CrowdSec

No entries match these filters. Clear filters

1. v1.8.2 Oct 26, 2026 · issue 123

   CrowdSec v1.8.2 adds WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server. rate limiting, custom JS bot fingerprinting, a new cscli bot subcommand, and several new expression helpers.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v1.8.2 https://github.com/crowdsecurity/crowdsec.git
   # already have the repo? check out this version:
   $ git checkout v1.8.2

   └──▷ TRY IT
   Inspect or manage bot detection state directly from the CLI using the new bot subcommand.
   copy

   $ cscli bot

   Use GetDecisionsSinceCountByScenario in a postoverflow or rule expression to gate actions on how many decisions a scenario has already produced in a time window.
   copy

   $ GetDecisionsSinceCountByScenario('crowdsecurity/http-probing', '1h') > 5

   Call SkipProcessing() inside a WAF rule to short-circuit all further rule evaluation for a matching request, useful for allowlisting trusted internal scanners.
   copy

   $ SkipProcessing()

   • Adds cscli bot subcommand for managing bot detection from the CLI and FlagSubmission() helper to bot detection for marking submission events.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds SkipProcessing() helper to the WAF for conditionally bypassing rule evaluation and a rate limiting feature enabling request-rate-based blocking at the application layer.
   • Adds GetDecisionsSinceCountByScenario expression helper for querying per-scenario decision counts.
   • Adds custom JS fingerprinting to bot detection, allowing user-defined and hub-distributed detection rules, and optional SameSite=None and Partitioned flag support on bot detection cookies.
   • Adds optional category field to the AppSecAppSecApplication security: the practice of finding and fixing vulnerabilities in software during design, development, and testing. Cyber tools build on AppSec workflows to shift vulnerability detection earlier in the development lifecycle. request score for finer-grained scoring classification.

   +5 more show less

   • Adds cs_features Prometheus metric to track which Security Engine features are active.
   • Adds kind label to the cs_alerts Prometheus metric and a CAPI last-pull timestamp and error counter to metrics.
   • Adds optional concurrency limit for simultaneous decision stream requests via LAPI and makes decision stream page size configurable in LAPI.
   • Enables automatic TLS server certificate reload when certificate files change on disk.
   • Adds LookupHost DNS cache support in expression helpers to reduce repeated DNS lookups.
   • Adds cscli bot subcommand for managing bot detection from the CLI and FlagSubmission() helper to bot detection for marking submission events.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds SkipProcessing() helper to the WAF for conditionally bypassing rule evaluation and a rate limiting feature enabling request-rate-based blocking at the application layer.
   • Adds GetDecisionsSinceCountByScenario expression helper for querying per-scenario decision counts.
   • Adds cs_features Prometheus metric to track which Security Engine features are active.

   6 more in Everything

2. docs update Sep 25, 2026 · issue 085

   CrowdSec adds a Go-based HAProxy SPOA bouncer with WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server./AppSecAppSecApplication security: the practice of finding and fixing vulnerabilities in software during design, development, and testing. Cyber tools build on AppSec workflows to shift vulnerability detection earlier in the development lifecycle. support, CAPTCHA, GeoIPGeoIPA database that maps IP addresses to geographic locations; tools use it to attribute traffic or alerts to countries, cities, or ASNs without querying external services. headers, mTLSmTLSMutual TLS, an encrypted connection where both client and server present certificates to prove their identity. It helps services verify who they are communicating with., and PrometheusPrometheusAn open-source monitoring system maintained by the CNCF that scrapes and stores time-series metrics, giving cyber tools a standard way to expose and query operational data. metrics⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ TRY IT
   Run the SPOA bouncer as a container when HAProxy is in a separate container, so CrowdSec can enforce decisions without installing anything on the HAProxy host.
   copy

   $ docker run -d \
     --name crowdsec-spoa-bouncer \
     -e CROWDSEC_KEY="<your-lapi-api-key>" \
     -e CROWDSEC_URL="http://crowdsec:8080/" \
     -p :9000 \
     -p :6060 \
     crowdsecurity/spoa-bouncer

   Enable Lua-based dynamic ban/captcha template rendering when you need runtime variables not available as HAProxy log-format fetch methods.
   /etc/haproxy/haproxy.cfg copy

   global
     lua-prepend-path /usr/lib/crowdsec-haproxy-spoa-bouncer/lua/?.lua
     lua-load /usr/lib/crowdsec-haproxy-spoa-bouncer/lua/crowdsec.lua
     setenv CROWDSEC_BAN_TEMPLATE_PATH /var/lib/crowdsec-haproxy-spoa-bouncer/html/lua/ban.html
     setenv CROWDSEC_CAPTCHA_TEMPLATE_PATH /var/lib/crowdsec-haproxy-spoa-bouncer/html/lua/captcha.html

   Extract the real client IP from CDNCDNA content delivery network, servers distributed across locations that cache and serve content near readers. It can reduce loading time and traffic to the original server./proxy headers before SPOE evaluation so CrowdSec decisions target the originating IP, not the edge node.
   /etc/haproxy/haproxy.cfg copy

   frontend http-in
     http-request set-src hdr_ip(X-Real-IP) if { req.hdr(X-Real-IP) -m found }
     http-request set-src hdr_ip(CF-Connecting-IP) if { req.hdr(CF-Connecting-IP) -m found } !{ req.hdr(X-Real-IP) -m found }
     http-request set-src hdr_ip(X-Forwarded-For) if { req.hdr(X-Forwarded-For) -m found } !{ req.hdr(X-Real-IP) -m found } !{ req.hdr(CF-Connecting-IP) -m found }
     filter spoe engine crowdsec config /etc/haproxy/crowdsec.cfg
     http-request send-spoe-group crowdsec crowdsec-http-body if body_within_limit || !{ req.body_size -m found }
     http-request send-spoe-group crowdsec crowdsec-http-no-body if !body_within_limit { req.body_size -m found }

   • Installs via crowdsec-haproxy-spoa-bouncer package (apt/dnf) with bouncer config at /etc/crowdsec/bouncers/crowdsec-spoa-bouncer.yaml and HAProxy snippets under /usr/share/doc/crowdsec-haproxy-spoa-bouncer/examples.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Configures the SPOE agent via /etc/haproxy/crowdsec.cfg, using spoe-message crowdsec-tcp for IP-level decisions and spoe-message crowdsec-http-body / crowdsec-http-no-body groups for HTTP-layer WAF evaluation including request body up to 51200 bytes.
   • Adds WAF (AppSec) evaluation via CrowdSec AppSec — the only HAProxy bouncer with WAF support — enabling real-time WAF protection and virtual patching directly in HAProxy.
   • Supports mTLS to LAPI via cert_path, key_path, and ca_cert_path config keys in crowdsec-spoa-bouncer.yaml.
   • Serves ban and captcha pages natively using HAProxy http-request return with lf-file (log-format file) — no Lua required — with templates at /var/lib/crowdsec-haproxy-spoa-bouncer/html/.

   +6 more show less

   • Provides optional Lua-based dynamic template rendering via lua-load /usr/lib/crowdsec-haproxy-spoa-bouncer/lua/crowdsec.lua, with template paths set via CROWDSEC_BAN_TEMPLATE_PATH and CROWDSEC_CAPTCHA_TEMPLATE_PATH environment variables.
   • Supports real client IP extraction behind CDN/proxy using http-request set-src on X-Real-IP, CF-Connecting-IP, or X-Forwarded-For headers before SPOE group dispatch.
   • Exposes the bouncer as a container image crowdsecurity/spoa-bouncer, configurable via CROWDSEC_KEY and CROWDSEC_URL environment variables, listening on ports 9000 (SPOA) and 6060 (metrics).
   • Injects GeoIP headers (X-Crowdsec-IsoCode) and remediation type (X-Crowdsec-Remediation) as HAProxy transaction variables (txn.crowdsec.isocode, txn.crowdsec.remediation).
   • Supports CAPTCHA remediation (hCaptcha, reCAPTCHA, Turnstile) with cookie management via txn.crowdsec.captcha_cookie and txn.crowdsec.captcha_status variables.
   • Exposes Prometheus metrics on a dedicated port alongside SPOA traffic.

   11 details in Everything

3. docs update Sep 24, 2026 · issue 084

   CrowdSec: Adds BOUNCER_KEY_traefik environment variable wired via secretKeyRef in crowdsec-values.yaml (lapi.env) so the LAPI bouncer key is never committed in plaintext.

