You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
2. Select the Discord server you want to link to your CrowdSec Console using the dropdown menu on top-tight of the page. Then select **Allow**. Repeat the process if you want to link more servers.
16
+
17
+
3. You should be redirected to the Discord integration page. You can now create a notification rule by navigating to the **Rules** tab.
Your Discord integration is now linked to your CrowdSec Console.
22
+
23
+
## Create a notification rule
24
+
25
+
1. In the [CrowdSec Console](https://app.crowdsec.net), navigate to **Settings > Integrations > Discord** go to the Rules tab and click on **Add rule**.
26
+
27
+
2. Follow the steps in the [Create a notification rule](/u/console/notification_integrations/rule) documentation to create your rule.
Copy file name to clipboardExpand all lines: crowdsec-docs/versioned_docs/version-v1.6.0/appsec/quickstart.md
+22-25Lines changed: 22 additions & 25 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -4,8 +4,6 @@ title: Quickstart
4
4
sidebar_position: 2
5
5
---
6
6
7
-
## Objectives
8
-
9
7
The goal of this quickstart is to set up the [AppSec Component](appsec/intro.md#introduction) to safeguard web applications running on [Nginx](https://nginx.com). We'll deploy a [set of rules](https://app.crowdsec.net/hub/author/crowdsecurity/collections/appsec-virtual-patching) designed to block [well-known attacks](https://app.crowdsec.net/hub/author/crowdsecurity/collections/appsec-generic-rules) and [currently exploited vulnerabilities](https://app.crowdsec.net/hub/author/crowdsecurity/collections/appsec-virtual-patching). Additionally, we'll show how to monitor these alerts through the [console](https://app.crowdsec.net/).
Executing this command will install the following items:
38
36
39
-
- The [*AppSec Rules*](/appsec/rules_syntax.md) contain the definition of malevolent requests to be matched and stopped
40
-
- The [*AppSec configuration*](/appsec/configuration.md#appsec-configuration) links together a set of rules to provide a coherent set
41
-
- The [*CrowdSec Parser*](/concepts.md#parsers) and [*CrowdSec Scenario(s)*](/concepts.md#scenarios) bans for a longer duration repeating offenders
37
+
- The [_AppSec Rules_](/appsec/rules_syntax.md) contain the definition of malevolent requests to be matched and stopped
38
+
- The [_AppSec configuration_](/appsec/configuration.md#appsec-configuration) links together a set of rules to provide a coherent set
39
+
- The [_CrowdSec Parser_](/concepts.md#parsers) and [_CrowdSec Scenario(s)_](/concepts.md#scenarios) bans for a longer duration repeating offenders
42
40
43
41
### Setup the acquisition
44
42
45
43
Having installed the required components, it's time to configure the CrowdSec [Acquisition](/concepts.md#acquisition) to connect the Application Security Component with our Nginx web server. This configuration allows our Nginx server to send requests to the AppSec Component for evaluation and decision-making.
46
44
47
-
- Create the `/etc/crowdsec/acquis.d/` directory with `mkdir -p /etc/crowdsec/acquis.d/` (if it doesn't exist on your machine)
48
-
- Put the following content in `/etc/crowdsec/acquis.d/appsec.yaml` :
45
+
- Create the `/etc/crowdsec/acquis.d/` directory with `mkdir -p /etc/crowdsec/acquis.d/` (if it doesn't exist on your machine)
46
+
- Put the following content in `/etc/crowdsec/acquis.d/appsec.yaml` :
The two important directives in this configuration file are:
59
57
60
-
- `appsec_config` is the name of the [*AppSec configuration*](/appsec/configuration.md#appsec-configuration) that was included in the [collection](/concepts.md#collections) we just installed.
61
-
- the `listen_addr` is the IP and port the AppSec Component will listen to.
58
+
- `appsec_config` is the name of the [_AppSec configuration_](/appsec/configuration.md#appsec-configuration) that was included in the [collection](/concepts.md#collections) we just installed.
59
+
- the `listen_addr` is the IP and port the AppSec Component will listen to.
62
60
63
61
:::info
64
62
You can find more about the [supported options for the acquisition here](/data_sources/appsec.md)
With our AppSec Component active within CrowdSec, it's time to configure the remediation component to forward requests to it.
@@ -148,8 +145,6 @@ To setup forwarding of requests in the Nginx remediation component, we'll modify
148
145
APPSEC_URL=http://127.0.0.1:7422
149
146
```
150
147
151
-
152
-
153
148
This instructs our Nginx plugin (the remediation component) to communicate with the AppSec Component at `http://127.0.0.1:7422`. Once configured, all incoming HTTP requests will be sent there for analysis. The snippet above assumes that the AppSec Component is running on the same machine.
154
149
155
150
We can now restart the service:
@@ -169,8 +164,9 @@ if now try to access `http://localhost/.env` from a browser, our If you now atte
169
164

170
165
171
166
We can also look at the metrics from `cscli metrics`. Amongst other things, it will show:
172
-
- the number of requests processed by the AppSec Component
173
-
- Individual rule matches
167
+
168
+
- the number of requests processed by the AppSec Component
1. We did a request (`localhost/.env`) to our local nginx webserver
205
-
2. Nginx, thanks to the Remediation Component configuration, forwarded the request to `http://127.0.0.1:7422`
206
-
3. Our AppSec Component, listening on `http://127.0.0.1:7422` analyzed the request
207
-
4. The request matches the [AppSec rule to detect .env access](https://app.crowdsec.net/hub/author/crowdsecurity/appsec-rules/vpatch-env-access)
208
-
5. The AppSec Component thus answered with [HTTP 403](https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/403) to Nginx, indicating that the request must be blocked
209
-
6. Nginx presented us with the default "request blocked" page provided by the Remediation Component
200
+
1. We did a request (`localhost/.env`) to our local nginx webserver
201
+
2. Nginx, thanks to the Remediation Component configuration, forwarded the request to `http://127.0.0.1:7422`
202
+
3. Our AppSec Component, listening on `http://127.0.0.1:7422` analyzed the request
203
+
4. The request matches the [AppSec rule to detect .env access](https://app.crowdsec.net/hub/author/crowdsecurity/appsec-rules/vpatch-env-access)
204
+
5. The AppSec Component thus answered with [HTTP 403](https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/403) to Nginx, indicating that the request must be blocked
205
+
6. Nginx presented us with the default "request blocked" page provided by the Remediation Component
210
206
211
207
## Integration with the console
212
208
213
209
<!-- fix link to this guide once done -->
210
+
214
211
If you haven't yet, follow the guide about [how to enroll your Security Engine in the console](/docs/getting_started/install_crowdsec).
215
212
216
213
Once done, all your alerts, including the ones generated by the AppSec Component, are going to appear in the console:
217
214
218
215

219
216
220
-
221
217
## Next steps
222
218
223
219
You are now running the AppSec Component on your Crowdsec Security Engine, congrats!
224
220
225
221
As the next steps, you can:
226
-
- [Explore the hub](https://hub.crowdsec.net) to find more rules for your use case
227
-
- Look at the [Rules syntax](/appsec/rules_syntax.md) and [creation process](/appsec/create_rules.md) to create your own and contribute
228
-
- Take a look at [the benchmarks](/appsec/benchmark.md)
222
+
223
+
- [Explore the hub](https://hub.crowdsec.net) to find more rules for your use case
224
+
- Look at the [Rules syntax](/appsec/rules_syntax.md) and [creation process](/appsec/create_rules.md) to create your own and contribute
225
+
- Take a look at [the benchmarks](/appsec/benchmark.md)
0 commit comments