diff --git a/crowdsec-docs/docusaurus.config.ts b/crowdsec-docs/docusaurus.config.ts index 73cbeea32..0aeccb9b8 100644 --- a/crowdsec-docs/docusaurus.config.ts +++ b/crowdsec-docs/docusaurus.config.ts @@ -86,14 +86,7 @@ const NAVBAR_ITEMS: NavbarItem[] = [ position: "left", label: "Blocklists", }, - { - label: "API(s)", - position: "left", - items: [ - { label: "CTI API", to: "/u/cti_api/getting_started" }, - { label: "Service API 🏅", to: "/u/service_api/getting_started" }, - ], - }, + { to: "/u/cti_api/intro", position: "left", label: "CTI" }, { to: "/u/console/intro", position: "left", label: "Console" }, { label: "Resources", @@ -147,6 +140,8 @@ const FOOTER_LINKS = [ { label: "Discourse", href: "https://discourse.crowdsec.net/" }, { label: "Discord", href: "https://discord.gg/crowdsec" }, { label: "Twitter", href: "https://twitter.com/crowd_security" }, + { label: "LinkedIn", href: "https://www.linkedin.com/company/crowdsec/" }, + { label: "YouTube", href: "https://www.youtube.com/@crowdsec" }, ], }, { @@ -159,6 +154,8 @@ const FOOTER_LINKS = [ label: "Tutorial", href: "https://crowdsec.net/blog/category/tutorial/", }, + { label: "Academy", href: "https://academy.crowdsec.net/" }, + { label: "Custom GPT", href: "https://chatgpt.com/g/g-682c3a61a78081918417571116c2b563-crowdsec-documentation" }, ], }, ]; @@ -182,11 +179,11 @@ const redirects = [ to: "/u/getting_started/installation/freebsd", }, { - from: "/docs/next/getting_started/install_crowdsec", + from: "/docs/getting_started/install_crowdsec", to: "/u/getting_started/installation/linux", }, { - from: "/docs/next/getting_started/install_crowdsec_freebsd", + from: "/docs/getting_started/install_crowdsec_freebsd", to: "/u/getting_started/installation/freebsd", }, ]; @@ -306,6 +303,7 @@ const config: Config = { sidebarPath: "./sidebarsUnversioned.ts", }, ], + ["./plugins/gtag/index.ts", { trackingID: "G-0TFBMNTDFQ" }], ["@docusaurus/plugin-client-redirects", { redirects }], tailwindPlugin, diff --git a/crowdsec-docs/sidebarsUnversioned.ts b/crowdsec-docs/sidebarsUnversioned.ts index a02b71324..fc945a1f0 100644 --- a/crowdsec-docs/sidebarsUnversioned.ts +++ b/crowdsec-docs/sidebarsUnversioned.ts @@ -9,59 +9,96 @@ const sidebarsUnversionedConfig: SidebarConfig = { label: "Introduction", id: "cti_api/intro", }, - { - type: "doc", - label: "Getting Started", - id: "cti_api/getting_started", - }, { type: "category", - label: "Taxonomy", + label: "Web UI", items: [ - "cti_api/taxonomy/intro", - "cti_api/taxonomy/cti_object", - "cti_api/taxonomy/scores", - "cti_api/taxonomy/scenarios", - "cti_api/taxonomy/behaviors", - "cti_api/taxonomy/classifications", - "cti_api/taxonomy/false_positives", - "cti_api/taxonomy/benign", + { + type: "doc", + label: "Getting Started", + id: "cti_api/getting_started", + }, + { + type: "doc", + label: "IP Report", + id: "cti_api/ip_report", + }, + { + type: "doc", + label: "Advanced Search", + id: "cti_api/advanced_search", + }, + { + type: "doc", + label: "Search Queries", + id: "cti_api/search_queries", + }, + { + type: "doc", + label: "CVE Explorer", + id: "cti_api/cve_explorer", + }, ], }, { - type: "link", - label: "Swagger", - href: "https://crowdsecurity.github.io/cti-api/", + type: "category", + label: "API", + items: [ + { + type: "doc", + label: "Getting Started", + id: "cti_api/api_getting_started", + }, + { + type: "category", + label: "Taxonomy", + items: [ + "cti_api/taxonomy/intro", + "cti_api/taxonomy/cti_object", + "cti_api/taxonomy/scores", + "cti_api/taxonomy/scenarios", + "cti_api/taxonomy/behaviors", + "cti_api/taxonomy/classifications", + "cti_api/taxonomy/false_positives", + "cti_api/taxonomy/benign", + ], + }, + { + type: "link", + label: "Swagger", + href: "https://crowdsecurity.github.io/cti-api/", + }, + ], }, { type: "category", label: "Integrations", link: { type: "doc", - id: "cti_api/integration_intro", + id: "cti_api/api_integration/integration_intro", }, items: [ - "cti_api/integration_ipdex", - "cti_api/integration_chrome", - "cti_api/integration_gigasheet", - "cti_api/integration_intelowl", - "cti_api/integration_maltego", - "cti_api/integration_misp", - "cti_api/integration_msticpy", - "cti_api/integration_opencti", - "cti_api/integration_paloalto_xsoar", - "cti_api/integration_qradar", - "cti_api/integration_securitycopilot", - "cti_api/integration_sekoia_xdr", - "cti_api/integration_splunk_siem", - "cti_api/integration_splunk_soar", - "cti_api/integration_thehive", + "cti_api/api_integration/integration_ipdex", + "cti_api/api_integration/integration_chrome", + "cti_api/api_integration/integration_gigasheet", + "cti_api/api_integration/integration_intelowl", + "cti_api/api_integration/integration_maltego", + "cti_api/api_integration/integration_misp", + "cti_api/api_integration/integration_msticpy", + "cti_api/api_integration/integration_opencti", + "cti_api/api_integration/integration_paloalto_xsoar", + "cti_api/api_integration/integration_qradar", + "cti_api/api_integration/integration_securitycopilot", + "cti_api/api_integration/integration_sekoia_xdr", + "cti_api/api_integration/integration_splunk_siem", + "cti_api/api_integration/integration_splunk_soar", + "cti_api/api_integration/integration_thehive", ], }, { type: "doc", - label: "Search Queries", - id: "cti_api/search_queries", + label: "FAQ", + id: "cti_api/faq", }, ], consoleSidebar: [ @@ -196,42 +233,6 @@ const sidebarsUnversionedConfig: SidebarConfig = { label: "Remediation Metrics", id: "console/remediation_metrics", }, - { - type: "category", - label: "CTI", - items: [ - { - type: "doc", - label: "Getting started", - id: "console/cti/getting_started", - }, - { - type: "doc", - label: "CTI API Keys", - id: "console/cti/cti_api_keys", - }, - { - type: "doc", - label: "IP report", - id: "console/cti/ip_report", - }, - { - type: "doc", - label: "Advanced search", - id: "console/cti/advanced_search", - }, - { - type: "doc", - label: "CVE Explorer", - id: "console/cti/cve_explorer", - }, - { - type: "doc", - label: "FAQ", - id: "console/cti/faq", - }, - ], - }, { type: "category", label: "Decision", @@ -293,11 +294,84 @@ const sidebarsUnversionedConfig: SidebarConfig = { }, { type: "link", + label: "CTI", + href: "/u/cti_api/intro", + }, + { + type: "category", label: "Service API", - href: "/u/service_api/getting_started", customProps: { tag: "premium", }, + items: [ + { + type: "doc", + id: "console/service_api/getting_started", + label: "Getting Started", + customProps: { + tag: "premium", + }, + }, + { + type: "category", + label: "Quickstart", + customProps: { + tag: "premium", + }, + items: [ + "console/service_api/quickstart/authentication", + "console/service_api/quickstart/blocklists", + "console/service_api/quickstart/integrations", + "console/service_api/quickstart/allowlists", + "console/service_api/quickstart/metrics", + ], + }, + { + type: "doc", + label: "Blocklists", + id: "console/service_api/blocklists", + }, + { + type: "doc", + label: "Integrations", + id: "console/service_api/integrations", + }, + { + type: "category", + label: "SDKs", + customProps: { + tag: "premium", + }, + items: [ + { + type: "doc", + label: "Python", + id: "console/service_api/sdks/python", + customProps: { + tag: "premium", + }, + }, + ], + }, + { + type: "link", + label: "Swagger", + href: "https://admin.api.crowdsec.net/v1/docs#/", + }, + { + type: "link", + label: "Redoc", + href: "https://admin.api.crowdsec.net/v1/redoc", + }, + { + type: "doc", + id: "console/service_api/faq", + label: "FAQ", + customProps: { + tag: "premium", + }, + }, + ], }, { type: "category", @@ -533,50 +607,7 @@ const sidebarsUnversionedConfig: SidebarConfig = { label: "CTI", }, ], - serviceApiSideBar: [ - { - type: "doc", - id: "service_api/getting_started", - label: "Getting Started", - }, - { - type: "category", - label: "Quickstart", - items: [ - "service_api/quickstart/authentication", - "service_api/quickstart/blocklists", - "service_api/quickstart/integrations", - "service_api/quickstart/allowlists", - "service_api/quickstart/metrics", - ], - }, - { - type: "category", - label: "SDKs", - items: [ - { - type: "doc", - label: "Python", - id: "service_api/sdks/python", - }, - ], - }, - { - type: "link", - label: "Swagger", - href: "https://admin.api.crowdsec.net/v1/docs#/", - }, - { - type: "link", - label: "Redoc", - href: "https://admin.api.crowdsec.net/v1/redoc", - }, - { - type: "doc", - id: "service_api/faq", - label: "FAQ", - }, - ], + guidesSideBar: [ "user_guides/intro", { @@ -705,7 +736,6 @@ export const { remediationSideBar, blocklistsSideBar, troubleshootingSideBar, - serviceApiSideBar, guidesSideBar, gettingStarted, } = sidebarsUnversionedConfig; diff --git a/crowdsec-docs/src/components/console-promo.tsx b/crowdsec-docs/src/components/console-promo.tsx index d32e5c091..58bd143aa 100644 --- a/crowdsec-docs/src/components/console-promo.tsx +++ b/crowdsec-docs/src/components/console-promo.tsx @@ -6,21 +6,21 @@ import React from "react"; const ConsolePromo = ({ ...props }): React.JSX.Element => { const url = useBaseUrl(`/img/${props.image}`); return ( - - {props.title ?