   └──▷ USE IT
   Deploy the Traefik bouncer with WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server./AppSecAppSecApplication security: the practice of finding and fixing vulnerabilities in software during design, development, and testing. Cyber tools build on AppSec workflows to shift vulnerability detection earlier in the development lifecycle. enabled in Kubernetes, mounting the LAPI key from a secret to avoid plaintext credentials in manifests.
   bouncer-middleware.yaml copy

   apiVersion: traefik.io/v1alpha1
   kind: Middleware
   metadata:
     name: bouncer
     namespace: traefik
   spec:
     plugin:
       bouncer:
         enabled: true
         crowdsecMode: stream
         crowdsecLapiScheme: http
         crowdsecLapiHost: crowdsec-service.crowdsec.svc.cluster.local:
         crowdsecLapiPath: /
         crowdsecLapiKeyFile: /etc/traefik/crowdsec/BOUNCER_KEY_traefik
         crowdsecAppsecEnabled: true
         crowdsecAppsecHost: crowdsec-appsec-service.crowdsec.svc.cluster.local:
         crowdsecAppsecPath: /
         crowdsecAppsecFailureBlock: true
         crowdsecAppsecUnreachableBlock: true

   Check AppSec is actively blocking after enabling it — inspect per-rule trigger counts without leaving the CLI.
   copy

   $ cscli metrics show appsec

   Load the Traefik bouncer plugin and mount the bouncer key secret into the Traefik pod via Helm values before applying the middleware.
   traefik-values.yaml copy

   experimental:
     plugins:
       bouncer:
         moduleName: github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin
         version: v1.4.5
   volumes:
     - name: crowdsec-bouncer-key
       mountPath: /etc/traefik/crowdsec
       type: secret
       secretName: crowdsec-bouncer-key

   • Adds cscli metrics show appsec command to view processed vs. blocked requests and individual AppSec rule triggers after enabling the AppSec Component.
   • Supports deploying the CrowdSec Traefik bouncer plugin (github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin v1.4.5) on Kubernetes via the experimental.plugins.bouncer key in traefik-values.yaml.

   2 details in Everything

4. docs update Sep 24, 2026 · issue 084

   CrowdSec: Adds CAPTCHA_PROVIDER config key in /etc/crowdsec/bouncers/crowdsec-openresty-bouncer.conf to select among three captcha providers: recaptcha, hcaptcha, or turnstile.

   └──▷ USE IT
   Enable WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server./AppSecAppSecApplication security: the practice of finding and fixing vulnerabilities in software during design, development, and testing. Cyber tools build on AppSec workflows to shift vulnerability detection earlier in the development lifecycle. inspection on all requests, and drop requests whose body cannot be read (e.g. HTTP/2HTTP/2The second major version of the HTTP protocol, standardized by the IETF, adding multiplexed streams, header compression, and binary framing over a single TCP connection to cut latency and reduce overhead. without Content-Length) to prevent WAF bypass.
   /etc/crowdsec/bouncers/crowdsec-openresty-bouncer.conf copy

   APPSEC_URL=http://127.0.0.1:7422
   APPSEC_FAILURE_ACTION=passthrough
   ALWAYS_SEND_TO_APPSEC=false
   APPSEC_DROP_UNREADABLE_BODY=true

   Switch from API key auth to mTLSmTLSMutual TLS, an encrypted connection where both client and server present certificates to prove their identity. It helps services verify who they are communicating with. for hardened, certificate-based communication with the CrowdSec Local API.
   /etc/crowdsec/bouncers/crowdsec-openresty-bouncer.conf copy

   USE_TLS_AUTH=true
   TLS_CLIENT_CERT=/etc/crowdsec/certs/bouncer.crt
   TLS_CLIENT_KEY=/etc/crowdsec/certs/bouncer.key

   Test captcha remediation end-to-end after configuring hCaptcha as the provider.
   copy

   $ sudo cscli decisions add -i <IP_TO_TEST> -t captcha

   • Adds REDIRECT_LOCATION and RET_CODE config keys alongside BAN_TEMPLATE_PATH in /etc/crowdsec/bouncers/crowdsec-openresty-bouncer.conf to control ban remediation response (redirect, custom HTTP code, or custom HTML page).
   • Supports both live mode (per-request Local API query) and stream mode (periodic pull every UPDATE_FREQUENCY seconds) via the MODE config key, with CACHE_EXPIRATION tuning for live mode.
   • Supports IPv4/IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. and IP range-based remediation decisions.

   3 details in Everything

5. docs update Sep 24, 2026 · issue 084

   CrowdSec: Adds crowdsecurity/crs AppSecAppSecApplication security: the practice of finding and fixing vulnerabilities in software during design, development, and testing. Cyber tools build on AppSec workflows to shift vulnerability detection earlier in the development lifecycle. config key to /etc/crowdsec/acquis.d/appsec.yaml appsec_configs list to load CRS rules in out-of-band mode alongside crowdsecurity/appsec-default virtual patching.

   └──▷ TRY IT
   Add non-blocking OWASP CRSOWASP CRSA free, community-maintained ruleset for ModSecurity and compatible WAFs that detects common web attacks like SQLi and XSS, giving cyber tools a ready-made detection baseline without writing rules from scratch. detection on top of existing virtual patching to gain broad attack visibility with zero latency impact on legitimate traffic.
   copy

   $ sudo cscli collections install crowdsecurity/appsec-crs

   Configure /etc/crowdsec/acquis.d/appsec.yaml to layer out-of-band CRS detection alongside in-band virtual patching after installing the crowdsecurity/appsec-crs collection.
   /etc/crowdsec/acquis.d/appsec.yaml copy

   appsec_configs:
     - crowdsecurity/appsec-default
     - crowdsecurity/crs
   labels:
     type: appsec
   listen_addr: :
   source: appsec
   name: myAppSecComponent

   Switch to maximum protection by enabling in-band CRS blocking so SQL injectionSQL injectionAn attack that makes an application treat untrusted input as part of a database command. It can expose or modify data by changing what the query does., XSSXSSCross-site scripting, an attack that runs malicious script in another user's browser through a trusted site. It can steal data or perform actions using the user's session., path traversal, and command injectioncommand injectionAn attack that makes an application execute operating-system commands supplied through untrusted input. It often happens when input is passed unsafely to a shell. are rejected instantly rather than logged.
   copy

   $ sudo cscli collections install crowdsecurity/appsec-crs-inband

   • Adds crowdsecurity/crs-inband AppSec config key to /etc/crowdsec/acquis.d/appsec.yaml appsec_configs list to load CRS rules in blocking (in-band) mode.
   • Documents a three-tier WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server. security enhancement path: basic virtual patching, enhanced out-of-band CRS detection, and maximum in-band CRS blocking.

   2 details in Everything

6. docs update Sep 24, 2026 · issue 084

   CrowdSec: Adds SendChallenge() helper in on_challenge to force re-challenge even when the client already holds a valid cookie.

   └──▷ USE IT
   Reject challenge submissions from clients whose fingerprint signals CDPCDPCisco Discovery Protocol, a Cisco-proprietary Layer 2 protocol that advertises device identity, capabilities, and topology between directly connected Cisco gear, giving cyber tools a passive way to map network infrastructure. automation, using request scoring to set a threshold before denying the cookie.
   yaml copy

   on_challenge_submit:
     - filter: EvaluateMismatches().Has("cdp")
       apply:
         - AddRequestScore(100, "cdp")
     - filter: RequestScore() >= 75
       apply:
         - RejectSubmission("request score " + string(RequestScore()), "verbose")
     - apply:
         - LogAccepted("challenge submission accepted")

   Exempt verified GPTBot crawlers from the JavaScript challenge in pre_eval, so they are never served a proof-of-work.
   yaml copy

   pre_eval:
     - filter: MatchKnownBot(req.RemoteAddr, req.UserAgent(), req.URL.Path, "legit_bots/gptbot.json")
       apply:
         - ExemptFromChallenge("gptbot")

   Force a harder proof-of-work re-challenge on requests where the fingerprint shows high mismatch signals, while allowing clean requests through.
   yaml copy

   on_challenge:
     - filter: EvaluateMismatches().High() >= 1
       apply:
         - SetChallengeDifficulty("high")
         - SendChallenge()

   • Adds SetRemediation(action) and SetReturnCode(code) helpers in on_challenge to override the remediation action and HTTP status code returned to the bouncer.
   • Adds DropRequest(reason) helper in on_challenge to immediately block a request based on fingerprint signals.
   • Adds MatchKnownBot(ip, ua, path, ...files) helper (available in pre_eval, post_eval, on_match) to verify legitimate crawlers against bot definition files in <datadir>/legit_bots/*.json using IP-range and FCrDNS checks; ships via crowdsecurity/appsec-bot-challenge-exclude-* appsec-configs.
   • Adds LogAccepted(msg, verbosity?) helper in on_challenge_submit to emit a structured submission accepted log line with the same verbosity semantics as RejectSubmission.

   4 details in Everything

7. docs update Sep 24, 2026 · issue 084

   CrowdSec: Adds key_rotation_interval config key to control how often signing keys rotate without invalidating already-issued cookies.

