crowdsecurity/crowdsec

Features

• Security Event Correlation - Aggregates and correlates security events from logs and network traffic to identify malicious patterns.
• Intrusion Prevention Systems - Parses logs and network traffic to detect threats, sharing intelligence across a global community to automate blocking.
• Web Application Firewalls - Configures web application firewall rules to inspect and filter incoming traffic for malicious patterns.
• Security Infrastructure Managers - Provides a command-line interface to configure security engines, manage detection scenarios, and oversee active blocking decisions.
• Threat Detection - Identifies threats by parsing logs and traffic and matching them against predefined security scenarios.
• Traffic Filtering - Filters incoming network requests against curated lists of malicious IP addresses to prevent cyberattacks.
• Security - Provides a centralized API service for aggregating security signals and coordinating remediation decisions across distributed agents.
• Security Log Processors - Processes logs from various sources to identify potential security threats and malicious activity within the infrastructure.
• Security Engines - Registers security engine instances to the central database to enable fleet-wide coordination and threat detection.
• Security Monitoring - Provides a management console for unified monitoring and orchestration of distributed security instances.
• Security Policy Management - Maintains a centralized management interface for security policies to ensure consistent protection across infrastructure.
• Threat Intelligence Platforms - Aggregates, processes, and shares malicious IP data and attack patterns to protect distributed infrastructure.
• Virtual Patching - Deploys security rules to mitigate web application vulnerabilities without requiring direct code changes.
• Distributed Orchestration Platforms - Manages security agents and enforcement components across diverse environments, including containers, cloud, and on-premises servers.
• Alert Generation Engines - Generates runtime security alerts when traffic patterns exceed defined thresholds.
• Request Interception and Blocking - Inspects incoming web traffic against vulnerability signatures to block unauthorized access attempts in real-time.
• Event Pattern Detection - Aggregates security events over time to identify and block automated threats using threshold-based logic.
• Infrastructure Deployment - Supports flexible deployment across standalone, containerized, and cloud-native environments.
• Decision Storage Backends - Maintains a persistent database backend to track active alerts, remediation decisions, and system state across distributed security instances.
• Blocklist Aggregators - Fetches curated lists of known malicious IP addresses from a global network to proactively block threats before they reach an application.
• Custom Detection Rules - Constructs custom pattern-matching logic to inspect HTTP requests for malicious payloads.
• Security Policy Enforcers - Blocks source IP addresses that trigger specific security rules multiple times within a defined timeframe to prevent ongoing malicious activity.
• Network Access Controls - Prevents access from known malicious IP addresses by consuming real-time threat intelligence.
• Web Security Policies - Integrates web server bouncers to intercept and reject unauthorized requests at the edge before they reach application logic.
• Reverse Proxy Security - Integrates with reverse proxies to perform lightweight request evaluation and block malicious traffic at the edge.
• Security Agent Registrations - Connects security agents to the central management server for signal reporting and policy synchronization.
• Security Context Installers - Downloads and enables detection patterns to identify and flag malicious behaviors within system logs.
• Security Detection Logic - Implements a security detection engine that matches HTTP traffic against complex rules to identify and log suspicious activity.
• Malicious Activity Reporters - Submits signals about detected threats to a central intelligence service to contribute to community-wide protection.
• Threat Intelligence Synchronizers - Synchronizes local security instances with centralized databases to share and receive updated blocklists and global attack patterns.
• Web Application Security - Integrates security inspection components with web applications to enforce request filtering and blocking.
• Bucket Aggregators - Aggregates security events into time-bound buckets to identify malicious patterns and trigger alerts when thresholds are exceeded.
• Central API Monitors - Ensures the security engine maintains a healthy connection to the centralized threat intelligence platform.
• Network Security - Lightweight software for detecting and blocking aggressive peers.
• Developer Utilities - Collaborative, modernized security automation for server protection.
• Security Tools - Collaborative intrusion prevention system for behavioral analysis.