{props.title}

: null} - -
- {props.description ?

{props.description}

: null} -
+ + {props.title ?

{props.title}

: null} + +
+ {props.description ?

{props.description}

: null} +
- {props.image ? {props.title} : null} + {props.image ? {props.title} : null} ); diff --git a/crowdsec-docs/src/components/home-page/get-to-know-us.tsx b/crowdsec-docs/src/components/home-page/get-to-know-us.tsx index d984afc2f..7fa131fd7 100644 --- a/crowdsec-docs/src/components/home-page/get-to-know-us.tsx +++ b/crowdsec-docs/src/components/home-page/get-to-know-us.tsx @@ -1,3 +1,5 @@ +import useBaseUrl from "@docusaurus/useBaseUrl"; +import ThemedImage from "@theme/ThemedImage"; import React from "react"; import { HomePageItem } from "./home-item"; @@ -19,7 +21,7 @@ const staticData: StaticData[] = [ icon: () => security engines, title: "Security Engines", description: "Secure yourself.", - link: "/docs/intro", + link: "/u/getting_started/intro", }, { icon: () => 🖥️, @@ -31,13 +33,13 @@ const staticData: StaticData[] = [ icon: () => 🧑🏻‍💻, title: "CrowdSec CLI", description: "Use our command line interface.", - link: "/docs/cscli/", + link: "/docs/next/cscli/", }, { icon: () => Web application firewall, title: "CrowdSec WAF", description: "Protect your web applications.", - link: "/docs/appsec/intro", + link: "/docs/next/appsec/intro", }, { icon: () => blocklists, @@ -51,13 +53,27 @@ const staticData: StaticData[] = [ description: "Integrate with your tools.", link: "/u/cti_api/intro", }, + { + icon: () => ( + + ), + title: "Custom GPT", + description: "Get help from our custom documentation GPT.", + link: "https://chatgpt.com/g/g-682c3a61a78081918417571116c2b563-crowdsec-documentation", + }, ]; const GetToKnowUs = (): React.JSX.Element => { return (
-

Get to know us!

- +

Get to know us!

{ icon={staticData[0].icon} />
- {staticData.slice(1, staticData.length).map((props) => ( + {staticData.slice(1, staticData.length - 1).map((props) => ( { key={props.title} /> ))} +
+ +
); diff --git a/crowdsec-docs/src/components/home-page/home-item.tsx b/crowdsec-docs/src/components/home-page/home-item.tsx index 8fe21e553..b44d19f78 100644 --- a/crowdsec-docs/src/components/home-page/home-item.tsx +++ b/crowdsec-docs/src/components/home-page/home-item.tsx @@ -14,10 +14,10 @@ export const HomePageItem = (props: Props): React.JSX.Element => (
- + {(!Array.isArray(props.icon) && ) || } diff --git a/crowdsec-docs/src/components/home-page/quick-start.tsx b/crowdsec-docs/src/components/home-page/quick-start.tsx index 6d2756f39..8234bdb44 100644 --- a/crowdsec-docs/src/components/home-page/quick-start.tsx +++ b/crowdsec-docs/src/components/home-page/quick-start.tsx @@ -1,3 +1,5 @@ +import ForwardIcon from "@mui/icons-material/Forward"; +import HubIcon from "@mui/icons-material/Hub"; import cibApple from "@site/static/img/logo/apple-colored.svg"; import cibDocker from "@site/static/img/logo/docker-colored.svg"; import cibFreebsd from "@site/static/img/logo/freebsd-colored.svg"; @@ -14,9 +16,10 @@ type StaticData = { icon: React.ComponentType>; text: string; link: string; + description?: string; }; -const staticData: StaticData[] = [ +const singleServerSetup: StaticData[] = [ { icon: cibLinux, text: "Linux", @@ -70,6 +73,21 @@ const staticData: StaticData[] = [ // }, ]; +const multiServerSetup: StaticData[] = [ + { + icon: HubIcon, + text: "Central LAPI", + link: "/u/user_guides/multiserver_setup", + description: "Use a single LAPI to collect alerts.", + }, + { + icon: ForwardIcon, + text: "Log Centralization", + link: "/u/user_guides/log_centralization", + description: "Use Rsyslog to centralize logs.", + }, +]; + const QuickStart = (): React.JSX.Element => { return (
@@ -78,15 +96,32 @@ const QuickStart = (): React.JSX.Element => {

We can secure your stack. Just select your platform and get started.

+
+

Single Server Setup

+

+ Install CrowdSec on a single server. This is the simplest way to get started with CrowdSec. +

+
- {staticData.map((props) => ( + {singleServerSetup.map((props) => ( ))}
-

+

*Logos and trademarks, such as the logos above, are the property of their respective owners and are used here for identification purposes only.

+
+

Multi-Server Setup

+

+ Use CrowdSec within a multi-server environment. This is the advanced way to get started. +