   └──▷ USE IT
   Exempt a known search crawler from the bot challenge by IP range so it is never intercepted, even on protected routes.
   yaml copy

   appsec-bot-challenge-exclude-googlebot:
     type: appsec-bot-challenge-exclude
     on_match:
       - MatchKnownBot()
       - ExemptFromChallenge('googlebot')

   Raise the proof-of-work cost and shorten the signing-key rotation window to harden the challenge for a high-value route.
   yaml copy

   appsec:
     bot_detection:
       key_rotation_interval: 1h
       master_secret: '<shared-secret-for-ha>'
     hooks:
       - name: send_challenge
         apply:
           - SetChallengeDifficulty(5)
           - SendChallenge()

   Branch on a specific bot-signal family inside a hook to reject headless browsers while still allowing automation signals that pass the device check.
   yaml copy

   on_submit:
     - if: fingerprint.IsBot() && HasHeadlessSignal()
       apply:
         - RejectSubmission()
     - apply:
         - GrantChallengeCookie()

   • Adds master_secret config key to share a root key across instances in an HA deployment.
   • Adds MatchKnownBot() and ExemptFromChallenge(reason) hook functions to classify and exempt known-good bots per-request.
   • Introduces a bot-detection challenge flow: visitors without a valid __crowdsec_challenge cookie are intercepted by SendChallenge, served a JS proof-of-work + fpscanner device-fingerprint page, and issued a sealed success cookie on passing.
   • Submissions from the browser are POSTed to /crowdsec-internal/challenge/submit and cryptographically validated by the AppSecAppSecApplication security: the practice of finding and fixing vulnerabilities in software during design, development, and testing. Cyber tools build on AppSec workflows to shift vulnerability detection earlier in the development lifecycle. component before a cookie is issued.
   • Decrypts browser fingerprint data into a FingerprintData Go type covering automation signals, device geometry, browser features, WebGL/WebGPUWebGPUA browser standard for using the device's GPU from a web page, which lets models run locally in the browser with no server. graphics, codec hashes, locale, and cross-context consistency checks.

   5 details in Everything

8. docs update Sep 24, 2026 · issue 084

   CrowdSec: Adds crowdsecurity/appsec-bot-challenge-scoring appsec-config that serves the challenge and computes a per-request bot score via AddRequestScore() and SendChallenge() hooks, with per-signal weights (e.g.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ cdp=100, utc_timezone=15).

   └──▷ TRY IT
   Triage bot-detection rejections separately from WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server. and log-based alerts to quickly see which IPs failed the browser challenge.
   copy

   $ sudo cscli alerts list --kind bot-detection --limit 50

   Drill into a specific rejection to read the per-signal score breakdown in score_reasons and identify whether a decision was driven by a strong signal like cdp=100 or an accumulation of weak ones.
   copy

   $ sudo cscli alerts inspect 2019 -d

   • Adds crowdsecurity/appsec-bot-challenge-good-bots and crowdsecurity/appsec-bot-challenge-exclude-paths reusable collections for composing custom bundles without the default threshold.
   • Adds MatchKnownBot() function that checks client IPs against vendor-published ranges and forward-confirmed reverse-DNS; bot definition files are downloaded into <datadir>/legit_bots/.
   • Adds crowdsecurity/rejected-browser-submission per-submission alert (kind bot-detection, alert-only) and crowdsecurity/appsec-bot-challenge-too-many-* behavioral alerts (kind crowdsec, creates block decisions), queryable with cscli alerts list --kind bot-detection.
   • Exposes additional event fields (method, platform, fingerprint_allowlisted, fingerprint_allowlist_reason, full decoded fingerprint under evt.Unmarshaled.fingerprint) readable from evt.Parsed for custom alert context expressions.

   4 details in Everything

9. docs update Sep 24, 2026 · issue 084

   CrowdSec AppSecAppSecApplication security: the practice of finding and fixing vulnerabilities in software during design, development, and testing. Cyber tools build on AppSec workflows to shift vulnerability detection earlier in the development lifecycle. Component adds native YAML rule syntax with in-band/out-of-band evaluation modes and ModSecurityModSecurityAn open-source web application firewall engine, maintained by the OWASP community, that inspects HTTP traffic against rule sets to block malicious requests before they reach an application. seclang import support.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ USE IT
   Detect SQL injectionSQL injectionAn attack that makes an application treat untrusted input as part of a database command. It can expose or modify data by changing what the query does. in any query parameter using the built-in libinjectionSQL matcher with URL-decode pre-processing, to catch obfuscated payloads.
   /etc/crowdsec/appsec-rules/sqli-args.yaml copy

   name: acme/sqli-args
   description: "Detect SQL injection in query string args"
   rules:
     - zones:
         - ARGS
       transform:
         - urldecode
         - lowercase
       match:
         type: libinjectionSQL
         value: ""
   labels:
     type: exploit
     service: http
     behavior: "http:exploit"

   Import an existing ModSecurity rule file into CrowdSec AppSec without rewriting it, placing the conf file in the Linux data directory.
   /etc/crowdsec/appsec-rules/legacy-modsec.yaml copy

   name: acme/legacy-modsec
   description: "Load existing ModSecurity ruleset via seclang"
   seclang_files_rules:
     - my-rule-file.conf

   Use and grouping to block only GET/HEAD requests to a specific URI, combining method and path conditions in a single in-band rule.
   /etc/crowdsec/appsec-rules/protect-admin.yaml copy

   name: acme/protect-admin
   description: "Block GET/HEAD access to /admin"
   rules:
     - and:
         - zones:
             - METHOD
           match:
             type: regex
             value: (GET|HEAD)
         - zones:
             - URI
           match:
             type: startsWith
             value: /admin
   labels:
     type: exploit
     service: http
     behavior: "http:exploit"

   • Introduces native CrowdSec AppSec YAML rule format with name, description, rules, and labels directives for writing WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server.-style detection rules without ModSecurity.
   • Supports in-band and out-of-band rule evaluation modes: in-band rules block requests synchronously and generate alerts; out-of-band rules run asynchronously, emit events into the parsers/scenarios pipeline, and do not generate alerts on their own.
   • Adds match field supporting match types regex, equals, startsWith, endsWith, contains, libinjectionSQL, libinjectionXSS, gt, lt, gte, and lte.
   • Supports boolean and / or grouping of rule conditions; conditions default to or when no operator is specified.

   4 details in Everything

10. docs update Sep 24, 2026 · issue 084

    CrowdSec: Surfaces Malicious Intents breakdowns — categorizing blocked IPs by inferred attack type (spam, scanning, brute-force) derived from community network observations.

    └──▷ HOW TO FIND IT
    Navigate to the Remediation Metrics page in the CrowdSec Console to review blocked attack counts, dropped traffic, and resource savings for your infrastructure.
    📍In the CrowdSec Console, go to Remediation Metrics. Select your desired time period to view Total Prevented Attacks, Malicious Traffic Discarded (raw and estimated), and Projected Resources Saved — with a per-blocklist breakdown for each section.
    • Surfaces Malicious Traffic Dropped/Discarded metrics, reporting both raw (actual packets/requests/bytes dropped by bouncers) and estimated traffic volume, with L4/L7-aware coefficients applied.
    • Adds a per-blocklist breakdown within both the Malicious Traffic Discarded and Projected Resources Saved sections, ordered by each list's contribution to blocked traffic.

    2 details in Everything

11. docs update Sep 24, 2026 · issue 084

    CrowdSec introduces the Service API (SAPI), a premium SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. API with API-key auth and OpenAPIOpenAPIA vendor-neutral specification for describing REST APIs in a machine-readable format, maintained by the OpenAPI Initiative. Cyber tools use it to auto-generate clients, documentation, and validation from a single source of truth. specs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ HOW TO FIND IT
    Create a scoped Service API key in the Console so you can authenticate SAPI calls from scripts or integrations.
    📍In the CrowdSec Console, go to Settings › Service API Keys, click Create API Key, set the desired permissions, then click Create key and copy the key for use in API requests.
    • Adds the Service API (SAPI), a premium endpoint layer exposing CrowdSec SaaS features — new SaaS capabilities will appear on SAPI before their UI counterparts.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Generates Service API keys via the CrowdSec Console under Settings > Service API Keys, with per-key permission scoping.
    • Publishes full API specifications in Redoc and OpenAPI formats.

