CrowdSec - the open-source and participative security solution offering crowdsourced protection against malicious IPs and access to the most advanced real-world CTI. https://crowdsec.net/
  • Go 82.2%
  • Shell 14%
  • Python 1.7%
  • HTML 0.9%
  • Makefile 0.8%
  • Other 0.3%
Find a file
TEJ b962bc0d47
Some checks failed
bats-hub.yml / fix(docker): bouncer name strips wrong field from Docker secrets path (#4490) (push) Failing after 0s
bats-sqlite-coverage.yml / fix(docker): bouncer name strips wrong field from Docker secrets path (#4490) (push) Failing after 0s
Tests / Functional tests (push) Failing after 1m6s
Tests / sqlite (push) Failing after 0s
Tests / Functional tests-1 (push) Failing after 5m31s
Tests / mariadb (push) Failing after 0s
Tests / Functional tests-2 (push) Failing after 6m20s
Tests / mysql (push) Failing after 0s
Tests / Functional tests-3 (push) Failing after 16m46s
Tests / postgres (push) Failing after 0s
Tests / Functional tests-4 (push) Failing after 5s
Tests / hub (push) Failing after 0s
Release Drafter / update_release_draft (push) Failing after 2s
CodeQL / Analyze (push) Failing after 3s
CodeQL / Analyze-1 (push) Failing after 4s
publish-docker.yml / fix(docker): bouncer name strips wrong field from Docker secrets path (#4490) (push) Failing after 0s
Test Docker images / test_flavor (debian) (push) Failing after 16m24s
Test Docker images / test_flavor (slim) (push) Failing after 13m13s
Build / Build + tests (push) Failing after 2m3s
build-msi (windows) / Build (push) Has been cancelled
Go tests (windows) / Build + tests (push) Has been cancelled
(push-master) Publish latest Docker images / Push Docker image to registries (push) Has been cancelled
(push-master) Publish latest Docker images / Push Docker image to registries-1 (push) Has been cancelled
(push-master) Publish latest Docker images / dev-alpine (push) Has been cancelled
(push-master) Publish latest Docker images / dev-debian (push) Has been cancelled
fix(docker): bouncer name strips wrong field from Docker secrets path (#4490)
2026-05-31 22:43:08 +02:00
.github build(deps): bump the github-actions group with 2 updates (#4447) 2026-05-05 15:02:47 +02:00
build fix(docker): bouncer name strips wrong field from Docker secrets path (#4490) 2026-05-31 22:43:08 +02:00
cmd cscli metrics: don't attempt to create a DB client if there's no DB config (#4451) 2026-05-05 09:35:26 +02:00
config cscli detect: set log type for caddy unit to "syslog" (#4321) 2026-02-20 16:43:26 +01:00
pkg LAPI body limit linting (#4462) 2026-05-11 09:45:15 +02:00
scripts
test cscli metrics: don't attempt to create a DB client if there's no DB config (#4451) 2026-05-05 09:35:26 +02:00
.dockerignore
.gitattributes
.gitignore
.gitmodules
.golangci.yml refact pkg/dumps: reduce complexity (#4209) 2026-03-04 21:29:13 +01:00
.yamllint
azure-pipelines.yml Dependencies update (#4412) 2026-04-10 16:05:55 +02:00
CONTRIBUTING.md
debian
go.mod update go-re2 to 1.11.0 (#4478) 2026-05-20 14:50:28 +02:00
go.sum update go-re2 to 1.11.0 (#4478) 2026-05-20 14:50:28 +02:00
LICENSE
Makefile
README.md
rpm
SECURITY.md
wizard.sh

CrowdSec




CrowdSec is an open-source and participative security solution offering crowdsourced server detection and protection against malicious IPs. Detect and block with our Security Engine, contribute to the network, and enjoy our real-time community blocklist.

CrowdSec schema

Features & Advantages

Versatile Security Engine

CrowdSec Security Engine is an all-in-one IDS/IPS and WAF.

It detects bad behaviors by analyzing log sources and HTTP requests, and allows active remediation thanks to the Remediation Components.

Detection rules are available on our hub under MIT license.

CrowdSec Community Blocklist

The "Community Blocklist" is a curated list of IP addresses identified as malicious by CrowdSec. The Security Engine proactively blocks the IP addresses of this blocklist, preventing malevolent IPs from reaching your systems.

CrowdSec Community Blocklist

Console - Monitoring & Automation of your security stack

CrowdSec Console

Multiple Platforms support

Multiple Platforms support

Outnumbering hackers all together

By sharing the threat they faced, all users are protecting each other (hence the name Crowd-Security). Crowdsec is designed for modern infrastructures, with its "Detect Here, Remedy There" approach, letting you analyze logs coming from several sources in one place and block threats at various levels (applicative, system, infrastructural) of your stack.

CrowdSec ships by default with scenarios (brute force, port scan, web scan, etc.) adapted for most contexts, but you can easily extend it by picking more of them from the HUB. It is also easy to adapt an existing one or create one yourself.

Installation

Follow our documentation to install CrowdSec in a few minutes on Linux, Windows, Docker, OpnSense, Kubernetes, and more.

Resources

  • Console: Supercharge your CrowdSec setup with visualization, management capabilities, extra blocklists and premium features.
  • Documentation: Learn how to exploit your CrowdSec setup to deter more attacks.
  • Discord: A question or a suggestion? This is the place.
  • Hub: Improve your stack protection, find the relevant remediation components for your infrastructure.
  • Public Roadmap: Vote for your favorite features and submit ideas to influence what we build next.
  • CrowdSec Academy: Learn and grow with our courses.
  • Corporate Website: For everything else.