Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 6 additions & 0 deletions crowdsec-docs/sidebarsUnversioned.ts
Original file line number Diff line number Diff line change
Expand Up @@ -317,11 +317,17 @@ const sidebarsUnversionedConfig: SidebarConfig = {
tag: "premium",
},
},
{
type: "doc",
label: "Discord",
id: "console/notification_integrations/discord",
},
{
type: "doc",
label: "Slack",
id: "console/notification_integrations/slack",
},

{
type: "doc",
label: "Webhook",
Expand Down
5 changes: 5 additions & 0 deletions crowdsec-docs/src/css/custom.css
Original file line number Diff line number Diff line change
Expand Up @@ -56,6 +56,11 @@ html[data-theme="dark"] {
--docusaurus-highlighted-code-line-bg: rgba(255, 255, 255, 0.1);
}

/* IMAGE STYLES FOR PAGES*/
.container img {
@apply border border-solid border-gray-300/80 dark:border-gray-300/80 rounded-lg p-2;
}

.docusaurus-highlight-code-line {
@apply bg-background block;
margin: 0 calc(-1 * var(--ifm-pre-padding));
Expand Down
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Original file line number Diff line number Diff line change
@@ -0,0 +1,27 @@
---
id: discord
title: Discord
---

Connecting an integration will create a configuration specific to your Discord server.
You can then define rules to control which events trigger notifications and which Discord channel they’re sent to.

## Link your server

1. In the [CrowdSec Console](https://app.crowdsec.net), navigate to **Settings > Integrations** and then select **Configure** in the Discord row.

![](/img/console/notification_integrations/configure-discord.png)

2. Select the Discord server you want to link to your CrowdSec Console using the dropdown menu on top-tight of the page. Then select **Allow**. Repeat the process if you want to link more servers.

3. You should be redirected to the Discord integration page. You can now create a notification rule by navigating to the **Rules** tab.

![](/img/console/notification_integrations/discord-configuration-tab.png)

Your Discord integration is now linked to your CrowdSec Console.

## Create a notification rule

1. In the [CrowdSec Console](https://app.crowdsec.net), navigate to **Settings > Integrations > Discord** go to the Rules tab and click on **Add rule**.

2. Follow the steps in the [Create a notification rule](/u/console/notification_integrations/rule) documentation to create your rule.
Original file line number Diff line number Diff line change
Expand Up @@ -16,9 +16,9 @@ Discover all the available notification integrations in CrowdSec. Each integrati

## Available Integrations

- [Discord](/u/console/notification_integrations/discord)
- [Slack](/u/console/notification_integrations/slack)
- [Webhook](/u/console/notification_integrations/webhook)
- Coming soon: Discord
- Coming soon: Microsoft Teams

## How to use notification integrations
Expand Down
47 changes: 22 additions & 25 deletions crowdsec-docs/versioned_docs/version-v1.6.0/appsec/quickstart.md
Original file line number Diff line number Diff line change
Expand Up @@ -4,8 +4,6 @@ title: Quickstart
sidebar_position: 2
---

## Objectives

The goal of this quickstart is to set up the [AppSec Component](appsec/intro.md#introduction) to safeguard web applications running on [Nginx](https://nginx.com). We'll deploy a [set of rules](https://app.crowdsec.net/hub/author/crowdsecurity/collections/appsec-virtual-patching) designed to block [well-known attacks](https://app.crowdsec.net/hub/author/crowdsecurity/collections/appsec-generic-rules) and [currently exploited vulnerabilities](https://app.crowdsec.net/hub/author/crowdsecurity/collections/appsec-virtual-patching). Additionally, we'll show how to monitor these alerts through the [console](https://app.crowdsec.net/).

## Pre-requisites
Expand Down Expand Up @@ -36,16 +34,16 @@ sudo cscli collections install crowdsecurity/appsec-generic-rules

Executing this command will install the following items:

- The [*AppSec Rules*](/appsec/rules_syntax.md) contain the definition of malevolent requests to be matched and stopped
- The [*AppSec configuration*](/appsec/configuration.md#appsec-configuration) links together a set of rules to provide a coherent set
- The [*CrowdSec Parser*](/concepts.md#parsers) and [*CrowdSec Scenario(s)*](/concepts.md#scenarios) bans for a longer duration repeating offenders
- The [_AppSec Rules_](/appsec/rules_syntax.md) contain the definition of malevolent requests to be matched and stopped
- The [_AppSec configuration_](/appsec/configuration.md#appsec-configuration) links together a set of rules to provide a coherent set
- The [_CrowdSec Parser_](/concepts.md#parsers) and [_CrowdSec Scenario(s)_](/concepts.md#scenarios) bans for a longer duration repeating offenders

### Setup the acquisition

Having installed the required components, it's time to configure the CrowdSec [Acquisition](/concepts.md#acquisition) to connect the Application Security Component with our Nginx web server. This configuration allows our Nginx server to send requests to the AppSec Component for evaluation and decision-making.