    3 details in Everything

12. docs update Sep 22, 2026 · issue 082

    CrowdSec adds an Envoy Gateway bouncer for Kubernetes with external authorization and WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server. support⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ TRY IT
    Install the Envoy Gateway bouncer via Helm into an existing cluster, connecting it to in-cluster CrowdSec LAPI and auto-creating SecurityPolicy resources.
    copy

    $ helm install crowdsec-envoy-bouncer oci://ghcr.io/kdwils/charts/envoy-proxy-bouncer \
      --namespace envoy-gateway-system \
      --create-namespace \
      -f envoy-bouncer-values.yaml

    Configure the Envoy bouncer Helm chart to reach CrowdSec LAPI and automatically create a SecurityPolicy for a named Gateway.
    envoy-bouncer-values.yaml copy

    fullnameOverride: crowdsec-envoy-bouncer
    config:
      bouncer:
        enabled: true
        lapiURL: http://crowdsec-service.crowdsec.svc.cluster.local:
        apiKeySecretRef:
          name: crowdsec-envoy-bouncer-secrets
          key: api-key
    securityPolicy:
      create: true
      gatewayName: shared-public
      gatewayNamespace: envoy-gateway-system

    Register the Envoy bouncer API key with CrowdSec LAPI by storing it as a Kubernetes secret and injecting it via BOUNCER_KEY_envoy in the LAPI Helm values.
    crowdsec-values.yaml copy

    lapi:
      env:
        - name: BOUNCER_KEY_envoy
          valueFrom:
            secretKeyRef:
              name: crowdsec-keys
              key: BOUNCER_KEY_envoy

    • Adds BOUNCER_KEY_envoy environment variable in lapi.env (via valueFrom.secretKeyRef) to register the Envoy bouncer key with CrowdSec LAPI in-cluster.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds securityPolicy.create, securityPolicy.gatewayName, and securityPolicy.gatewayNamespace Helm values in envoy-bouncer-values.yaml to auto-create gateway.envoyproxy.io/v1alpha1 SecurityPolicy resources for HTTPRoutes.
    • Adds config.bouncer.lapiURL and config.bouncer.apiKeySecretRef Helm values to connect the Envoy bouncer to CrowdSec LAPI via envoy-bouncer-values.yaml.
    • Adds ENVOY_BOUNCER_BOUNCER_ENABLED, ENVOY_BOUNCER_BOUNCER_APIKEY, ENVOY_BOUNCER_BOUNCER_LAPIURL, ENVOY_BOUNCER_SERVER_GRPCPORT, ENVOY_BOUNCER_SERVER_HTTPPORT, and ENVOY_BOUNCER_SERVER_LOGLEVEL environment variables for raw (non-Helm) Kubernetes Deployment configuration of the Envoy bouncer.
    • Supports deployment of kdwils/envoy-proxy-crowdsec-bouncer as a CrowdSec external authorization bouncer for Envoy Gateway, enforcing IP-based remediation decisions before traffic reaches backends.

    +4 more show less

    • Supports gateway.envoyproxy.io/v1alpha1 SecurityPolicy with extAuth.grpc.backendRefs attached at the HTTPRoute level for scoped, per-application CrowdSec enforcement.
    • Supports cross-namespace bouncer references via gateway.networking.k8s.io/v1beta1 ReferenceGrant when the bouncer Service and SecurityPolicy live in different namespaces.
    • Supports WAF capabilities for real-time WAF protection with SecurityPolicy.spec.extAuth.bodyToExtAuth.maxRequestBytes required when bot detection is enabled.
    • Supports Helm-based installation via oci://ghcr.io/kdwils/charts/envoy-proxy-bouncer chart for the Envoy Gateway bouncer.

    9 details in Everything

13. docs update Sep 22, 2026 · issue 082

    CrowdSec adds Traefik Kubernetes bouncer docs with AppSecAppSecApplication security: the practice of finding and fixing vulnerabilities in software during design, development, and testing. Cyber tools build on AppSec workflows to shift vulnerability detection earlier in the development lifecycle./WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server., stream mode, and secret-backed LAPI key mounting⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ USE IT
    Enable WAF protection on a Traefik ingress in Kubernetes by attaching an AppSec-enabled CrowdSec middleware that blocks malicious requests in real time.
    bouncer-middleware.yaml copy

    apiVersion: traefik.io/v1alpha1
    kind: Middleware
    metadata:
      name: bouncer
      namespace: traefik
    spec:
      plugin:
        bouncer:
          enabled: true
          crowdsecMode: stream
          crowdsecLapiScheme: http
          crowdsecLapiHost: crowdsec-service.crowdsec.svc.cluster.local:
          crowdsecLapiPath: /
          crowdsecLapiKeyFile: /etc/traefik/crowdsec/BOUNCER_KEY_traefik
          crowdsecAppsecEnabled: true
          crowdsecAppsecHost: crowdsec-appsec-service.crowdsec.svc.cluster.local:
          crowdsecAppsecPath: /
          crowdsecAppsecFailureBlock: true
          crowdsecAppsecUnreachableBlock: true

    Store the shared Traefik bouncer key securely in Kubernetes secrets across both namespaces to avoid plaintext keys in Helm values or middleware manifests.
    crowdsec-keys.yaml copy

    apiVersion: v1
    kind: Secret
    metadata:
      name: crowdsec-keys
      namespace: crowdsec
    type: Opaque
    stringData:
      ENROLL_KEY: "<your-existing-enroll-key>"
      BOUNCER_KEY_traefik: "<your-shared-traefik-bouncer-key>"
    ---
    apiVersion: v1
    kind: Secret
    metadata:
      name: crowdsec-bouncer-key
      namespace: traefik
    type: Opaque
    stringData:
      BOUNCER_KEY_traefik: "<your-shared-traefik-bouncer-key>"

    Check how many requests AppSec has processed and blocked, and which rules triggered, after enabling the AppSec Component.
    copy

    $ cscli metrics show appsec

    • Adds crowdsecAppsecEnabled: true to the bouncer middleware spec to enable real-time WAF protection (virtual patching, SQLiSQLiAn attack that makes an application treat untrusted input as part of a database command. It can expose or modify data by changing what the query does., XSSXSSCross-site scripting, an attack that runs malicious script in another user's browser through a trusted site. It can steal data or perform actions using the user's session.) via the CrowdSec AppSec Component.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds crowdsecLapiKeyFile field to the Traefik Middleware CRDCRDA Kubernetes extension that adds a new object type to the cluster, so a tool's configuration is stored, validated and versioned by Kubernetes itself rather than in a file beside it. spec, allowing the LAPI bouncer key to be mounted from a Kubernetes Secret rather than stored in plaintext in the manifest.
    • Adds crowdsecAppsecHost, crowdsecAppsecPath, crowdsecAppsecFailureBlock, crowdsecAppsecUnreachableBlock, and crowdsecAppsecBodyLimit fields to the bouncer middleware spec for fine-grained AppSec routing and failure policy.
    • Adds forwardedHeadersTrustedIps and forwardedHeadersCustomName fields to the bouncer middleware spec to ensure correct client IP propagation behind load balancers and CDNs.
    • Adds crowdsecMode: stream support in the Traefik middleware plugin, enabling decision streaming from CrowdSec LAPI.

    +3 more show less

    • Introduces BOUNCER_KEY_traefik Kubernetes secret pattern (crowdsec-keys in the crowdsec namespace and crowdsec-bouncer-key in the traefik namespace) for sharing the bouncer key across namespaces without committing it in Helm values.
    • Supports appsec source acquisition with crowdsecurity/appsec-virtual-patching, crowdsecurity/appsec-crs, and crowdsecurity/appsec-generic-rules collections via the CrowdSec Helm chart appsec.enabled: true config.
    • Enables AppSec metrics visibility via cscli metrics show appsec once the AppSec Component is active.

    8 details in Everything

14. docs update Sep 22, 2026 · issue 082

    CrowdSec adds a Go-based HAProxy SPOA bouncer with WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server./AppSecAppSecApplication security: the practice of finding and fixing vulnerabilities in software during design, development, and testing. Cyber tools build on AppSec workflows to shift vulnerability detection earlier in the development lifecycle. support, CAPTCHA, GeoIPGeoIPA database that maps IP addresses to geographic locations; tools use it to attribute traffic or alerts to countries, cities, or ASNs without querying external services. headers, and mTLSmTLSMutual TLS, an encrypted connection where both client and server present certificates to prove their identity. It helps services verify who they are communicating with. — the only HAProxy integration with AppSec.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ TRY IT
    Install the SPOA bouncer package on Debian/Ubuntu and get a working default config at /etc/crowdsec/bouncers/crowdsec-spoa-bouncer.yaml when LAPI is on the same host.
    copy

    $ sudo apt install crowdsec-haproxy-spoa-bouncer

    Run the SPOA bouncer as a container — for example in a Docker Compose stack where HAProxy is a separate service — pointing it at your LAPI instance.
    copy

    $ docker run -d \
      --name crowdsec-spoa-bouncer \
      -e CROWDSEC_KEY="<your-lapi-api-key>" \
      -e CROWDSEC_URL="http://crowdsec:8080/" \
      -p :9000 \
      -p :6060 \
      crowdsecurity/spoa-bouncer

    Extract the real client IP from CDNCDNA content delivery network, servers distributed across locations that cache and serve content near readers. It can reduce loading time and traffic to the original server./proxy headers before the SPOE group fires, so CrowdSec evaluates the actual visitor rather than the edge IP.
    copy

