You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
- Combining classic WAF benefits with advanced CrowdSec features for otherwise difficult **advanced behavior detection**.
18
-
-**Full integration** with the Crowdsec software stack, including the console and remediation components.
15
+
-Low-effort **virtual patching** capabilities.
16
+
-Support for your legacy **ModSecurity** rules.
17
+
-Combining classic WAF benefits with advanced CrowdSec features for otherwise difficult **advanced behavior detection**.
18
+
-**Full integration** with the Crowdsec software stack, including the console and remediation components.
19
19
20
20
<!-- xx : links -->
21
21
22
22
This component capitalizes on existing remediation functions in web servers (such as Nginx, Traefik, Haproxy, etc.) to provide web application firewall capabilities.
23
23
24
-
24
+
25
25
26
-
1) The Web Server receives the HTTP request
27
-
2) The HTTP Request is intercepted and passed to the Crowdsec Security Engine via [the HTTP API](/appsec/protocol.md)
28
-
3) The Security Engine answers to the Web Server once the Appsec inband rules have been processed.
29
-
4) Based on the [Security Engine answer](/appsec/protocol#response-code), the Web Server either blocks the HTTP Request or processes it as usual
26
+
1. The Web Server receives the HTTP request
27
+
2. The HTTP Request is intercepted and passed to the Crowdsec Security Engine via [the HTTP API](/appsec/protocol.md)
28
+
3. The Security Engine answers to the Web Server once the Appsec inband rules have been processed.
29
+
4. Based on the [Security Engine answer](/appsec/protocol#response-code), the Web Server either blocks the HTTP Request or processes it as usual
30
30
31
31
## Inband Rules and Out-Of-Band Rules
32
32
33
33
The AppSec component relies on rules to inspect HTTP Requests:
34
-
- Inband rules are meant to interrupt request processing
35
-
- Out-Of-Band rules are non-blocking and are evaluated asynchronously
34
+
35
+
- Inband rules are meant to interrupt request processing
36
+
- Out-Of-Band rules are non-blocking and are evaluated asynchronously
36
37
37
38
### Inband rule processing
38
39
@@ -54,18 +55,18 @@ They are usually meant to detect unwanted behaviors that exhibit a repetitive as
54
55
55
56
When a request triggers one or more rules, either in the inband section (blocking) or out-of-band (non-blocking), several things happen:
56
57
57
-
- Inband (blocking) rules will appear in your `cscli alerts list` (and thus in your [console dashboard](https://app.crowdsec.net)).
58
-
- Inband and Out-Of-Band rules will trigger an internal crowdsec event that can be treated as any log lines.
58
+
-Inband (blocking) rules will appear in your `cscli alerts list` (and thus in your [console dashboard](https://app.crowdsec.net)).
59
+
-Inband and Out-Of-Band rules will trigger an internal crowdsec event that can be treated as any log lines.
59
60
60
61
This is meant to allow for scenarios to exploit the WAF rules events, such as blocking for a longer time an IP that clearly engages in malevolent activities, triggering several virtual patching rules.
61
62
62
63
## Next steps
63
64
64
65
Let's now start using this AppSec capabilities:
65
66
66
-
-**Installation**: [How to configure the Application Security Component with an existing remediation component](/appsec/installation.md)
67
-
-**Rules**: [How to read, write and debug rules](/appsec/rules_syntax.md)
68
-
-**Scenarios**: [How to create scenarios that leverage the AppSec Component events](#TODO)
69
-
-**Hooks**: [For advanced use let's talk about possible Hooks](/appsec/hooks.md)
70
-
-**Troubleshoot**: [How to troubleshoot the behavior of the AppSec Component](/appsec/troubleshooting.md)
71
-
-**AppSec Protocol**: [if you're maintaining or creating a remedation component and want to add the AppSec capabilities](/appsec/protocol.md)
67
+
-**Installation**: [How to configure the Application Security Component with an existing remediation component](/appsec/installation.md)
68
+
-**Rules**: [How to read, write and debug rules](/appsec/rules_syntax.md)
69
+
-**Scenarios**: [How to create scenarios that leverage the AppSec Component events](#TODO)
70
+
-**Hooks**: [For advanced use let's talk about possible Hooks](/appsec/hooks.md)
71
+
-**Troubleshoot**: [How to troubleshoot the behavior of the AppSec Component](/appsec/troubleshooting.md)
72
+
-**AppSec Protocol**: [if you're maintaining or creating a remedation component and want to add the AppSec capabilities](/appsec/protocol.md)
The [CrowdSec Security Engine](https://github.com/crowdsecurity/crowdsec) is an open-source, lightweight software that detects and blocks malicious actors from accessing your systems at various levels, using log and HTTP Requests analysis with threat patterns called scenarios.
21
12
22
13
CrowdSec is a modular security tool offering [behavior-based detection](https://app.crowdsec.net/hub/collections), including [AppSec rules](https://app.crowdsec.net/hub/appsec-rules), and optional components to block threats called [Remediation Components](https://app.crowdsec.net/hub/bouncers)
The crowd-sourced aspect allows the sharing of attacks they detected and blocked. Participants of this crowd-sourced threat intel receive, automatically via the security engine, a curated list of validated attackers (community blocklist) enhancing their real-time protection capabilities by taking preemptive actions against known threats.
35
27
36
-
37
-
38
28
## Main Features
39
29
40
30
In addition to the core "detect and react" mechanism, CrowdSec is committed to several other key aspects:
41
31
42
-
-**Easy Installation**: Effortless out-of-the-box installation on all [supported platforms](/getting_started/versions_matrix.md).