- Create the `/etc/crowdsec/acquis.d/` directory with `mkdir -p /etc/crowdsec/acquis.d/` (if it doesn't exist on your machine)
- Put the following content in `/etc/crowdsec/acquis.d/appsec.yaml` :
- Create the `/etc/crowdsec/acquis.d/` directory with `mkdir -p /etc/crowdsec/acquis.d/` (if it doesn't exist on your machine)
- Put the following content in `/etc/crowdsec/acquis.d/appsec.yaml` :

```yaml title="/etc/crowdsec/acquis.d/appsec.yaml"
appsec_config: crowdsecurity/appsec-default
Expand All @@ -57,8 +55,8 @@ source: appsec

The two important directives in this configuration file are:

- `appsec_config` is the name of the [*AppSec configuration*](/appsec/configuration.md#appsec-configuration) that was included in the [collection](/concepts.md#collections) we just installed.
- the `listen_addr` is the IP and port the AppSec Component will listen to.
- `appsec_config` is the name of the [_AppSec configuration_](/appsec/configuration.md#appsec-configuration) that was included in the [collection](/concepts.md#collections) we just installed.
- the `listen_addr` is the IP and port the AppSec Component will listen to.

:::info
You can find more about the [supported options for the acquisition here](/data_sources/appsec.md)
Expand Down Expand Up @@ -133,7 +131,6 @@ sudo cscli bouncers delete test_waf

</details>


## Remediation Component Setup

With our AppSec Component active within CrowdSec, it's time to configure the remediation component to forward requests to it.
Expand All @@ -148,8 +145,6 @@ To setup forwarding of requests in the Nginx remediation component, we'll modify
APPSEC_URL=http://127.0.0.1:7422
```



This instructs our Nginx plugin (the remediation component) to communicate with the AppSec Component at `http://127.0.0.1:7422`. Once configured, all incoming HTTP requests will be sent there for analysis. The snippet above assumes that the AppSec Component is running on the same machine.

We can now restart the service:
Expand All @@ -169,8 +164,9 @@ if now try to access `http://localhost/.env` from a browser, our If you now atte
![appsec-denied](/img/appsec_denied.png)

We can also look at the metrics from `cscli metrics`. Amongst other things, it will show:
- the number of requests processed by the AppSec Component
- Individual rule matches

- the number of requests processed by the AppSec Component
- Individual rule matches

<details>
<summary>cscli metrics output example</summary>
Expand All @@ -194,35 +190,36 @@ Appsec '127.0.0.1:7422/' Rules Metrics:
╰─────────────────────────────────┴───────────╯

```
</details>

</details>

### Explanation

What happened in the test that we just did is:

1. We did a request (`localhost/.env`) to our local nginx webserver
2. Nginx, thanks to the Remediation Component configuration, forwarded the request to `http://127.0.0.1:7422`
3. Our AppSec Component, listening on `http://127.0.0.1:7422` analyzed the request
4. The request matches the [AppSec rule to detect .env access](https://app.crowdsec.net/hub/author/crowdsecurity/appsec-rules/vpatch-env-access)
5. The AppSec Component thus answered with [HTTP 403](https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/403) to Nginx, indicating that the request must be blocked
6. Nginx presented us with the default "request blocked" page provided by the Remediation Component
1. We did a request (`localhost/.env`) to our local nginx webserver
2. Nginx, thanks to the Remediation Component configuration, forwarded the request to `http://127.0.0.1:7422`
3. Our AppSec Component, listening on `http://127.0.0.1:7422` analyzed the request
4. The request matches the [AppSec rule to detect .env access](https://app.crowdsec.net/hub/author/crowdsecurity/appsec-rules/vpatch-env-access)
5. The AppSec Component thus answered with [HTTP 403](https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/403) to Nginx, indicating that the request must be blocked
6. Nginx presented us with the default "request blocked" page provided by the Remediation Component

## Integration with the console

<!-- fix link to this guide once done -->

If you haven't yet, follow the guide about [how to enroll your Security Engine in the console](/docs/getting_started/install_crowdsec).

Once done, all your alerts, including the ones generated by the AppSec Component, are going to appear in the console:

![appsec-console](/img/appsec_console.png)


## Next steps

You are now running the AppSec Component on your Crowdsec Security Engine, congrats!

As the next steps, you can:
- [Explore the hub](https://hub.crowdsec.net) to find more rules for your use case
- Look at the [Rules syntax](/appsec/rules_syntax.md) and [creation process](/appsec/create_rules.md) to create your own and contribute
- Take a look at [the benchmarks](/appsec/benchmark.md)

- [Explore the hub](https://hub.crowdsec.net) to find more rules for your use case
- Look at the [Rules syntax](/appsec/rules_syntax.md) and [creation process](/appsec/create_rules.md) to create your own and contribute
- Take a look at [the benchmarks](/appsec/benchmark.md)