    $ # In /etc/haproxy/haproxy.cfg frontend block
    http-request set-src hdr_ip(X-Real-IP) if { req.hdr(X-Real-IP) -m found }
    http-request set-src hdr_ip(CF-Connecting-IP) if { req.hdr(CF-Connecting-IP) -m found } !{ req.hdr(X-Real-IP) -m found }
    http-request set-src hdr_ip(X-Forwarded-For) if { req.hdr(X-Forwarded-For) -m found } !{ req.hdr(X-Real-IP) -m found } !{ req.hdr(CF-Connecting-IP) -m found }
    filter spoe engine crowdsec config /etc/haproxy/crowdsec.cfg
    http-request send-spoe-group crowdsec crowdsec-http-body if body_within_limit || !{ req.body_size -m found }
    http-request send-spoe-group crowdsec crowdsec-http-no-body if !body_within_limit { req.body_size -m found }

    • Adds cs-haproxy-spoa-bouncer configured via /etc/crowdsec/bouncers/crowdsec-spoa-bouncer.yaml, integrating CrowdSec with HAProxy over the SPOE protocol to enforce ban, CAPTCHA, and allow decisions natively — replacing the old Lua-based bouncer.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds SPOE agent configuration at /etc/haproxy/crowdsec.cfg with spoe-message definitions (crowdsec-tcp, crowdsec-http-body, crowdsec-http-no-body) and spoe-group entries to split TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it.-level and HTTP-level checks.
    • Adds WAF / AppSec evaluation support — the only HAProxy bouncer to pass request body, headers, method, path, query, and URL to CrowdSec AppSec via the crowdsec-http-body SPOE group.
    • Supports mTLS to LAPI via cert_path, key_path, and ca_cert_path config keys in crowdsec-spoa-bouncer.yaml.
    • Supports CAPTCHA remediation (hCaptcha, reCAPTCHA, Turnstile) with cookie management via txn.crowdsec.captcha_cookie and txn.crowdsec.captcha_status HAProxy transaction variables.

    +5 more show less

    • Adds GeoIP header injection (X-Crowdsec-IsoCode) and remediation header (X-Crowdsec-Remediation) driven by txn.crowdsec.isocode and txn.crowdsec.remediation SPOE variables.
    • Serves ban and CAPTCHA HTML pages natively using HAProxy http-request return with lf-file (log-format file) — no Lua required; templates stored in /var/lib/crowdsec-haproxy-spoa-bouncer/html/.
    • Provides optional Lua-based dynamic template rendering via lua-load /usr/lib/crowdsec-haproxy-spoa-bouncer/lua/crowdsec.lua with CROWDSEC_BAN_TEMPLATE_PATH and CROWDSEC_CAPTCHA_TEMPLATE_PATH environment variables.
    • Supports real-client-IP extraction from X-Real-IP, CF-Connecting-IP, and X-Forwarded-For headers via http-request set-src before the SPOE group is called, for deployments behind CDNs or upstream proxies.
    • Publishes a container image crowdsecurity/spoa-bouncer configurable via CROWDSEC_KEY and CROWDSEC_URL environment variables, exposing the SPOA listener on port 9000 and metrics on port 6060.

    10 details in Everything

15. docs update Sep 22, 2026 · issue 082

    CrowdSec OpenResty bouncer adds Lua-based WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server./AppSecAppSecApplication security: the practice of finding and fixing vulnerabilities in software during design, development, and testing. Cyber tools build on AppSec workflows to shift vulnerability detection earlier in the development lifecycle., mTLSmTLSMutual TLS, an encrypted connection where both client and server present certificates to prove their identity. It helps services verify who they are communicating with., captcha (reCAPTCHA/hCaptcha/Turnstile), live/stream remediation, and full config reference⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ USE IT
    Enable the WAF/AppSec component to get real-time virtual patching against SQLiSQLiAn attack that makes an application treat untrusted input as part of a database command. It can expose or modify data by changing what the query does. and XSSXSSCross-site scripting, an attack that runs malicious script in another user's browser through a trusted site. It can steal data or perform actions using the user's session., and drop requests whose bodies cannot be inspected to prevent bypasses.
    /etc/crowdsec/bouncers/crowdsec-openresty-bouncer.conf copy

    APPSEC_URL=http://127.0.0.1:7422
    APPSEC_FAILURE_ACTION=passthrough
    ALWAYS_SEND_TO_APPSEC=false
    APPSEC_DROP_UNREADABLE_BODY=true

    Switch from API-key auth to mTLS when the CrowdSec Local API requires client certificate authentication.
    /etc/crowdsec/bouncers/crowdsec-openresty-bouncer.conf copy

    USE_TLS_AUTH=true
    TLS_CLIENT_CERT=/etc/crowdsec/tls/client.crt
    TLS_CLIENT_KEY=/etc/crowdsec/tls/client.key

    Test captcha remediation against a specific IP by issuing a captcha decision via the CLI.
    copy

    $ sudo cscli decisions add -i 198.51.100.42 -t captcha

    • Adds APPSEC_URL, APPSEC_FAILURE_ACTION, APPSEC_CONNECT_TIMEOUT, APPSEC_SEND_TIMEOUT, APPSEC_PROCESS_TIMEOUT, ALWAYS_SEND_TO_APPSEC, and APPSEC_DROP_UNREADABLE_BODY keys to /etc/crowdsec/bouncers/crowdsec-openresty-bouncer.conf to enable and tune the Application Security (WAF) Component for virtual patching, SQLi, and XSS defense.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds USE_TLS_AUTH, TLS_CLIENT_CERT, and TLS_CLIENT_KEY configuration keys to /etc/crowdsec/bouncers/crowdsec-openresty-bouncer.conf to enable mutual TLSmutual TLSMutual TLS, an encrypted connection where both client and server present certificates to prove their identity. It helps services verify who they are communicating with. (mTLS) authentication with the CrowdSec Local API in place of API keys.
    • Adds CAPTCHA_PROVIDER to /etc/crowdsec/bouncers/crowdsec-openresty-bouncer.conf supporting recaptcha, hcaptcha, and turnstile providers alongside SECRET_KEY, SITE_KEY, CAPTCHA_TEMPLATE_PATH, and CAPTCHA_EXPIRATION for captcha remediation.
    • Adds override support via /etc/crowdsec/bouncers/crowdsec-nginx-bouncer.conf.local, which takes precedence over the main config file without requiring all fields to be present.
    • Supports BOUNCING_ON_TYPE set to all, ban, or captcha to selectively apply remediation types, with FALLBACK_REMEDIATION controlling behavior for unknown decision types.

    +4 more show less

    • Supports live and stream remediation modes via MODE in /etc/crowdsec/bouncers/crowdsec-openresty-bouncer.conf, with stream mode pulling decisions from the Local API on a configurable UPDATE_FREQUENCY.
    • Provides REDIRECT_LOCATION, BAN_TEMPLATE_PATH, and RET_CODE config keys for customizing ban remediation responses, with REDIRECT_LOCATION taking priority over the other two.
    • Deploys OpenResty configuration at /usr/local/openresty/nginx/conf/conf.d/crowdsec_openresty.conf using access_by_lua_block and init_worker_by_lua_block to enforce decisions and set up stream mode and metrics per worker.
    • Supports configurable shared cache size via lua_shared_dict crowdsec_cache 50m in the OpenResty configuration.

    9 details in Everything

16. docs update Sep 22, 2026 · issue 082

    CrowdSec WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server. gains documented progressive deployment paths: out-of-band CRS detection and in-band CRS blocking alongside virtual patching⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ TRY IT
    Add non-blocking OWASP CRSOWASP CRSA free, community-maintained ruleset for ModSecurity and compatible WAFs that detects common web attacks like SQLi and XSS, giving cyber tools a ready-made detection baseline without writing rules from scratch. detection on top of an existing virtual patching deployment to gain OWASPOWASPA nonprofit foundation that publishes open standards, guides, and ranked vulnerability lists—most famously the OWASP Top 10—giving cyber tools a vendor-neutral benchmark to test or report against. Top 10 visibility with zero latency impact.
    copy

    $ sudo cscli collections install crowdsecurity/appsec-crs

    Configure /etc/crowdsec/acquis.d/appsec.yaml to load both virtual patching (in-band blocking) and OWASP CRS (out-of-band detection) simultaneously.
    /etc/crowdsec/acquis.d/appsec.yaml copy

    appsec_configs:
      - crowdsecurity/appsec-default  # Virtual patching rules (in-band blocking)
      - crowdsecurity/crs              # OWASP CRS rules (out-of-band detection)
    labels:
      type: appsec
    listen_addr: :
    source: appsec
    name: myAppSecComponent

    Upgrade to maximum protection by switching to in-band CRS blocking, so SQL injectionSQL injectionAn attack that makes an application treat untrusted input as part of a database command. It can expose or modify data by changing what the query does., XSSXSSCross-site scripting, an attack that runs malicious script in another user's browser through a trusted site. It can steal data or perform actions using the user's session., command injectioncommand injectionAn attack that makes an application execute operating-system commands supplied through untrusted input. It often happens when input is passed unsafely to a shell., and path traversal are blocked immediately rather than flagged asynchronously.
    copy

    $ sudo cscli collections install crowdsecurity/appsec-crs-inband

    • Adds crowdsecurity/appsec-crs collection for out-of-band OWASP CRS detection layered alongside existing virtual patching, installed via cscli collections install crowdsecurity/appsec-crs, configured in /etc/crowdsec/acquis.d/appsec.yaml.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds crowdsecurity/appsec-crs-inband collection for immediate in-band blocking using OWASP CRS rules alongside virtual patching, installed via cscli collections install crowdsecurity/appsec-crs-inband.
    • Adds crowdsecurity/crowdsec-appsec-outofband scenario (bundled with crowdsecurity/appsec-crs) that automatically bans IPs triggering 5 or more distinct out-of-band CRS violations in a short period.

