diff --git a/.github/ISSUE_TEMPLATE/feature_request.md b/.github/ISSUE_TEMPLATE/feature_request.md index 6dcb9458b..e0f229dc1 100644 --- a/.github/ISSUE_TEMPLATE/feature_request.md +++ b/.github/ISSUE_TEMPLATE/feature_request.md @@ -1,13 +1,13 @@ --- name: Feature request about: Suggest an idea for this project -title: Improvment/ +title: Improvement/ labels: enhancement assignees: '' --- -Please, start your issue name (after `improvment`) with the component name impacted by this feature request and a small description of the FR. Example: `Improvment/cscli: add this feature ....` and remove this line :) +Please, start your issue name (after `improvement`) with the component name impacted by this feature request and a small description of the FR. Example: `Improvement/cscli: add this feature ....` and remove this line :) **Is your feature request related to a problem? Please describe.** A clear and concise description of what the problem is. Ex. I'm always frustrated when [...] diff --git a/.github/release-drafter.yml b/.github/release-drafter.yml index 2f317cc84..5f662f0a8 100644 --- a/.github/release-drafter.yml +++ b/.github/release-drafter.yml @@ -2,10 +2,10 @@ categories: - title: 'New Features' labels: - 'new feature' - - title: 'Improvments' + - title: 'Improvements' labels: - 'enhancement' - - 'improvment' + - 'improvement' - title: 'Bug Fixes' labels: - 'fix' @@ -13,7 +13,7 @@ categories: - 'bug' - title: 'Documentation' labels: - - 'documention' + - 'documentation' - 'doc' tag-template: "- $TITLE @$AUTHOR (#$NUMBER)" template: | diff --git a/docs/assets/images/dashboard_view2.png b/docs/assets/images/dashboard_view2.png new file mode 100644 index 000000000..6a91381eb Binary files /dev/null and b/docs/assets/images/dashboard_view2.png differ diff --git a/docs/cheat_sheets/ban-mgmt.md b/docs/cheat_sheets/ban-mgmt.md index 273f6e02e..02d99d1c8 100644 --- a/docs/cheat_sheets/ban-mgmt.md +++ b/docs/cheat_sheets/ban-mgmt.md @@ -38,9 +38,11 @@ And 64 records from API, 32 distinct AS, 19 distinct countries - `EXPIRATION` is the time left on remediation -## Remove a ban +Check [command usage](/cscli/cscli_ban_list/) for additional filtering and output control flags. +## Delete a ban + > delete the ban on IP `1.2.3.4` ```bash @@ -69,4 +71,17 @@ And 64 records from API, 32 distinct AS, 19 distinct countries ``` - + +## Flush all existing bans + +> Flush all the existing bans + +```bash +{{cli.bin}} ban flush +``` + +!!! warning + This will as well remove any existing ban + + + diff --git a/docs/cheat_sheets/config-mgmt.md b/docs/cheat_sheets/config-mgmt.md index a57d3a5f5..c4a6c8477 100644 --- a/docs/cheat_sheets/config-mgmt.md +++ b/docs/cheat_sheets/config-mgmt.md @@ -1,4 +1,4 @@ -{{cli.bin}} allows you install, list, update/upgrade and remove configurations : parsers, enrichment, scenarios. +{{cli.bin}} allows you install, list, upgrade and remove configurations : parsers, enrichment, scenarios. The various parsers, enrichers and scenarios installed on your machine makes a coherent ensemble to provide detection capabilities. diff --git a/docs/getting_started/FAQ.md b/docs/getting_started/FAQ.md index 108da9e54..e9cfd171d 100644 --- a/docs/getting_started/FAQ.md +++ b/docs/getting_started/FAQ.md @@ -13,30 +13,28 @@ {{crowdsec.Name}} is under [MIT license]({{crowdsec.url}}/blob/master/LICENSE) -## How fast is it ? - -{{crowdsec.name}} can easily handle 5k+ EP/s on a rich pipeline (multiple parsers, geoip enrichment, scenarios and so on). Logs are a good fit for sharding by default, so it is definitely the way to go if you need to handle higher throughput. - -If you need help for large scale deployment, please get in touch with us on the {{doc.discourse}}, we love challenges ;) - - -## Is there any performance impact ? - -As {{crowdsec.name}} only works on logs, it shouldn't impact your production. -When it comes to {{blockers.name}}, it should perform **one** request to the database when a **new** IP is discovered thus have minimal performance impact. - -## Which information is shared from my logs ? - +## Which information is sent to the APIs ? Our aim is to build a strong community that can share malevolent