@@ -15,6 +15,63 @@ You can find the default configurations on our GitHub repository:
1515
1616[ Windows default configuration] ( https://github.com/crowdsecurity/crowdsec/blob/master/config/config_win.yaml )
1717
18+ ## Common configuration directories & paths
19+
20+ ### ` /etc/crowdsec/ `
21+
22+ All CrowdSec configuration are living in this directory.
23+
24+ ### ` /etc/crowdsec/config.yaml `
25+
26+ Main configuration file for Log Processor and Local API.
27+
28+ ### ` /etc/crowdsec/acquis.d ` and ` /etc/crowdsec/acquis.yaml `
29+
30+ Documents which log sources and datasources are processed by the Log Processor.
31+
32+ ` /etc/crowdsec/acquis.yaml ` is the historical acquisition configuration file.
33+ ` /etc/crowdsec/acquis.d/*.yaml ` is prefered when possible.
34+
35+ ### ` /etc/crowdsec/bouncers/*.yaml `
36+
37+ Individual configuration file for bouncers.
38+
39+ ### ` /etc/crowdsec/collections/*.yaml `
40+
41+ Collections currently installed on the Log Processor.
42+
43+ ### ` /etc/crowdsec/console.yaml `
44+
45+ Console specific flags to enable/disable manual decisions management, alert context sharing.
46+
47+ ### ` /etc/crowdsec/contexts/*.yaml `
48+
49+ Enabled alert context for Local API and Log Processor.
50+
51+ ### ` /etc/crowdsec/hub/ `
52+
53+ Local Hub Mirror.
54+
55+ ### ` /etc/crowdsec/local_api_credentials.yaml ` and ` /etc/crowdsec/online_api_credentials.yaml `
56+
57+ Credentials for Local API and Central API.
58+
59+ ### ` /etc/crowdsec/parsers `
60+
61+ Contains all parsers enabled on the Log Processor, organised in stages:
62+ - ` /etc/crowdsec/parsers/s00-raw/*.yaml ` : parsers for based formats such as syslog.
63+ - ` /etc/crowdsec/parsers/s01-parse/*.yaml ` : service specific parsers such as nginx or ssh.
64+ - ` /etc/crowdsec/parsers/s02-enrich/*.yaml ` : enrichment parsers and whitelists.
65+
66+ ### ` /etc/crowdsec/scenarios `
67+
68+ Contains all scenarios enabled on the Log Processor.
69+
70+ ### ` /etc/crowdsec/profiles.yaml `
71+
72+ Contains profiles used by Local API to eventually turn alerts into decisions or dispatch them to notification plugins.
73+
74+
1875## Environment variables
1976
2077It is possible to set configuration values based on environment variables.
0 commit comments