+
+
+ {multiServerSetup.map((props) => ( + + ))} +
); }; diff --git a/crowdsec-docs/src/css/navbar.css b/crowdsec-docs/src/css/navbar.css index 8fc1200ee..8d5ca217a 100644 --- a/crowdsec-docs/src/css/navbar.css +++ b/crowdsec-docs/src/css/navbar.css @@ -42,6 +42,7 @@ html[data-theme="light"] .navbar-sidebar__item > .menu__list .menu__caret::befor content: "Discord"; padding-left: 1.5rem !important; padding-right: 0 !important; + color: white; background: no-repeat left / 22% url("data:image/svg+xml,%3C%3Fxml%20version%3D%221.0%22%3F%3E%3Csvg%20fill%3D%22%23ffffff%22%20xmlns%3D%22http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%22%20%20viewBox%3D%220%200%2024%2024%22%20width%3D%2224px%22%20height%3D%2224px%22%3E%20%20%20%20%3Cpath%20d%3D%22M19.952%2C5.672c-1.904-1.531-4.916-1.79-5.044-1.801c-0.201-0.017-0.392%2C0.097-0.474%2C0.281%20c-0.006%2C0.012-0.072%2C0.163-0.145%2C0.398c1.259%2C0.212%2C2.806%2C0.64%2C4.206%2C1.509c0.224%2C0.139%2C0.293%2C0.434%2C0.154%2C0.659%20c-0.09%2C0.146-0.247%2C0.226-0.407%2C0.226c-0.086%2C0-0.173-0.023-0.252-0.072C15.584%2C5.38%2C12.578%2C5.305%2C12%2C5.305S8.415%2C5.38%2C6.011%2C6.872%20c-0.225%2C0.14-0.519%2C0.07-0.659-0.154c-0.14-0.225-0.07-0.519%2C0.154-0.659c1.4-0.868%2C2.946-1.297%2C4.206-1.509%20c-0.074-0.236-0.14-0.386-0.145-0.398C9.484%2C3.968%2C9.294%2C3.852%2C9.092%2C3.872c-0.127%2C0.01-3.139%2C0.269-5.069%2C1.822%20C3.015%2C6.625%2C1%2C12.073%2C1%2C16.783c0%2C0.083%2C0.022%2C0.165%2C0.063%2C0.237c1.391%2C2.443%2C5.185%2C3.083%2C6.05%2C3.111c0.005%2C0%2C0.01%2C0%2C0.015%2C0%20c0.153%2C0%2C0.297-0.073%2C0.387-0.197l0.875-1.202c-2.359-0.61-3.564-1.645-3.634-1.706c-0.198-0.175-0.217-0.477-0.042-0.675%20c0.175-0.198%2C0.476-0.217%2C0.674-0.043c0.029%2C0.026%2C2.248%2C1.909%2C6.612%2C1.909c4.372%2C0%2C6.591-1.891%2C6.613-1.91%20c0.198-0.172%2C0.5-0.154%2C0.674%2C0.045c0.174%2C0.198%2C0.155%2C0.499-0.042%2C0.673c-0.07%2C0.062-1.275%2C1.096-3.634%2C1.706l0.875%2C1.202%20c0.09%2C0.124%2C0.234%2C0.197%2C0.387%2C0.197c0.005%2C0%2C0.01%2C0%2C0.015%2C0c0.865-0.027%2C4.659-0.667%2C6.05-3.111%20C22.978%2C16.947%2C23%2C16.866%2C23%2C16.783C23%2C12.073%2C20.985%2C6.625%2C19.952%2C5.672z%20M8.891%2C14.87c-0.924%2C0-1.674-0.857-1.674-1.913%20s0.749-1.913%2C1.674-1.913s1.674%2C0.857%2C1.674%2C1.913S9.816%2C14.87%2C8.891%2C14.87z%20M15.109%2C14.87c-0.924%2C0-1.674-0.857-1.674-1.913%20s0.749-1.913%2C1.674-1.913c0.924%2C0%2C1.674%2C0.857%2C1.674%2C1.913S16.033%2C14.87%2C15.109%2C14.87z%22%2F%3E%3C%2Fsvg%3E"); @@ -51,6 +52,7 @@ html[data-theme="light"] .navbar-sidebar__item > .menu__list .menu__caret::befor content: "GitHub"; padding-left: 1.5rem !important; padding-right: 0 !important; + color: white; background: no-repeat left / 22% url("data:image/svg+xml,%3Csvg viewBox='0 0 24 24' xmlns='http://www.w3.org/2000/svg'%3E%3Cpath fill='white' d='M12 .297c-6.63 0-12 5.373-12 12 0 5.303 3.438 9.8 8.205 11.385.6.113.82-.258.82-.577 0-.285-.01-1.04-.015-2.04-3.338.724-4.042-1.61-4.042-1.61C4.422 18.07 3.633 17.7 3.633 17.7c-1.087-.744.084-.729.084-.729 1.205.084 1.838 1.236 1.838 1.236 1.07 1.835 2.809 1.305 3.495.998.108-.776.417-1.305.76-1.605-2.665-.3-5.466-1.332-5.466-5.93 0-1.31.465-2.38 1.235-3.22-.135-.303-.54-1.523.105-3.176 0 0 1.005-.322 3.3 1.23.96-.267 1.98-.399 3-.405 1.02.006 2.04.138 3 .405 2.28-1.552 3.285-1.23 3.285-1.23.645 1.653.24 2.873.12 3.176.765.84 1.23 1.91 1.23 3.22 0 4.61-2.805 5.625-5.475 5.92.42.36.81 1.096.81 2.22 0 1.606-.015 2.896-.015 3.286 0 .315.21.69.825.57C20.565 22.092 24 17.592 24 12.297c0-6.627-5.373-12-12-12'/%3E%3C/svg%3E"); @@ -60,6 +62,7 @@ html[data-theme="light"] .navbar-sidebar__item > .menu__list .menu__caret::befor content: "Forum"; padding-left: 1.5rem !important; padding-right: 0 !important; + color: white; background: no-repeat left / 22% url("data:image/svg+xml,%3Csvg%20xmlns%3D%22http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%22%20xmlns%3Axlink%3D%22http%3A%2F%2Fwww.w3.org%2F1999%2Fxlink%22%20width%3D%2222%22%20height%3D%2222%22%20preserveAspectRatio%3D%22xMidYMid%20meet%22%20viewBox%3D%220%200%2024%2024%22%3E%3Cpath%20d%3D%22M12.077%203C7.149%203%203%206.96%203%2011.843V21l9.075-.01c4.928%200%208.925-4.11%208.925-8.993C21%207.113%2017%203%2012.077%203zm3.92%2012.859a5.568%205.568%200%200%201-6.102%201.043l-3.595.805l1.001-3.192a5.435%205.435%200%200%201%20.11-5.415a5.55%205.55%200%200%201%204.753-2.678v.001h.006a5.533%205.533%200%200%201%205.131%203.438a5.442%205.442%200%200%201-1.304%205.998z%22%20fill%3D%22white%22%2F%3E%3C%2Fsvg%3E"); diff --git a/crowdsec-docs/src/pages/index.tsx b/crowdsec-docs/src/pages/index.tsx index f6337999b..f550d70ae 100644 --- a/crowdsec-docs/src/pages/index.tsx +++ b/crowdsec-docs/src/pages/index.tsx @@ -21,16 +21,24 @@ const HomePageHeader = (): React.JSX.Element => {
CrowdSec Logo
-
- - - - - - - - +
+ + +
+ + + + + + +