    3 details in Everything

17. docs update Sep 22, 2026 · issue 082

    CrowdSec AppSecAppSecApplication security: the practice of finding and fixing vulnerabilities in software during design, development, and testing. Cyber tools build on AppSec workflows to shift vulnerability detection earlier in the development lifecycle. gains bot-detection hooks with fingerprint helpers, request scoring, known-bot exemptions, and challenge difficulty controls⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ USE IT
    Accumulate a score across bot signals in on_challenge_submit and reject submissions that cross a threshold, with verbose fingerprint logging for post-incident review.
    yaml copy

    on_challenge_submit:
      - filter: EvaluateMismatches().Has("cdp")
        apply:
          - AddRequestScore(100, "cdp")
      - filter: RequestScore() >= 75
        apply:
          - RejectSubmission("request score " + string(RequestScore()), "verbose")
      - apply:
          - LogAccepted("challenge submission accepted")

    Exempt verified AI crawlers (e.g. GPTBot) from the JavaScript challenge in pre_eval by checking both User-Agent and FCrDNS-validated IP against the shipped bot-definition file.
    yaml copy

    pre_eval:
      - filter: MatchKnownBot(req.RemoteAddr, req.UserAgent(), req.URL.Path, "legit_bots/gptbot.json")
        apply:
          - ExemptFromChallenge("gptbot")

    Enforce that clients must have solved the bot challenge before hitting API endpoints in a SPA, dropping requests that arrive without a valid cookie.
    yaml copy

    inband:
      pre_eval:
        - filter: req.URL.Path startswith "/api" && !HasValidChallengeCookie()
          apply:
            - DropRequest("challenge must be solved before accessing the API")

    • Adds on_challenge_submit hook that fires after cryptographic validation of a challenge response but before the success cookie is issued, enabling automation-based rejections via RejectSubmission(reason, verbosity?) and inline cookie grants via GrantChallengeCookie(reason, ttl?).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds RejectSubmission(reason, verbosity?) helper to refuse cookie issuance despite a valid crypto submission; verbosity accepts 'minimal', 'info' (default), or 'verbose' to control fingerprint detail in logs.
    • Adds GrantChallengeCookie(reason, ttl?) helper to issue the challenge cookie inline in the submit response (skipping the 307 redirect); ttl is a Go duration string like '24h' and overrides the configured cookie_ttl.
    • Adds CancelAlert() and SendAlert() helpers in on_challenge_submit to suppress or re-enable the alert produced by a rejection.
    • Adds DumpFingerprint(label) helper that appends the decrypted fingerprint plus request context as a JSONLJSONLA text format where each line is a self-contained, valid JSON object, making it easy to stream, append, and process large datasets line by line without parsing a full JSON array into memory. line to a dump file for offline analysis, returning the file path.

    +9 more show less

    • Adds EvaluateMismatches() helper returning a MismatchReport object in both on_challenge_submit and on_challenge hooks to run configured mismatch checks against the decrypted fingerprint.
    • Adds on_challenge hook that fires for in-band requests carrying a valid __crowdsec_challenge cookie, exposing the decoded device fingerprint and helpers including SendChallenge(), SetChallengeDifficulty(level), SetRemediation(action), SetReturnCode(code), and DropRequest(reason).
    • Adds fingerprint mismatch helpers fingerprint.UAMobileMismatch(), fingerprint.AcceptLanguageMismatch(req), and fingerprint.TimezoneCountryMismatch(country) for per-request bot signal cross-checks in on_challenge.
    • Adds request-scoring helpers AddRequestScore(points, reason), RequestScore(), RequestScoreReasons(), RequestScoreDetail(), and RequestScoreFor(reason) available across pre_eval, post_eval, on_match, on_challenge, and on_challenge_submit; score breakdown lands in alerts as request_score_reasons.
    • Adds MatchKnownBot(ip, ua, path, ...files) helper (available in pre_eval, post_eval, on_match) that validates a request against named bot-definition JSON files under <datadir>/legit_bots/*.json, requiring both UA match and FCrDNS or published IP-range verification; fail-closed on DNS failure or parse error.
    • Adds ExemptFromChallenge(reason) helper for per-request bot exemption (no cookie); exemption is labeled in logs and the cs_appsec_challenge_exempt_total metric, and makes SendChallenge() a no-op for the rest of that request.
    • Adds HasValidChallengeCookie() helper (available in pre_eval, post_eval, on_match, in-band and out-of-band) returning true when the request carries a valid __crowdsec_challenge cookie or an earlier hook called ExemptFromChallenge().
    • Adds SetChallengeDifficulty(level) accepting 'disabled' (0 bits), 'low' (18 bits, ~262k hashes), 'medium' (20 bits, ~1M hashes, default), 'high' (22 bits, ~4M hashes), and 'impossible' (256 bits, server-side hard block).
    • Ships crowdsecurity/appsec-bot-challenge-exclude-* appsec-config collections (search-engines, ai-crawlers, social, monitoring) that declare and load known-bot definition files and call MatchKnownBot in pre_eval.

    14 details in Everything

18. docs update Sep 22, 2026 · issue 082

    CrowdSec AppSecAppSecApplication security: the practice of finding and fixing vulnerabilities in software during design, development, and testing. Cyber tools build on AppSec workflows to shift vulnerability detection earlier in the development lifecycle. gains configurable bot-detection settings: signing keys, rotation, cookie lifetime, and JS obfuscation pooling.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ USE IT
    Share a consistent master_secret and key_rotation_interval across all AppSec nodes so challenge cookies issued by one instance are accepted by every other node in an HA deployment.
    /etc/crowdsec/appsec-configs/mycorp-overlay.yaml copy

    # /etc/crowdsec/appsec-configs/mycorp-overlay.yaml
    challenge:
      master_secret: "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
      key_rotation_interval: 5m
      cookie_ttl: 12h

    Generate a cryptographically strong master_secret value suitable for use in challenge: config.
    copy

    $ openssl rand -hex 32

    Raise log_level for the challenge runtime to debug and bump max_live_epochs to accommodate slow mobile clients, without touching the upstream collection appsec-config.
    /etc/crowdsec/appsec-configs/mycorp-overlay.yaml copy

    # /etc/crowdsec/appsec-configs/mycorp-overlay.yaml
    challenge:
      log_level: debug
      max_live_epochs: 3

    • Adds master_secret under challenge: in an appsec-config YAML file to set a shared long-lived secret for multi-instance AppSec deployments, required when running more than one AppSec instance so cookies issued by one node are accepted by another.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds key_rotation_interval (default 5m, minimum 30s) under challenge: to control how frequently the per-epoch signing key advances across all AppSec instances.
    • Adds max_live_epochs under challenge: to control how many past epochs remain accepted, tunable for slow mobile networks or long round-trips.
    • Adds cookie_ttl (default 12h) under challenge: to set how long a successful-challenge cookie stays valid, independent of key rotation.
    • Adds crypto_obfuscation_pool_size under challenge: to control how many distinct obfuscations of the per-epoch sign-key module are kept per live epoch.

    +5 more show less

    • Adds max_cookie_size under challenge: as an upper bound in bytes on the sealed challenge cookie, closing an over-allocation DoS vector.
    • Adds spent_set_max_entries under challenge: to cap the replay-protection set that prevents a solved challenge from being submitted twice.
    • Adds log_level under challenge: to set challenge-runtime log verbosity (debug, info, warning, error) independently of the global CrowdSec log level.
    • Supports overlay appsec-config files that merge field-by-field with upstream collection configs, letting operators ship a small override without modifying upstream files.
    • Exposes challenge submission and rejection events in /var/log/crowdsec.log filterable by challenge submission and on_challenge_submit for live verification.

