[blockers](/blockers/)"
|
htmlname: "[bouncers](/bouncers/)"
|
||||||
Htmlname: "[blockers](/blockers/)"
|
Htmlname: "[Bouncers](/bouncers/)"
|
||||||
plugins:
|
plugins:
|
||||||
name: backend plugins
|
name: backend plugins
|
||||||
configpath: "/etc/crowdsec/plugins/backend/"
|
configpath: "/etc/crowdsec/plugins/backend/"
|
||||||
|
@ -225,10 +225,10 @@ extra:
|
||||||
htmlname: "[whitelists](/write_configurations/whitelist/)"
|
htmlname: "[whitelists](/write_configurations/whitelist/)"
|
||||||
Htmlname: "[Whitelists](/write_configurations/whitelist/)"
|
Htmlname: "[Whitelists](/write_configurations/whitelist/)"
|
||||||
signal:
|
signal:
|
||||||
name: signal
|
name: alert
|
||||||
Name: Signal
|
Name: Alert
|
||||||
htmlname: "[signal](/getting_started/concepts/#overflow-or-signaloccurence)"
|
htmlname: "[alert](/getting_started/concepts/#overflow-or-signaloccurence)"
|
||||||
Htmlname: "[Signal](/getting_started/concepts/#overflow-or-signaloccurence)"
|
Htmlname: "[Alert](/getting_started/concepts/#overflow-or-signaloccurence)"
|
||||||
#scenario stuff
|
#scenario stuff
|
||||||
stage:
|
stage:
|
||||||
name: stage
|
name: stage
|
||||||
|
|
Loading…
Reference in a new issue