• Intrusion Detection Systems - Collaborative behavior detection engine and IP reputation network.
• Security and Infrastructure - Collaborative IPS/IDS software for analyzing visitor behavior.
• Security And Privacy - Crowdsourced security solution for protecting against malicious IPs.
• Security Configuration Hubs - Distributes community-curated security scenarios, parsers, and collections from a central repository to ensure consistent and up-to-date protection.
• Security Configuration Updaters - Automates daily updates to security rule collections to ensure protection against evolving vulnerabilities.
• Security Policy Automators - Processes security alerts against ordered rules to trigger automated remediation and notification workflows.
• Security Agent Inspectors - Allows administrators to verify the connectivity and operational health of security agents.
• Security Machine Authentications - Authenticates and connects security agents to the central API for centralized threat management.
• Web Security - Blocks common web attack patterns and known vulnerabilities by applying virtual patching rules to incoming traffic.
• Cross-Site Scripting Prevention - Examines input strings for malicious script injection patterns to prevent cross-site scripting attacks.
• Attack Simulations - Analyzes traffic for generic attack signatures and suspicious behavior to identify threats.
• Network Access Controls - Applies temporary restrictions to specific IP addresses or network ranges to block unauthorized access.
• Traffic Inspection and Manipulation - Analyzes web application security events by listening on network interfaces to detect and block malicious requests.
• Secure Remote Access - Establishes secure communication channels for distributed security agents to synchronize threat intelligence and policies.
• Bouncer Registrations - Registers lightweight external components to the central API for automated traffic enforcement.
• Allowlist Management - Allows exempting specific IP addresses or network ranges from automated blocking actions while maintaining monitoring.
• Security Collection Configurators - Installs and manages curated sets of security rules and configurations to detect infrastructure threats.
• Decoupled Architectures - Offloads active blocking and remediation actions to lightweight external components that query the central API for current decisions.
• Device Connection Monitoring - Displays the connection status between the security engine and the management platform to ensure intelligence sharing.
• Centralized Logging Systems - Centralizes security alerts and remediation decisions from distributed agents into a unified database.
• Instance Health Monitors - Links local security engines to a centralized management platform for remote administration.
• IP Address Blocklists - Maintains and displays lists of banned IP addresses with options to revoke decisions or whitelist network ranges.
• Local API Servers - Acts as a hub for security agents to report signals, store remediation decisions, and synchronize threat intelligence across infrastructure.
• Data Parsing - Parses and transforms raw log data into structured objects for security analysis and event processing.
• Data Enrichment - Enriches traffic data with geographic and network provider information for better security context.
• Data Visualization Dashboards - Deploys a dashboard interface to provide graphical insights and reporting on detected threats.
• Relational Database Persistence - Persists security data in relational database backends to handle varying levels of traffic and scale.
• External Intelligence Integrators - Queries external security services to enrich local data with global insights and improve threat detection accuracy.
• Security Collection Upgraders - Updates installed security configurations to their latest versions from a central repository.
• Security Parser Updaters - Downloads and installs the latest versions of detection patterns from a central repository.
• Container Monitoring - Monitors container logs for security events and applies targeted parsing rules.
• Agent Security - Manages the authorization of security agents to connect to the API and report threat intelligence.
• Detection Scenario Inspectors - Allows administrators to verify the configuration and operational status of installed security detection scenarios.
• Security Decision Importers - Ingests lists of malicious traffic patterns from external files to apply automated blocking rules across the infrastructure.
• Enrollment Management - Connects local security engines to a centralized management platform for remote monitoring and fleet orchestration.
• Security Auditing - Provides visibility into active enforcement actions, including blocked IP addresses and triggered security scenarios.
• Security Configurations - Defines how security rules are processed and applied to web traffic, including blocking modes and custom hooks.
• Threat Notification Systems - Forwards security alerts to external services to trigger downstream workflows when threats are detected.