    10 details in Everything

19. docs update Sep 22, 2026 · issue 082

    CrowdSec AppSecAppSecApplication security: the practice of finding and fixing vulnerabilities in software during design, development, and testing. Cyber tools build on AppSec workflows to shift vulnerability detection earlier in the development lifecycle. bot detection gains overlay config recipes for per-path/per-host challenge scoping, difficulty tuning, probe allowlisting, and custom known-bot files⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ USE IT
    Restrict bot challenges to only the checkout funnel, leaving all other paths unchallenged, without touching upstream collection files.
    /etc/crowdsec/appsec-configs/mycorp-challenge-checkout-only.yaml copy

    # /etc/crowdsec/appsec-configs/mycorp-challenge-checkout-only.yaml
    name: mycorp/appsec-bot-challenge-checkout-only
    inband:
      pre_eval:
        - filter: '!(req.URL.Path startsWith "/checkout/")'
          apply:
            - ExemptFromChallenge("outside-checkout")

    Raise proof-of-work difficulty on login/auth routes to slow credential-stuffing bots while keeping it low on the mobile API where client CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. is limited.
    /etc/crowdsec/appsec-configs/mycorp-challenge-difficulty.yaml copy

    # /etc/crowdsec/appsec-configs/mycorp-challenge-difficulty.yaml
    name: mycorp/appsec-bot-challenge-difficulty
    inband:
      pre_eval:
        - filter: 'req.URL.Path startsWith "/login" || req.URL.Path startsWith "/auth"'
          apply:
            - SetChallengeDifficulty("high")
        - filter: 'req.URL.Path startsWith "/m/"'
          apply:
            - SetChallengeDifficulty("low")

    Register a private uptime monitor as a known bot so it is never challenged, using IP ranges and a path restriction to avoid spoofing via User-Agent alone.
    /etc/crowdsec/appsec-configs/mycorp-known-bot.yaml copy

    # /etc/crowdsec/appsec-configs/mycorp-known-bot.yaml
    name: mycorp/appsec-bot-challenge-known-bot
    inband:
      pre_eval:
        - filter: 'MatchKnownBot(req.RemoteAddr, req.UserAgent(), req.URL.Path, "legit_bots/mybot.json")'
          apply:
            - ExemptFromChallenge("mybot")
    data:
      - source_url: https://example.com/mybot.json
        dest_file: legit_bots/mybot.json
        type: bots

    • Adds ExemptFromChallenge(reason) helper callable in pre_eval hooks to flag a request as exempt so SendChallenge() becomes a no-op for it, enabling per-path or per-host challenge scoping.
    • Adds GrantChallengeCookie(label, duration) helper to mint a session cookie (e.g. GrantChallengeCookie("internal-probe", "24h")) so cookie-capable clients are waved through for an entire session window without re-checking the exemption condition on every request.
    • Adds SetChallengeDifficulty(level) helper available in pre_eval, post_eval, and on_challenge hooks to set proof-of-work difficulty ("low", "medium", "high") per route before the challenge is issued.
    • Adds MatchKnownBot(remoteAddr, userAgent, path, file) helper to match requests against custom bot-description JSON files stored under <datadir>/legit_bots/ (typically /var/lib/crowdsec/data/legit_bots/), with a data: section in the appsec-config declaring the source_url, dest_file, and type: bots for each file.
    • Adds custom known-bot JSON file format (newline-delimited JSON objects) supporting fields name, user_agent, paths, ips, ranges, and rdns — where at least one of ips, ranges, or rdns is required per entry — for defining privately recognised legitimate bots.

    +2 more show less

    • Supports listing custom overlay appsec-config names explicitly in appsec_configs: inside /etc/crowdsec/acquis.d/appsec.yaml alongside the crowdsecurity/appsec-bot-* wildcard, since custom namespaced names are not matched by the wildcard.
    • Exposes req.Host and req.URL.Path in all in-band hook expressions, enabling pre_eval filters that scope challenges to specific virtual hosts and path prefixes within a single AppSec component.

    7 details in Everything

20. docs update Sep 22, 2026 · issue 082

    CrowdSec AppSecAppSecApplication security: the practice of finding and fixing vulnerabilities in software during design, development, and testing. Cyber tools build on AppSec workflows to shift vulnerability detection earlier in the development lifecycle. adds bot detection via browser proof-of-work, device fingerprinting, and sealed challenge cookies⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • Adds SendChallenge(), GrantChallengeCookie(), RejectSubmission(), and HasValidChallengeCookie() hook functions that activate the bot-detection challenge runtime when referenced by a loaded hook.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Introduces SetChallengeDifficulty to tune the cost of the proof-of-work puzzle served to browser clients.
    • Adds key_rotation_interval config key to control how frequently signing keys rotate, with a separate long-lived master_secret that must be shared across instances in an HA deployment.
    • Introduces appsec-bot-challenge-exclude-* configs with MatchKnownBot() and ExemptFromChallenge(reason) to skip legitimate non-browser clients (crawlers, uptime probes) without minting a challenge cookie.
    • Adds fingerprint signal helpers — HasAutomationSignal(), HasImpossibleDeviceSignal(), HasHeadlessSignal(), HasMismatchSignal(), and fingerprint.IsBot() — for branching on specific bot-detection verdicts derived from the FingerprintData object.

    +3 more show less

    • Adds a __crowdsec_challenge sealed cookie carrying device fingerprint and expiry timestamp so validated browsers are not re-challenged on subsequent requests.
    • Serves the challenge submission endpoint at /crowdsec-internal/challenge/submit where browsers POST their proof-of-work and encrypted fingerprint for cryptographic validation.
    • Ships behavioral scenarios in the bot-detection collection that watch across requests (too many challenge requests, too many submissions) and create decisions to block repeat offenders at the bouncer.

    8 details in Everything

21. docs update Sep 22, 2026 · issue 082

    CrowdSec adds crowdsecurity/appsec-bot-challenge collection with scored bot detection, verified-bot exclusions, and behavioral block scenarios.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ TRY IT
    List only bot-challenge rejections in your alert feed, separated from WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server. and log-based alerts.
    copy

    $ sudo cscli alerts list --kind bot-detection --limit 50

    Drill into a specific bot rejection to see which signals accumulated (e.g. cdp=100,utc_timezone=15) and confirm whether it was decisive automation or a borderline accumulation.
    copy

    $ sudo cscli alerts inspect 2019 -d

    • Adds crowdsecurity/appsec-bot-challenge-scoring-balanced appsec-config that rejects any submission scoring >= 75 via RejectSubmission(), separating threshold policy from scoring logic so either can be swapped independently.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds three ready-made threshold collections — crowdsecurity/appsec-bot-challenge (>= 75, default), crowdsecurity/appsec-bot-challenge-strict (>= 45), and crowdsecurity/appsec-bot-challenge-permissive (>= 100) — to tune false-positive tolerance without rebuilding the scoring engine.
    • Adds --kind bot-detection flag to cscli alerts list to filter bot-challenge rejections away from WAF and log-based alerts.
    • Adds cscli alerts inspect <id> -d output fields score_reasons, request_score, fingerprint_id, bot_detected, challenge_event, and fail_reason via the crowdsecurity/appsec-bot-detection alert context, making each rejection self-explaining.
    • Adds four verified-bot identity exclude-configs — crowdsecurity/appsec-bot-challenge-exclude-search-engines, crowdsecurity/appsec-bot-challenge-exclude-ai-crawlers, crowdsecurity/appsec-bot-challenge-exclude-social, and crowdsecurity/appsec-bot-challenge-exclude-monitoring — each using MatchKnownBot() with FCrDNS/IP-range verification and ExemptFromChallenge(reason) to pass legitimate crawlers without issuing a cookie.

    +1 more show less

    • Exposes additional event fields (challenge_event, challenge_fail_reason, request_score, request_score_reasons, challenge_difficulty, fsid, fingerprint_bot, os, http_user_agent, source_ip, target_host, target_uri, request_uuid) for use in custom alert context expressions, with evt.Parsed and evt.Unmarshaled.fingerprint accessible for fields not promoted to evt.Meta.

    6 details in Everything

22. docs update Sep 22, 2026 · issue 082

    CrowdSec adds AppSecAppSecApplication security: the practice of finding and fixing vulnerabilities in software during design, development, and testing. Cyber tools build on AppSec workflows to shift vulnerability detection earlier in the development lifecycle. bot detection via proof-of-work challenges, CDPCDPCisco Discovery Protocol, a Cisco-proprietary Layer 2 protocol that advertises device identity, capabilities, and topology between directly connected Cisco gear, giving cyber tools a passive way to map network infrastructure. fingerprinting, and per-engine PrometheusPrometheusAn open-source monitoring system maintained by the CNCF that scrapes and stores time-series metrics, giving cyber tools a standard way to expose and query operational data. metrics.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ TRY IT
    Enable bot detection at the default (balanced) threshold by installing the collection and activating it in the AppSec acquisition file.
    copy

    $ sudo cscli collections install crowdsecurity/appsec-bot-challenge

    Configure the AppSec datasource to load the bot detection configs automatically via wildcard so all installed scoring and exclusion configs are picked up.
    /etc/crowdsec/acquis.d/appsec.yaml copy

    source: appsec
    listen_addr: :
    appsec_configs:
      - crowdsecurity/appsec-default
      - crowdsecurity/appsec-bot-*
    labels:
      type: appsec

    Review the challenge funnel and see why individual clients were rejected — useful after tuning the threshold or investigating false positives.
    copy

    $ sudo cscli metrics show bot-detection
    sudo cscli alerts list --kind bot-detection --limit 20
    sudo cscli alerts inspect <ID> -d

    • Installs bot detection via cscli collections install crowdsecurity/appsec-bot-challenge, which bundles appsec-configs, scenarios, and parsers into a single collection.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds crowdsecurity/appsec-bot-challenge-strict (rejects at >= 45) and crowdsecurity/appsec-bot-challenge-permissive (rejects at >= 100) as alternative threshold bundles alongside the default crowdsecurity/appsec-bot-challenge (rejects at >= 75).
    • Loads bot detection into the AppSec acquisition by adding crowdsecurity/appsec-bot-* (or a wildcard) to the appsec_configs: list in /etc/crowdsec/acquis.d/appsec.yaml.
    • Exposes per-engine bot detection metrics — Requested, Submitted, Solved, Granted, Exempt, Protocol Failures, Submissions Rejected, Cookies Invalid — via cscli metrics show bot-detection.
    • Detects Chrome DevTools Protocol (CDP) automation as a high-severity fingerprint signal worth 100 points, rejecting Puppeteer, Playwright/Chromium, and any Chrome launched with --remote-debugging-port.

