Skip to content
OpenSourceSoftware.ai
CrowdSec logo

CrowdSec

crowdsecurity · Application security

GitHub stars

15,390
—Awaiting first sync

Awaiting first sync

No measured star history yet

What is CrowdSec?

CrowdSec watches the logs your servers and web apps already write, recognises patterns that look like attacks, and records a decision to block the source IP. A separate small component, the bouncer, enforces that decision at a firewall, web server or proxy. The same engine can also take part in a shared community blocklist.

CrowdSec is an open-source security engine that reads your server and application logs, detects attacks such as brute force and scans, and tells small blocking components called bouncers to stop the offending IP addresses. Engines can also share attacks and receive a community blocklist.

Core capabilities

  • Detects brute force, port scans and web scans from your logs with ready-made scenarios from the hub.
  • Blocks attackers through bouncers for firewalls, Nginx, Apache, Traefik, HAProxy, Cloudflare and more.
  • Installs on Linux, Windows, Docker and Kubernetes, and includes a web application firewall component.

From log lines to blocked IPs

The Log Processor reads logs from your data sources, parses and enriches them, and matches them against scenarios that describe attack behaviour. Alerts go to the Local API, which turns them into decisions. Bouncers ask the Local API for those decisions and enforce them. Collections bundle the parsers and scenarios for an application such as Nginx, and the detection rules on the hub are published under the MIT licence.

  • Log analysis
  • Scenarios
  • Bouncers
  • Hub

Sharing attacks and the community blocklist

An enrolled engine sends signal metadata to CrowdSec's Central API: the scenario name, hash and version, a timestamp, the machine ID and the offending IP address. You can opt out. In return it receives a blocklist matched to the scenarios it runs. Free users who contribute with unmodified hub scenarios get the Community list (about 15,000 IPs), free users who do not contribute get the Lite list (capped at 3,000), and paying users get Premium (up to 60,000). The Central API is run by CrowdSec, not by you.

  • Community blocklist
  • Signals
  • Privacy

Install it and what the licence covers

The Security Engine runs from packages on Linux, as an MSI or Chocolatey package on Windows, as the crowdsecurity/crowdsec Docker image, and on Kubernetes through a Helm chart. The docs also cover FreeBSD, macOS, pfSense and OPNsense. The engine in the GitHub repository is MIT licensed. The CrowdSec Console, premium blocklists and threat-intelligence feeds are separate services from the company, and the Console has a free tier.

  • MIT licence
  • Docker
  • Kubernetes
  • Windows

Where it fits

Use cases

  1. 01

    Stop SSH and login brute force

    Install the Security Engine from the CrowdSec package repository and point it at the SSH and web server logs. Add the firewall bouncer so an IP that triggers a brute-force scenario is blocked at the firewall.

  2. 02

    Keep bad traffic away from a web app

    Install the collection for your web server, such as Nginx, and add the matching bouncer. Requests from flagged IPs are refused before they reach the application, and the AppSec component can also check requests against WAF rules.

  3. 03

    Protect several servers from one place

    Run one Local API and point the Log Processor on each machine at it, then install bouncers wherever blocking should happen. Detection happens on one host and the block is applied on another, including inside Docker and Kubernetes.