diff --git a/crowdsec-docs/static/img/icons/OpenAI-black-monoblossom.svg b/crowdsec-docs/static/img/icons/OpenAI-black-monoblossom.svg new file mode 100644 index 000000000..832fa6a5f --- /dev/null +++ b/crowdsec-docs/static/img/icons/OpenAI-black-monoblossom.svg @@ -0,0 +1,15 @@ + + + + + + + + + + + + + + + diff --git a/crowdsec-docs/static/img/icons/OpenAI-white-monoblossom.svg b/crowdsec-docs/static/img/icons/OpenAI-white-monoblossom.svg new file mode 100644 index 000000000..ba36fc2aa --- /dev/null +++ b/crowdsec-docs/static/img/icons/OpenAI-white-monoblossom.svg @@ -0,0 +1,15 @@ + + + + + + + + + + + + + + + diff --git a/crowdsec-docs/unversioned/console/cti/cti_api_keys.mdx b/crowdsec-docs/unversioned/console/cti/cti_api_keys.mdx deleted file mode 100644 index 8b6eba0db..000000000 --- a/crowdsec-docs/unversioned/console/cti/cti_api_keys.mdx +++ /dev/null @@ -1,51 +0,0 @@ ---- -title: CTI API Keys -description: What can you access in the CTI API ---- - -import AcademyPromo from '@site/src/components/academy-promo'; -import ThemedImage from "@theme/ThemedImage"; -import useBaseUrl from "@docusaurus/useBaseUrl"; - -This section will describe how to access to our CTI API and the [different plans available](#ip-lookup-plans). -If you want to know more about the CTI API itself, you can check the [CTI API documentation](/u/cti_api/getting_started). - -# Creating a CTI API Key - -You can create a CTI API key via the **+** short cut on the top right corner that will lead you to the CrowdSec Console settings, CTI API Key section. - -![CTI API Key Creation](/img/console/cti/cti_api_create_key.png) - - - -# CTI Plans - -The CTI API contains multiple endpoints that are not all accessible with any plan. -You can check the Swagger [There ↗️](https://crowdsecurity.github.io/cti-api/). - -The different plans are the following: - -## Ip Lookup Plans -Those CTI API plans give you access to the search by IP and search query endpoints. -They return CrowdSec CTI enriched information about IPS. -IP returned will consume one token from your quota. - -The CTI endpoint accessible with those keys are: -`/smoke/{ip}` and `/smoke/search` - -The plans quotas are the following: -* Community CTI API Key (**1 free key** with a console account): **50 token/day** -* Extended CTI API Key: [Contact us to activate an extended key for additional quota ↗️](https://www.crowdsec.net/contact-threat-intelligence-subscription) - -## Advanced plans -Those CTI API plans extend access to all CTI API endpoints: -* `/smoke` : Allowing batch IP lookup -* `/fire` : To stream all enriched IPs from our CrowdSec Intelligence Blocklist - -[Contact us to activate an extended key for additional quota ↗️](https://www.crowdsec.net/contact-threat-intelligence-subscription) \ No newline at end of file diff --git a/crowdsec-docs/unversioned/service_api/blocklists.md b/crowdsec-docs/unversioned/console/service_api/blocklists.md similarity index 100% rename from crowdsec-docs/unversioned/service_api/blocklists.md rename to crowdsec-docs/unversioned/console/service_api/blocklists.md diff --git a/crowdsec-docs/unversioned/service_api/faq.md b/crowdsec-docs/unversioned/console/service_api/faq.md similarity index 100% rename from crowdsec-docs/unversioned/service_api/faq.md rename to crowdsec-docs/unversioned/console/service_api/faq.md diff --git a/crowdsec-docs/unversioned/service_api/getting_started.mdx b/crowdsec-docs/unversioned/console/service_api/getting_started.mdx similarity index 100% rename from crowdsec-docs/unversioned/service_api/getting_started.mdx rename to crowdsec-docs/unversioned/console/service_api/getting_started.mdx diff --git a/crowdsec-docs/unversioned/service_api/integrations.md b/crowdsec-docs/unversioned/console/service_api/integrations.md similarity index 100% rename from crowdsec-docs/unversioned/service_api/integrations.md rename to crowdsec-docs/unversioned/console/service_api/integrations.md diff --git a/crowdsec-docs/unversioned/service_api/quickstart/allowlists.mdx b/crowdsec-docs/unversioned/console/service_api/quickstart/allowlists.mdx similarity index 100% rename from crowdsec-docs/unversioned/service_api/quickstart/allowlists.mdx rename to crowdsec-docs/unversioned/console/service_api/quickstart/allowlists.mdx diff --git a/crowdsec-docs/unversioned/service_api/quickstart/authentication.mdx b/crowdsec-docs/unversioned/console/service_api/quickstart/authentication.mdx similarity index 100% rename from crowdsec-docs/unversioned/service_api/quickstart/authentication.mdx rename to crowdsec-docs/unversioned/console/service_api/quickstart/authentication.mdx diff --git a/crowdsec-docs/unversioned/service_api/quickstart/blocklists.mdx b/crowdsec-docs/unversioned/console/service_api/quickstart/blocklists.mdx similarity index 99% rename from crowdsec-docs/unversioned/service_api/quickstart/blocklists.mdx rename to crowdsec-docs/unversioned/console/service_api/quickstart/blocklists.mdx index 5a7654f97..fa6c34ae4 100644 --- a/crowdsec-docs/unversioned/service_api/quickstart/blocklists.mdx +++ b/crowdsec-docs/unversioned/console/service_api/quickstart/blocklists.mdx @@ -437,7 +437,7 @@ print(response) ### Subscribe to a blocklist -You can see details about the [subscriber's logic here](/unversioned/service_api/blocklists.md#blocklist-subscription-mechanism). +You can see details about the [subscriber's logic here](/console/service_api/blocklists.md#blocklist-subscription-mechanism). ` with your API key for CrowdSec CTI API. You can learn more about getting your API key [here](/cti_api/getting_started.mdx). +Make