crowdsec
CrowdSec - the open-source and participative security solution offering crowdsourced protection against malicious IPs and access to the most advanced real-world CTI.
An open-source security tool that reads your server logs to detect attacks like brute-force and port scans, blocks malicious IPs via pluggable components, and shares threat data with a global community so you block known attackers before they target you.
CrowdSec is an open-source security tool written in Go that monitors your server logs and incoming HTTP requests for signs of malicious behavior, then blocks the responsible IP addresses. It reads log files from services like web servers, SSH daemons, and others, looking for patterns such as brute-force login attempts, port scans, or automated web crawlers probing for weaknesses. The detection side functions as an intrusion detection system; the actual blocking is handled by separate components you install alongside it.
What distinguishes CrowdSec from a standalone firewall is its community sharing model. When your installation detects and reports a malicious IP address, that data is contributed to a shared network. In return, your server receives the Community Blocklist: a live feed of IP addresses already flagged by CrowdSec users around the world. Your server can start blocking known bad actors before they ever attempt to reach you, based on attacks other users have already seen.
Detection rules are called scenarios and are available under the MIT license on the project hub. The hub lets you browse and install pre-built scenarios for common attack types, or write your own. Blocking is applied through remediation components, also called bouncers, which you install at different points in your infrastructure: the firewall, a CDN, a specific application, or a Kubernetes ingress controller.
CrowdSec installs on Linux, Windows, Docker, Kubernetes, and several other platforms. A web console is available for visualizing security events and managing configuration. Premium blocklists and additional threat intelligence are available as paid offerings on top of the free open-source core.
Where it fits
- Protect an SSH server from brute-force login attempts by automatically detecting and blocking offending IP addresses.
- Block malicious web crawlers and vulnerability scanners from reaching your web server using live community-sourced blocklists.
- Add a security layer to a Kubernetes cluster by installing a CrowdSec bouncer on the ingress controller.
- Subscribe to the Community Blocklist to block IPs flagged by thousands of other CrowdSec users before they ever reach your server.