attackers IPs, for that we need to collect the bans triggered locally by each user. -The signal sent by your {{crowdsec.name}} to the central API only contains meta-data about the attack, including : +The signal sent by your {{crowdsec.name}} to the central API only contains only meta-data about the attack : - Attacker IP - Scenario name - Time of start/end of attack -You can find the specific list [here]({{crowdsec.url}}/blob/master/pkg/types/signal_occurence.go) +Your logs are not sent to our central API, only meta-data about blocked attacks will be. + +## What is the performance impact ? + +As {{crowdsec.name}} only works on logs, it shouldn't impact your production. +When it comes to {{blockers.name}}, it should perform **one** request to the database when a **new** IP is discovered thus have minimal performance impact. + +## How fast is it ? + +{{crowdsec.name}} can easily handle several thousands of events per second on a rich pipeline (multiple parsers, geoip enrichment, scenarios and so on). Logs are a good fit for sharding by default, so it is definitely the way to go if you need to handle higher throughput. + +If you need help for large scale deployment, please get in touch with us on the {{doc.discourse}}, we love challenges ;) ## What backend database does {{crowdsec.Name}} supports and how to switch ? @@ -46,6 +44,13 @@ See [backend configuration](/references/output/#switching-backend-database) for SQLite is the default backend as it's suitable for standalone/single-machine setups. On the other hand, MySQL is more suitable for distributed architectures where blockers across the applicative stack need to access a centralized ban database. +## How to control granularity of actions ? (whitelists, learning etc.) + +{{crowdsec.name}} support both [whitelists]((/write_configurations/whitelist/) and [learning](/guide/crowdsec/simulation/) : + + - Whitelists allows you to "discard" events or overflows + - Learning allows you to simply cancel the decision that is going to be taken, but keep track of it + ## How to add whitelists ? You can follow this [guide](/write_configurations/whitelist/) @@ -68,13 +73,19 @@ Defaults env_keep += "HTTP_PROXY HTTPS_PROXY NO_PROXY" To report a bug, please open an issue on the [repository]({{crowdsec.bugreport}}) +## What about false positives ? + +Several initiatives have been taken to tackle the false positives approach as early as possible : + + - The scenarios published on the hub are tailored to favor low false positive rates + - You can find [generic whitelists](https://hub.crowdsec.net/author/crowdsecurity/collections/whitelist-good-actors) that should allow to cover most common cases (SEO whitelists, CDN whitelists etc.) + - The [simulation configuration](/guide/crowdsec/simulation/) allows you to keep a tight control over scenario and their false positives + + ## I need some help Feel free to ask for some help to the {{doc.community}}. -## Who's stronger : elephant or hippopotamus ? - -[The answer](https://www.quora.com/Which-animal-is-stronger-the-elephant-or-the-hippopotamus) \ No newline at end of file diff --git a/docs/write_configurations/whitelist.md b/docs/write_configurations/whitelist.md index 85ac1909c..3b2ff3697 100644 --- a/docs/write_configurations/whitelist.md +++ b/docs/write_configurations/whitelist.md @@ -86,7 +86,7 @@ whitelist: - "80.x.x.x" ``` -and reload {{crowdsec.name}} : `sudo systemctl restart crowdsec` +and reload {{crowdsec.name}} : `sudo systemctl reload crowdsec` ### Test the whitelist diff --git a/mkdocs.yml b/mkdocs.yml index 8c9ef357e..6c0ea48f2 100644 --- a/mkdocs.yml +++ b/mkdocs.yml @@ -134,6 +134,7 @@ extra: update_doc: /cscli/cscli_update/ upgrade_doc: /cscli/cscli_upgrade/ backup_doc: /cscli/cscli_backup/ + simulation_doc: /cscli/cscli_simulation/ config: cli_dir: /etc/crowdsec/cscli/ crowdsec_dir: "/etc/crowdsec/config/" @@ -174,8 +175,8 @@ extra: expr: name: expr Name: Expr - htmlname: "[expr](https://github.com/antonmedv/expr)" - Htmlname: "[Expr](https://github.com/antonmedv/expr)" + htmlname: "[expr](/write_configurations/expressions/)" + Htmlname: "[Expr](/write_configurations/expressions/)" stages: name: stages name: Stages