sure to replace `` with your API key for CrowdSec CTI API. You can learn more about getting your API key [here](/cti_api/api_getting_started.mdx). You can uncomment the `Primary` line if you want to use CrowdSec as your primary TIProvider, for enriching IOCs of ipv4 and ipv6 types. diff --git a/crowdsec-docs/unversioned/cti_api/integration_opencti.md b/crowdsec-docs/unversioned/cti_api/api_integration/integration_opencti.md similarity index 98% rename from crowdsec-docs/unversioned/cti_api/integration_opencti.md rename to crowdsec-docs/unversioned/cti_api/api_integration/integration_opencti.md index d6a8a8c7a..b07b47668 100644 --- a/crowdsec-docs/unversioned/cti_api/integration_opencti.md +++ b/crowdsec-docs/unversioned/cti_api/api_integration/integration_opencti.md @@ -87,7 +87,7 @@ crowdsec: Replace `opencti.token` with your openCTI token Replace `connector.id` with an ID of your choice. -Replace `crowdsec.key` with your CrowdSec CTI API key. See [instructions about obtaining it](/cti_api/getting_started.mdx) +Replace `crowdsec.key` with your CrowdSec CTI API key. See [instructions about obtaining it](/cti_api/api_getting_started.mdx) Finally run the connector diff --git a/crowdsec-docs/unversioned/cti_api/integration_paloalto_xsoar.md b/crowdsec-docs/unversioned/cti_api/api_integration/integration_paloalto_xsoar.md similarity index 100% rename from crowdsec-docs/unversioned/cti_api/integration_paloalto_xsoar.md rename to crowdsec-docs/unversioned/cti_api/api_integration/integration_paloalto_xsoar.md diff --git a/crowdsec-docs/unversioned/cti_api/integration_qradar.md b/crowdsec-docs/unversioned/cti_api/api_integration/integration_qradar.md similarity index 95% rename from crowdsec-docs/unversioned/cti_api/integration_qradar.md rename to crowdsec-docs/unversioned/cti_api/api_integration/integration_qradar.md index 9716f1ff9..ddc8c9523 100644 --- a/crowdsec-docs/unversioned/cti_api/integration_qradar.md +++ b/crowdsec-docs/unversioned/cti_api/api_integration/integration_qradar.md @@ -18,7 +18,7 @@ This QRadar App leverages CrowdSec's CTI’s smoke endpoint to get information a ## Configuration Setup the App in two easy steps -1. Generate your Crowdsec CTI API Key in CrowdSec's console. You can find the instructions to obtain it [here](https://docs.crowdsec.net/cti_api/getting_started.mdx) +1. Generate your Crowdsec CTI API Key in CrowdSec's console. You can find the instructions to obtain it [here](/cti_api/api_getting_started.mdx) 2. Put the API Key in the App as demonstrated below Within QRadar’s Admin page, navigate to the CrowdSec App and click on the app Setting icon diff --git a/crowdsec-docs/unversioned/cti_api/integration_securitycopilot.md b/crowdsec-docs/unversioned/cti_api/api_integration/integration_securitycopilot.md similarity index 97% rename from crowdsec-docs/unversioned/cti_api/integration_securitycopilot.md rename to crowdsec-docs/unversioned/cti_api/api_integration/integration_securitycopilot.md index e2b183b34..51e3728c5 100644 --- a/crowdsec-docs/unversioned/cti_api/integration_securitycopilot.md +++ b/crowdsec-docs/unversioned/cti_api/api_integration/integration_securitycopilot.md @@ -13,7 +13,7 @@ This documentation will lead you through an easy setup and lead you through some ### Prerequisite: retrieve your API Key The plugin is using our CTI API to provide information on over 70M attackers recently reported by CrowdSec's network. You can create a trial key or retrieve your existing keys in the [console](https://app.crowdsec.net/) in the "Settings" > "CTI API Keys" section. -If you need more details check out the [CTI API Key - getting started section](/cti_api/getting_started.mdx) +If you need more details check out the [CTI API Key - getting started section](/cti_api/api_getting_started.mdx) ### Activate and setup the plugin This consists of 3 easy steps: browse plugins, select "CrowdSec Threat Intelligence" plugin, paste API Key in settings diff --git a/crowdsec-docs/unversioned/cti_api/integration_sekoia_xdr.md b/crowdsec-docs/unversioned/cti_api/api_integration/integration_sekoia_xdr.md similarity index 96% rename from crowdsec-docs/unversioned/cti_api/integration_sekoia_xdr.md rename to crowdsec-docs/unversioned/cti_api/api_integration/integration_sekoia_xdr.md index 59dfecf83..579cbeca6 100644 --- a/crowdsec-docs/unversioned/cti_api/integration_sekoia_xdr.md +++ b/crowdsec-docs/unversioned/cti_api/api_integration/integration_sekoia_xdr.md @@ -8,7 +8,7 @@ CrowdSec's CTI API can be used in Sekoia XDR Playbooks to enrich alerts with Cro ## Usage -Get your API key for CrowdSec CTI API by following [this guide.](/cti_api/getting_started.mdx) +Get your API key for CrowdSec CTI API by following [this guide.](/cti_api/api_getting_started.mdx) In your playbook you can now create a Node which calls CrowdSec's CTI API. diff --git a/crowdsec-docs/unversioned/cti_api/integration_splunk_siem.md b/crowdsec-docs/unversioned/cti_api/api_integration/integration_splunk_siem.md similarity index 99% rename from crowdsec-docs/unversioned/cti_api/integration_splunk_siem.md rename to crowdsec-docs/unversioned/cti_api/api_integration/integration_splunk_siem.md index a40efe37f..3992a132a 