43
-
-**Simplified Daily Operations**: You have access to our Web UI administration via [CrowdSec's console](http://app.crowdsec.net) or the powerful [Command line tool cscli](/cscli/cscli.md) for effortless maintenance and keeping your detection mechanisms up-to-date.
44
-
-**Reproducibility**: The Security Engine can analyze not only live logs but also [cold logs](/u/user_guides/replay_mode), making it easier to detect potential false triggers, conduct forensic analysis, or generate reports.
45
-
-**Versatile**: The Security Engine can analyze [system logs](/docs/data_sources/intro) and [HTTP Requests](/docs/next/appsec/intro) to exhaustively protect your perimeter.
46
-
-**Observability**: Providing valuable insights into the system's activity:
47
-
- Users can view/manage alerts from the ([Console](https://app.crowdsec.net/signup)).
48
-
- Operations personnel have access to detailed Prometheus metrics ([Prometheus](/observability/prometheus.md)).
49
-
- Administrators can utilize a user-friendly command-line interface tool ([cscli](/observability/cscli.md)).
50
-
-**API-Centric**: All components communicate via an [HTTP API](/local_api/intro.md), facilitating multi-machine setups.
51
-
32
+
-**Easy Installation**: Effortless out-of-the-box installation on all [supported platforms](/getting_started/versions_matrix.md).
33
+
-**Simplified Daily Operations**: You have access to our Web UI administration via [CrowdSec's console](http://app.crowdsec.net) or the powerful [Command line tool cscli](/cscli/cscli.md) for effortless maintenance and keeping your detection mechanisms up-to-date.
34
+
-**Reproducibility**: The Security Engine can analyze not only live logs but also [cold logs](/u/user_guides/replay_mode), making it easier to detect potential false triggers, conduct forensic analysis, or generate reports.
35
+
-**Versatile**: The Security Engine can analyze [system logs](/docs/data_sources/intro) and [HTTP Requests](/docs/next/appsec/intro) to exhaustively protect your perimeter.
36
+
-**Observability**: Providing valuable insights into the system's activity:
37
+
- Users can view/manage alerts from the ([Console](https://app.crowdsec.net/signup)).
38
+
- Operations personnel have access to detailed Prometheus metrics ([Prometheus](/observability/prometheus.md)).
39
+
- Administrators can utilize a user-friendly command-line interface tool ([cscli](/observability/cscli.md)).
40
+
-**API-Centric**: All components communicate via an [HTTP API](/local_api/intro.md), facilitating multi-machine setups.
Under the hood, the Security Engine has various components:
62
-
63
-
- The Log Processor is in charge of detection: it analyzes logs from [various data sources](/docs/data_sources/intro) or [HTTP requests](/appsec/intro.md) from web servers.
64
-
-The [Appsec](/appsec/intro.md) feature is part of the Log Processor and filters HTTP Requests from the compatible web servers.
65
-
- The [Local API](/local_api/intro.md) acts as a middle man:
66
-
- Between the [Log Processors](/docs/data_sources/intro) and the [Remediation Components](/u/bouncers/intro) which are in charge of enforcing decisions.
67
-
- And with the [Central API](/central_api/intro.md) to share alerts and receive blocklists.
68
-
- The [Remediation Components](/u/bouncers/intro) - also known as bouncers - block malicious IPs at your chosen level—whether via IpTables, firewalls, web servers, or reverse proxies. [See the full list on our CrowdSec Hub.](https://app.crowdsec.net/hub/remediation-components)
51
+
52
+
- The Log Processor is in charge of detection: it analyzes logs from [various data sources](/docs/data_sources/intro) or [HTTP requests](/appsec/intro.md) from web servers.
53
+
-The [Appsec](/appsec/intro.md) feature is part of the Log Processor and filters HTTP Requests from the compatible web servers.
54
+
- The [Local API](/local_api/intro.md) acts as a middle man:
55
+
-Between the [Log Processors](/docs/data_sources/intro) and the [Remediation Components](/u/bouncers/intro) which are in charge of enforcing decisions.
56
+
-And with the [Central API](/central_api/intro.md) to share alerts and receive blocklists.
57
+
- The [Remediation Components](/u/bouncers/intro) - also known as bouncers - block malicious IPs at your chosen level—whether via IpTables, firewalls, web servers, or reverse proxies. [See the full list on our CrowdSec Hub.](https://app.crowdsec.net/hub/remediation-components)
69
58
70
59
## Deployment options
71
60
72
61
This architecture allows for both simple/standalone setups, or more distributed ones including as illustrated below:
73
62
74
-
- One or more machines? Run crowdsec on each (alongside with a remediation component)
75
-
- Already have a log pit (such as rsyslog or loki)? Run crowdsec next to it, not on the production workloads
76
-
- Running Kubernetes? Have a look at [our helm chart](/u/getting_started/installation/kubernetes)
77
-
- Running containers? The [docker data source](/docs/data_sources/docker) might be what you need
78
-
- Just looking for a WAF? Look at [our quickstart](/appsec/intro.md)
63
+
- One or more machines? Run crowdsec on each (alongside with a remediation component)
64
+
- Already have a log pit (such as rsyslog or loki)? Run crowdsec next to it, not on the production workloads
65
+
- Running Kubernetes? Have a look at [our helm chart](/u/getting_started/installation/kubernetes)
66
+
- Running containers? The [docker data source](/docs/data_sources/docker) might be what you need
67
+
- Just looking for a WAF? Look at [our quickstart](/appsec/intro.md)
0 commit comments