• Event-Driven Plugin Registries - Executes custom logic and notification workflows at specific lifecycle stages to handle alerts and integrate with external security tools.
• Alerting and Incident Management - Inspects and manages detected security events to maintain an accurate record of blocked threats.
• Alerting Systems - Retrieves detected security events with support for filtering by source IP, network range, and scenario.
• API Monitoring - Verifies the authentication status and health of connections between security agents and the API.
• Application Logging - Extracts and analyzes security events from system logs and application files to identify malicious patterns.
• Log Analysis - Ingests and normalizes web server logs to extract security-relevant metadata for threat detection.
• Caching - Caches threat intelligence and security decisions to minimize latency and reduce network overhead during traffic inspection.
• Data Persistence and Storage - Provides persistent storage for security signals and remediation decisions within a local database backend.
• Data Persistence Management - Maintains a persistent database backend to manage the lifecycle of security alerts and remediation decisions.
• Decision Streamers - Synchronizes security policies by incrementally fetching new and expired decisions to ensure enforcement components maintain an accurate state.
• Security Rule Removers - Deletes specific application security rules to stop them from being applied to incoming traffic.
• Parser Inspectors - Provides visibility into active log processing configurations to ensure they are correctly loaded.
• Agent Registration Utilities - Registers security agents automatically within a cluster using secure tokens to simplify deployment and management.
• Security Agent Revocations - Revokes access for security agents to stop them from reporting events or receiving updates.
• API Access Security - Ensures authorized access to the security API by validating the identity of connected components.
• Security Decision Lookups - Enables querying the central database for active security decisions applied to specific entities.
• Client Certificate Authentication - Validates the identity of log processors and remediation components using API keys and TLS certificates.
• Detection Scenario Removers - Uninstalls specific security detection patterns to stop monitoring for particular malicious activities.
• Detection Overrides - Allows adding specific IP addresses or ranges to an allowlist to prevent them from being flagged or blocked by security detection engines.
• Security Governance - Facilitates lifecycle management of security components like parsers and scenarios sourced from a centralized hub.
• Security Plugin Frameworks - Manages application-specific security plugins to automate threat detection and rule exclusion.
• Security Service Configurators - Scans the local environment to identify running services and generates the necessary security configurations through an interactive setup process.
• Security Context Inspectors - Helps administrators understand the active protection environment by inspecting security context relationships.
• Sensitivity Configurations - Allows administrators to tune the strictness of security rules to balance detection accuracy.
• Security Testing Configurations - Implements functional testing for security scenarios and parsers to verify detection logic before production deployment.
• Decision Retrievers - Queries a central authority to determine if a specific IP address is flagged as malicious and should be blocked.
• Traffic Inspection Tools - Defines acquisition points and network listeners to intercept and analyze web traffic for potential security threats.
• Security Testing and Auditing - Allows auditing of installed security configurations used to inspect web traffic for malicious patterns.
• SQL Injection Detection Tools - Analyzes input strings for patterns indicative of SQL injection attempts to flag malicious database queries.
• Custom Action Handlers - Executes custom logic at lifecycle stages to dynamically modify security engine behavior and request processing.
• Metadata Attachments - Appends custom metadata to security alerts to provide context for incident response.
• Contextual Alert Samples - Enriches security alerts with custom data to improve visibility for incident response.
• Background Polling Services - Monitors the operational state of the polling interface to ensure security signals are processed.
• Allowlist Management - Prevents specific IP addresses or ranges from triggering security alerts or blocklist actions by defining trusted sources.
• Metrics Exporters - Exposes security and performance metrics to external monitoring systems for real-time observability.
• Metric and Performance Monitors - Exposes real-time performance data on log parsing, bucket overflows, and API activity.
• Processing Engine Metrics - Provides internal processing statistics and detection performance metrics to identify system bottlenecks.
• Server Metrics - Provides system and application performance data through standard endpoints for observability.
• Notification Channel Configuration - Manages external notification plugins to alert administrators when security events are detected.

Star history