Skip to content

Commit 0687ce1

Browse files
committed
WIP : improve community blocklist doc
1 parent fa7d92c commit 0687ce1

File tree

2 files changed

+43
-0
lines changed

2 files changed

+43
-0
lines changed
Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
---
2+
id: community_blocklist
3+
title: Community Blocklist
4+
sidebar_position: 3
5+
---
6+
7+
# Introduction
8+
9+
The "Community Blocklist" is a curated list of IP addresses identified as malicious by CrowdSec. CrowdSec proactively block the IP addresses of this blocklist, preventing malevolent IPs from reaching their systems.
10+
11+
12+
# Community Blocklist Variation and Eligibility
13+
14+
The rules are different for free and paying users:
15+
- Free users that **do** contribute get access to the `free blocklist`
16+
- Paying users get access to the `pro blocklist`, even if they don't contribute
17+
- Free users that **do not** contribute get the `degraded blocklist`
18+
19+
Regardless of the "tier" of blocklist you have access to (`degraded`, `free`, `pro`), each Security Engine gets a tailored blocklist based on the kind of signal they share with the network.
20+
21+
# Free Blocklist
22+
23+
Free users that are actively contributing to the network (sending signal on a regular basis) have their Security Engines automatically subscribed to the "free blocklist".
24+
25+
The content of the blocklist is unique to each Security Engine, as it mirrors the behaviours they report. For example, suppose you're running the Security Engine on a web server with WordPress. In that case, you will receive IPs performing generic attacks against web servers *and* IPs engaging in wordpress-specific attacks.
26+
27+
The `free` blocklist content is capped at 15 thousand IPs at once.
28+
29+
# Pro Blocklist
30+
31+
Paying users' blocklist contains IPs that mirror their installed scenarios, regardless of whether they report attacks for those.
32+
33+
The `pro` blocklist content has no size limit, unlike free users.
34+
35+
# Degraded Blocklist
36+
37+
Free users that are not actively contributing to the network or that have been flagged as cheating/abusing the system will receive a `degraded blocklist`. This Blocklist is capped at 3 thousand IPs.
38+
39+
40+
41+
42+

crowdsec-docs/sidebars.js

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -304,6 +304,7 @@
304304
id: "central_api/intro",
305305
},
306306
items: [
307+
"central_api/community_blocklist",
307308
{
308309
type: "link",
309310
label: "Swagger",

0 commit comments

Comments
 (0)