CrowdSec - the open-source and participative security solution offering crowdsourced protection against malicious IPs and access to the most advanced real-world CTI. https://crowdsec.net/
Find a file
blotus c3036e21ab
Some checks failed
(push-master) Publish latest Docker images / dev-debian (push) Has been cancelled
Release Drafter / update_release_draft (push) Has been cancelled
(sub) Bats / Hub / Functional tests (push) Has been cancelled
(sub) Bats / sqlite + coverage / Functional tests (push) Has been cancelled
Tests / sqlite (push) Has been cancelled
Tests / mariadb (push) Has been cancelled
Tests / mysql (push) Has been cancelled
Tests / postgres (push) Has been cancelled
Tests / hub (push) Has been cancelled
CodeQL / Analyze (push) Has been cancelled
Test Docker images / test_flavor (debian) (push) Has been cancelled
Test Docker images / test_flavor (slim) (push) Has been cancelled
Go tests (windows) / Build + tests (push) Has been cancelled
Build / Build + tests (push) Has been cancelled
(push-master) Publish latest Docker images / dev-alpine (push) Has been cancelled
(sub) Publish Docker images / Push Docker image to registries (push) Has been cancelled
WAF: Improve user-experience with CRS and modsecurity rules (#3827)
2025-09-01 11:51:44 +02:00
.github build(deps): bump codecov/codecov-action from 5.4.3 to 5.5.0 (#3816) 2025-08-28 16:41:23 +02:00
cmd WAF: Improve user-experience with CRS and modsecurity rules (#3827) 2025-09-01 11:51:44 +02:00
config detect.yaml: always acquire ssh from file if present (#3825) 2025-08-25 15:44:36 +02:00
debian fix: Postint check if api.server.enable is false (#3802) 2025-08-25 15:45:33 +02:00
docker docker: enforce volume use for /var/lib/crowdsec/data/ (#3757) 2025-08-01 14:35:38 +02:00
mk make: remove redundant go version check (#3118) 2024-07-09 14:49:55 +02:00
pkg WAF: Improve user-experience with CRS and modsecurity rules (#3827) 2025-09-01 11:51:44 +02:00
rpm fix: Postint check if api.server.enable is false (#3802) 2025-08-25 15:45:33 +02:00
scripts install scripts: echo -e -> echo (we're not requiring bash anymore) (#3799) 2025-08-18 14:44:21 +02:00
test fix "cscli alerts list -s <scenario>" for alerts with no decisions (#3830) 2025-08-28 16:39:16 +02:00
windows setup: add detect.yaml to windows install (#3775) 2025-08-01 11:26:54 +02:00
.dockerignore support capi_whitelists.yaml (#2224) 2023-05-25 10:02:33 +02:00
.gitignore CI: update action deps (#3692) 2025-07-08 20:58:08 +02:00
.gitmodules Rename directory "tests" to "test" (#2094) 2023-03-03 15:54:49 +01:00
.golangci.yml cscli setup improvements (#3789) 2025-08-06 16:34:20 +02:00
.yamllint
azure-pipelines.yml use go 1.24.6 (#3835) 2025-09-01 11:13:38 +02:00
CONTRIBUTING.md
Dockerfile cscli setup: new service detection and configuration (#3730) 2025-07-31 17:00:41 +02:00
Dockerfile.debian cscli setup: new service detection and configuration (#3730) 2025-07-31 17:00:41 +02:00
go.mod use go 1.24.6 (#3835) 2025-09-01 11:13:38 +02:00
go.sum build(deps): bump github.com/crowdsecurity/machineid from 1.0.2 to 1.0.3 (#3769) 2025-08-07 11:56:51 +02:00
LICENSE CI: Cache all built go modules (#2081) 2023-02-28 17:25:09 +01:00
make_chocolatey.ps1 Update windows pipeline (#2909) 2024-03-19 17:42:08 +01:00
make_installer.ps1 Update windows pipeline (#2909) 2024-03-19 17:42:08 +01:00
Makefile Makefile: typo (#3628) 2025-05-15 15:05:44 +02:00
README.md README revamp (#3408) 2025-01-21 15:05:12 +00:00
SECURITY.md renamed security.MD -> SECURITY.md, typos (#1774) 2022-10-04 09:50:18 +02:00
wizard.sh install scripts: echo -e -> echo (we're not requiring bash anymore) (#3799) 2025-08-18 14:44:21 +02:00

CrowdSec




CrowdSec is an open-source and participative security solution offering crowdsourced server detection and protection against malicious IPs. Detect and block with our Security Engine, contribute to the network, and enjoy our real-time community blocklist.

CrowdSec schema

Features & Advantages

Versatile Security Engine

CrowdSec Security Engine is an all-in-one IDS/IPS and WAF.

It detects bad behaviors by analyzing log sources and HTTP requests, and allows active remedation thanks to the Remediation Components.

Detection rules are available on our hub under MIT license.

CrowdSec Community Blocklist

The "Community Blocklist" is a curated list of IP addresses identified as malicious by CrowdSec. The Security Engine proactively block the IP addresses of this blocklist, preventing malevolent IPs from reaching your systems.

CrowdSec Community Blocklist

Console - Monitoring & Automation of your security stack

CrowdSec Console

Multiple Platforms support

Multiple Platforms support

Outnumbering hackers all together

By sharing the threat they faced, all users are protecting each-others (hence the name Crowd-Security). Crowdsec is designed for modern infrastructures, with its "Detect Here, Remedy There" approach, letting you analyze logs coming from several sources in one place and block threats at various levels (applicative, system, infrastructural) of your stack.

CrowdSec ships by default with scenarios (brute force, port scan, web scan, etc.) adapted for most contexts, but you can easily extend it by picking more of them from the HUB. It is also easy to adapt an existing one or create one yourself.

Installation

Follow our documentation to install CrowdSec in a few minutes on Linux, Windows, Docker, OpnSense, Kubernetes, and more.

Resources

  • Console: Supercharge your CrowdSec setup with visualization, management capabilities, extra blocklists and premium features.
  • Documentation: Learn how to exploit your CrowdSec setup to deter more attacks.
  • Discord: A question or a suggestion? This is the place.
  • Hub: Improve your stack protection, find the relevant remediation components for your infrastructure.
  • CrowdSec Academy: Learn and grow with our courses.
  • Corporate Website: For everything else.