CrowdSec Hub

Protect your next service in one command.

Log-based detection, a real-time WAF and remediation components, built and battle-tested by the CrowdSec community. Pick what you run, copy the command, done.

30 s · How the Hub works and how to install your next protection.

How the Hub fits together

Two ways to stop an attack, each driven by a single collection. Every item links to its page in the catalog.

Detect attacks from your logs: parsers read each line, scenarios spot the behavior, a remediation component enforces the decision.

Your logs

nginx access.log

nginxcscli collections install crowdsecurity/nginx

Log parsers

Attack scenarios

Collections can nest: also pullsbase-http-scenarios

Postoverflows

viawhitelist-good-actors

Remediation

cs-nginx-bouncer

Step 1 of 6

A scanner probes your site

Someone hunts for leaked secrets. Each request lands as a line in your nginx access log.

192.0.2.42 - - "GET /.env HTTP/1.1" 404
192.0.2.42 - - "GET /.git/config HTTP/1.1" 404
192.0.2.42 - - "GET /wp-config.php.bak HTTP/1.1" 404
… 9 more in 10 seconds

Typically installed

The collections and remediation components most CrowdSec setups run.

Linux - Generic Protection

v0.4@crowdsecurity / linux

Core linux support : syslog+geoip+ssh

Collection

cs-firewall-bouncer

v0.0.38@crowdsecurity

Crowdsec bouncer written in golang for firewalls

Remediation componentstable

SSHD - Bruteforce Protection

v0.9@crowdsecurity / sshd

Sshd support : parser and brute-force detection

Collection

cs-nginx-bouncer

v1.2.3@crowdsecurity

Crowdsec bouncer for nginx

Remediation componentstable

HTTP - Generic Protection

v1.4@crowdsecurity / base-http-scenarios

Http common : scanners detection

Collection

cs-cloudflare-worker-bouncer

v0.0.18@crowdsecurity

A crowdsec bouncer that syncs the decisions made by crowdsec with cloudflare's firewall using cloudflare workers. manages multi user, multi account, multi zone setup. supports ip, country and as scoped decisions.

Remediation componentstable