100644 --- a/crowdsec-docs/unversioned/cti_api/integration_splunk_siem.md +++ b/crowdsec-docs/unversioned/cti_api/api_integration/integration_splunk_siem.md @@ -13,7 +13,7 @@ The Splunk SIEM App is available in Splunkbase. You can download it from [here]( ## Usage -- Get your API key for CrowdSec CTI API by following [this guide.](/cti_api/getting_started.mdx) +- Get your API key for CrowdSec CTI API by following [this guide.](/cti_api/api_getting_started.mdx) - Complete the App setup by providing your API Key diff --git a/crowdsec-docs/unversioned/cti_api/integration_splunk_soar.md b/crowdsec-docs/unversioned/cti_api/api_integration/integration_splunk_soar.md similarity index 97% rename from crowdsec-docs/unversioned/cti_api/integration_splunk_soar.md rename to crowdsec-docs/unversioned/cti_api/api_integration/integration_splunk_soar.md index eee6ee8f2..ee3eeec32 100644 --- a/crowdsec-docs/unversioned/cti_api/integration_splunk_soar.md +++ b/crowdsec-docs/unversioned/cti_api/api_integration/integration_splunk_soar.md @@ -32,7 +32,7 @@ This documentation will guide you through installing and configuring the app as ![Asset Configure Part 1](/img/splunk_soar/configure_asset.png) -4. Navigate to Asset Setting pane, and enter your CrowdSec CTI API key. If you don't have [one already see this guide to obtain one](/cti_api/getting_started.mdx). +4. Navigate to Asset Setting pane, and enter your CrowdSec CTI API key. If you don't have [one already see this guide to obtain one](/cti_api/api_getting_started.mdx). ![Asset Configure Part 2](/img/splunk_soar/configure_asset_pt2.png) diff --git a/crowdsec-docs/unversioned/cti_api/integration_thehive.md b/crowdsec-docs/unversioned/cti_api/api_integration/integration_thehive.md similarity index 100% rename from crowdsec-docs/unversioned/cti_api/integration_thehive.md rename to crowdsec-docs/unversioned/cti_api/api_integration/integration_thehive.md diff --git a/crowdsec-docs/unversioned/cti_api/introduction.md b/crowdsec-docs/unversioned/cti_api/api_introduction.md similarity index 86% rename from crowdsec-docs/unversioned/cti_api/introduction.md rename to crowdsec-docs/unversioned/cti_api/api_introduction.md index ad0ae579c..6d8ac5e6c 100644 --- a/crowdsec-docs/unversioned/cti_api/introduction.md +++ b/crowdsec-docs/unversioned/cti_api/api_introduction.md @@ -1,6 +1,6 @@ --- -id: intro -title: Introduction +id: api_introduction +title: API Introduction sidebar_position: 1 --- @@ -31,5 +31,5 @@ When querying the CTI API about a given IP, you will get to know more about: ## How to access it -See the [getting started](/cti_api/getting_started.mdx) section to see how to get your API key and start exploring data. +See the [getting started](/cti_api/api_getting_started.mdx) section to see how to get your API key and start exploring data. The [console](https://app.crowdsec.net) can also show a lighter version of the CTI API data. diff --git a/crowdsec-docs/unversioned/console/cti/cve_explorer.md b/crowdsec-docs/unversioned/cti_api/cve_explorer.md similarity index 100% rename from crowdsec-docs/unversioned/console/cti/cve_explorer.md rename to crowdsec-docs/unversioned/cti_api/cve_explorer.md diff --git a/crowdsec-docs/unversioned/console/cti/faq.md b/crowdsec-docs/unversioned/cti_api/faq.md similarity index 100% rename from crowdsec-docs/unversioned/console/cti/faq.md rename to crowdsec-docs/unversioned/cti_api/faq.md diff --git a/crowdsec-docs/unversioned/console/cti/getting_started.md b/crowdsec-docs/unversioned/cti_api/getting_started.md similarity index 96% rename from crowdsec-docs/unversioned/console/cti/getting_started.md rename to crowdsec-docs/unversioned/cti_api/getting_started.md index 7a0193a78..058083092 100644 --- a/crowdsec-docs/unversioned/console/cti/getting_started.md +++ b/crowdsec-docs/unversioned/cti_api/getting_started.md @@ -1,4 +1,5 @@ --- +id: getting_started title: Getting Started description: Get started with CrowdSec's Cyber Threat Intelligence (CTI) platform. --- @@ -7,7 +8,7 @@ Welcome to **CrowdSec’s Cyber Threat Intelligence (CTI)**! This guide will help you navigate the **CTI Web UI** and make the most of its features, from searching for IP details to exploring real-time threat insights. Let’s get started! > You can access CrowdSec's CTI via our **Web UI** on the [**CTI Home page** ↗️](https://app.crowdsec.net/cti) -> Or [Create a **CTI API key** and use our **CTI API**](/u/console/cti/cti_api_keys) +> Or [Create a **CTI API key** and use our **CTI API**](/u/cti_api/api_getting_started) ## Features on the CTI Web UI diff --git a/crowdsec-docs/unversioned/cti_api/integration_intro.md b/crowdsec-docs/unversioned/cti_api/integration_intro.md deleted file mode 100644 index c9e6584d4..000000000 --- a/crowdsec-docs/unversioned/cti_api/integration_intro.md +++ /dev/null @@ -1,20 +0,0 @@ ---- -id: integration_intro -title: Integrations ---- - -| Integration | Description | -|---------------------------|----------------------------------------| -| [Chrome](/cti_api/integration_browser_chrome.md) | A Chrome extension which allows you to quickly search an IP on a web page | -| [Gigasheet](/cti_api/integration_gigasheet.md) | Gigasheet's