crowdsec README

The project's README from github.com/crowdsecurity/crowdsec. As one markdown file: README.md.

CrowdSec




CrowdSec is an open-source and participative security solution offering crowdsourced server detection and protection against malicious IPs. Detect and block with our Security Engine, contribute to the network, and enjoy our real-time community blocklist.

CrowdSec schema

Features & Advantages

Versatile Security Engine

CrowdSec Security Engine is an all-in-one IDS/IPS and WAF.

It detects bad behaviors by analyzing log sources and HTTP requests, and allows active remediation thanks to the Remediation Components.

Detection rules are available on our hub under MIT license.

CrowdSec Community Blocklist

The "Community Blocklist" is a curated list of IP addresses identified as malicious by CrowdSec. The Security Engine proactively blocks the IP addresses of this blocklist, preventing malevolent IPs from reaching your systems.

CrowdSec Community Blocklist

Console - Monitoring & Automation of your security stack

CrowdSec Console

Multiple Platforms support

Multiple Platforms support

Outnumbering hackers all together

By sharing the threat they faced, all users are protecting each other (hence the name Crowd-Security). Crowdsec is designed for modern infrastructures, with its "Detect Here, Remedy There" approach, letting you analyze logs coming from several sources in one place and block threats at various levels (applicative, system, infrastructural) of your stack.

CrowdSec ships by default with scenarios (brute force, port scan, web scan, etc.) adapted for most contexts, but you can easily extend it by picking more of them from the HUB. It is also easy to adapt an existing one or create one yourself.

Installation

Follow our documentation to install CrowdSec in a few minutes on Linux, Windows, Docker, OpnSense, Kubernetes, and more.

Resources

crowdsec (crowdsecurity/crowdsec)

Searching Database…

15.2K ·GitHub
这是什么?CrowdSec 是一款开源的 IDS/IPS 和 WAF,它通过分析日志和 HTTP 请求来检测恶意行为,在本地封锁恶意访问者,并将匿名的攻击数据分享到众包网络中,从而生成实时的社区黑名单。
它是单个二进制文件,还是需要多个独立组件?它由 Security Engine(核心检测与决策守护进程)和负责实际执行封锁的独立 Remediation Components 组成,例如防火墙 bouncer、WAF、nginx/traefik 插件等。因此通常需要安装 engine 以及一个或多个 bouncer。
我该如何让它运行起来?请按照官方文档安装 CrowdSec Security Engine,它支持 Linux、Windows、Docker、OpnSense 和 Kubernetes,几分钟即可完成。
我需要从零开始自己配置检测场景吗?不需要。它为大多数场景预装了默认检测场景(如暴力破解、端口扫描、Web 扫描等),你也可以从 CrowdSec Hub 获取更多场景和 Remediation Components。
使用 CrowdSec 必须购买付费的 Console 吗?不需要。核心引擎和社区黑名单都是免费的,并采用 MIT 许可证;Console 则在此基础上提供可选的监控、可视化、额外黑名单和高级功能。
这是面向个人服务器还是大型基础设施的?它专为现代的多服务器基础设施设计,可以将多个来源的日志汇总到一处,并在技术栈的多个层面封锁威胁。
会有哪些数据被分享到众包网络中?用户会分享他们所遇到威胁的信息(即检测到的攻击行为),这些信息将用于生成保护所有人的实时社区黑名单;这是一种自愿参与的社区贡献模式。
什么是 CrowdSec Hub?它是一个由社区贡献的场景、解析器和 Remediation Components 目录。你可以从中添加内容以扩展检测覆盖范围,并为你的特定基础设施找到相应的封锁模块。
它开箱即用能检测哪些类型的攻击?默认场景涵盖常见威胁,如暴力破解尝试、端口扫描和 Web 扫描,并适用于大多数典型的服务器环境。
CrowdSec 与传统的独立 WAF 有何不同?它将 IDS/IPS 和 WAF 检测与众包黑名单相结合,因此你不仅依赖自身流量,还能实时受益于整个 CrowdSec 社区共享的威胁情报。
我可以在哪里提问或提出功能建议?项目设有用于提问和建议的 Discord 服务器,还有一个公开路线图(Public Roadmap),用户可以在上面对功能想法投票并提交新的建议。
Size
217.1 MB
Stars
15.2K
Age
6y
Commits · 90 Days