No-Code API-data-enrichment feature | -| [IntelOwl](/cti_api/integration_intelowl.md) | IntelOwl is an open-source framework and platform for analyzing and processing threat intelligence data | -| [Maltego](/cti_api/integration_maltego.md) | Maltego is a powerful and versatile data visualization and link analysis tool used primarily in the field of digital forensics, cybersecurity, and intelligence gathering | -| [MISP](/cti_api/integration_misp.md) | MISP, short for Malware Information Sharing Platform & Threat Sharing, is an open-source threat intelligence platform designed to facilitate the sharing and collaboration | -| [MSTICpy](/cti_api/integration_msticpy.md) | MSTICpy, short for Microsoft Threat Intelligence Python Security Tools and Common Practices, is an open-source Python library developed by Microsoft | -| [OpenCTI](/cti_api/integration_opencti.md) | OpenCTI is an open-source threat intelligence platform that focuses on facilitating the collection, management, and analysis of cyber threat intelligence data | -| [PaloAlto XSOAR](/cti_api/integration_paloalto_xsoar.md) | Palo Alto Networks Cortex XSOAR is a Security Orchestration, Automation, and Response (SOAR) platform | -| [QRadar](/cti_api/integration_qradar.md) | QRadar is a widely-used Security Information and Event Management (SIEM) solution designed to provide comprehensive visibility into an organization's cybersecurity landscape | -| [Sekoia XDR](/cti_api/integration_sekoia_xdr.md) | Sekoia XDR (Extended Detection and Response) is a cybersecurity platform that combines threat detection, incident response, and proactive threat hunting capabilities into a unified solution | -| [Splunk SIEM](/cti_api/integration_splunk_siem.md) | Splunk Enterprise Security is a Security Information and Event Management (SIEM) solution that helps organizations centralize, analyze, and manage security-related data from various sources | -| [Splunk SOAR](/cti_api/integration_splunk_soar.md) | Splunk SOAR (Security Orchestration, Automation, and Response) is a security platform designed to streamline and automate the incident response and security operations processes | -| [TheHive](/cti_api/integration_thehive.md) | TheHive is an open-source, collaborative, and customizable Security Incident Response Platform (SIRP) designed to assist cybersecurity teams in managing and mitigating security incidents effectively | diff --git a/crowdsec-docs/unversioned/cti_api/intro.md b/crowdsec-docs/unversioned/cti_api/intro.md new file mode 100644 index 000000000..131dc3d7d --- /dev/null +++ b/crowdsec-docs/unversioned/cti_api/intro.md @@ -0,0 +1,54 @@ +--- +id: intro +title: CrowdSec CTI - Cyber Threat Intelligence +sidebar_position: 1 +--- + +# CrowdSec CTI - Cyber Threat Intelligence + +Welcome to **CrowdSec's Cyber Threat Intelligence (CTI)** platform! Our CTI provides real-time threat intelligence data collected from the global CrowdSec community, helping you make informed security decisions. + +## Choose Your Experience + +CrowdSec CTI offers two ways to access our threat intelligence data: + +### 🌐 Web UI Experience +Perfect for **security analysts** and **investigators** who want an intuitive interface to explore threat data. + +**What you can do:** +- Search and analyze IP addresses with detailed threat reports +- Explore threat intelligence using our advanced search capabilities +- View real-time geolocation and risk assessments +- Access predefined searches for common threat hunting scenarios +- Browse the top most aggressive IPs attacking the community + +**Getting Started:** [Explore the Web UI →](/u/cti_api/getting_started) + +--- + +### 🔧 API Integration +Ideal for **developers** and **security engineers** who want to integrate threat intelligence into their applications, SIEM, or security tools. + +**What you can do:** +- Programmatically query threat intelligence data +- Integrate with existing security workflows and tools +- Build custom threat hunting applications +- Access the same data that powers our Web UI +- Scale your security operations with automated threat lookups + +**Getting Started:** [API Documentation →](/u/cti_api/api_getting_started) + +--- + +## Community-Powered Intelligence + +Our CTI data is powered by the **CrowdSec community** - a global network of security engines that share attack patterns and malicious IPs in real-time. This collaborative approach ensures: + +- **Fresh Intelligence**: Real-time updates from active attacks worldwide +- **High Quality**: Community validation reduces false positives +- **Global Coverage**: Intelligence from diverse geographical locations and attack vectors +- **Context-Rich**: Detailed behavioral analysis and attack classifications + +## Ready to Get Started? + +Choose your preferred method above, or explore our comprehensive documentation to learn more about threat taxonomy, integrations, and advanced features. \ No newline at end of file diff --git a/crowdsec-docs/unversioned/console/cti/ip_report.mdx b/crowdsec-docs/unversioned/cti_api/ip_report.mdx similarity index 100% rename from crowdsec-docs/unversioned/console/cti/ip_report.mdx rename to crowdsec-docs/unversioned/cti_api/ip_report.mdx