    +1 more show less

    • Rejection events are logged with structured fields including automation, is_bot, platform, reason, signals, source, and timezone at the on_challenge_submit rejected log line.

    6 details in Everything

23. docs update Sep 22, 2026 · issue 082

    CrowdSec AppSecAppSecApplication security: the practice of finding and fixing vulnerabilities in software during design, development, and testing. Cyber tools build on AppSec workflows to shift vulnerability detection earlier in the development lifecycle. rules syntax documented: in-band/out-of-band detection, 15+ request zones, transforms, and ModSecurityModSecurityAn open-source web application firewall engine, maintained by the OWASP community, that inspects HTTP traffic against rule sets to block malicious requests before they reach an application. seclang import⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ USE IT
    Detect a POST with a suspicious JSON body key using zone targeting and base64-lenient decoding to catch obfuscated payloads
    /etc/crowdsec/appsec-rules/detect-obfuscated-json-sqli.yaml copy

    name: myorg/detect-obfuscated-json-sqli
    description: 'Detect SQL injection in JSON body field after lenient base64 decode'
    rules:
      - zones:
          - BODY_ARGS
        variables:
          - json.payload
        transform:
          - b64decode_lenient
          - lowercase
        match:
          type: libinjectionSQL
          value: ''
    labels:
      type: exploit
      service: http
      behavior: 'http:exploit'

    Migrate an existing ModSecurity ruleset into CrowdSec AppSec by referencing a seclang-format file from the data directory
    /etc/crowdsec/appsec-rules/legacy-modsec-rules.yaml copy

    name: myorg/legacy-modsec-rules
    description: 'Load legacy ModSecurity rules from file'
    seclang_rules_file:
      - my-legacy-rules.conf
    labels:
      type: exploit
      service: http

    Block requests only when both the HTTP method is GET/HEAD AND the URI matches a known probe path — using and grouping for compound detection
    /etc/crowdsec/appsec-rules/probe-detection.yaml copy

    name: myorg/probe-detection
    description: 'Detect known probe URI on GET/HEAD only'
    rules:
      - and:
          - zones:
              - METHOD
            match:
              type: regex
              value: (GET|HEAD)
          - zones:
              - URI
            match:
              type: startsWith
              value: /admin
    labels:
      type: exploit
      service: http
      behavior: 'http:exploit'

    • Adds seclang_rules parameter in AppSec rule files to embed ModSecurity/seclang rules inline without a separate file⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds seclang_rules_file parameter in AppSec rule files to load ModSecurity rules from a file in the CrowdSec data directory (/var/lib/crowdsec/data on Linux, /var/db/crowdsec/data on FreeBSD, C:\programdata\crowdsec\data on Windows)
    • Adds variables field to rule conditions, restricting match to specific keys within ARGS, BODY_ARGS, HEADERS, and COOKIES zones — supports literal keys or RE2RE2A regular-expression engine developed by Google that guarantees linear-time matching, preventing the catastrophic backtracking that plagues PCRE-style engines and making it safe to run untrusted patterns. regex patterns wrapped in slashes (e.g. /pattern_.*/)
    • Adds and / or boolean grouping operators to rule conditions inside rules arrays for compound multi-condition detection logic
    • Supports b64decode_lenient transform — decodes base64 without strict padding, skipping whitespace and dots, and stopping at the first invalid character

    +4 more show less

    • Supports normalize_path_win (alias normalizepathwin) transform for Windows-style path normalization including backslash handling
    • Introduces in-band AppSec rules that evaluate synchronously and trigger real-time blocking with an alert, versus out-of-band rules that evaluate asynchronously and emit events through the parsers/scenarios pipeline without blocking requests
    • Supports transform pipeline on rule conditions with operations including cmdline (command-line obfuscation decode), js_decode, css_decode, hexdecode, htmlentitydecode, remove_comments, replace_comments, remove_nulls, replace_nulls, compress_whitespaces, and remove_whitespaces
    • Supports match types libinjectionSQL and libinjectionXSS for detecting SQL injectionSQL injectionAn attack that makes an application treat untrusted input as part of a database command. It can expose or modify data by changing what the query does. and XSSXSSCross-site scripting, an attack that runs malicious script in another user's browser through a trusted site. It can steal data or perform actions using the user's session. via libinjection, plus numeric comparators gt, lt, gte, lte for zone values like FILES_TOTAL_SIZE

    9 details in Everything

24. docs update Sep 22, 2026 · issue 082

    CrowdSec AppSecAppSecApplication security: the practice of finding and fixing vulnerabilities in software during design, development, and testing. Cyber tools build on AppSec workflows to shift vulnerability detection earlier in the development lifecycle. configuration files documented: rule loading, hooks, HTTP codes, and per-band performance tuning via YAML⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ USE IT
    Suppress blocking on a staging host while still generating alerts — use the on_match hook to override remediation conditionally.
    /etc/crowdsec/appsec-configs/my-appsec-config.yaml copy

    name: custom/my-appsec-config
    inband_rules:
      - crowdsecurity/base-config
      - crowdsecurity/vpatch-*
    default_remediation: ban
    blocked_http_code: 403
    passed_http_code: 200
    on_match:
      - filter: req.Host == "staging.example.com"
        apply:
          - SetRemediation("allow")
          - CancelAlert()

    Limit in-band body inspection to 512 KB and skip body inspection entirely for out-of-band rules to reduce latency on high-traffic endpoints.
    /etc/crowdsec/appsec-configs/my-appsec-config.yaml copy

    name: custom/my-appsec-config
    inband_rules:
      - crowdsecurity/base-config
    outofband_rules:
      - crowdsecurity/crs
    inband_options:
      disable_body_inspection: false
      request_body_in_memory_limit: 524288
    outofband_options:
      disable_body_inspection: true
    default_remediation: ban
    log_level: warn

    Strip a problematic rule at load time and remove a strict rule only for internal IPs before evaluation, using on_load and pre_eval hooks.
    /etc/crowdsec/appsec-configs/my-appsec-config.yaml copy

    name: custom/my-appsec-config
    inband_rules:
      - crowdsecurity/base-config
    default_remediation: ban
    on_load:
      - apply:
          - RemoveInBandRuleByName("problematic-rule")
    pre_eval:
      - filter: IsInBand && req.RemoteAddr == "192.168.1.100"
        apply:
          - RemoveInBandRuleByName("strict-rule")

    • Adds inband_rules and outofband_rules array keys to AppSec config files (stored in /etc/crowdsec/appsec-configs/) for loading rule patterns into in-band vs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ out-of-band processing pipelines.
    • Adds default_remediation key (values: ban, captcha, allow) and default_pass_action key to control blocking and pass behavior per AppSec config.
    • Adds blocked_http_code, passed_http_code, user_blocked_http_code, and user_passed_http_code integer keys to configure HTTP status codes returned to the remediation component and to the end user independently.
    • Adds inband_options and outofband_options objects with disable_body_inspection (bool) and request_body_in_memory_limit (integer, default: 1048576 bytes) for per-band performance tuning.
    • Adds lifecycle hooks on_load, pre_eval, post_eval, and on_match arrays supporting filter and apply expressions to manipulate rules and remediation at each stage of request evaluation.

    +1 more show less

    • Adds data array key to declare datafiles (with source_url, dest_file, and type fields) that cscli downloads from the hub, enabling bot-detection configs to ship known-bot definitions consumed by MatchKnownBot.

    6 details in Everything

25. docs update Sep 22, 2026 · issue 082

    CrowdSec AppSecAppSecApplication security: the practice of finding and fixing vulnerabilities in software during design, development, and testing. Cyber tools build on AppSec workflows to shift vulnerability detection earlier in the development lifecycle. Component (WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server.) general setup guide documents acquisition config, virtual patching, and detection testing⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ TRY IT
    Bootstrap the AppSec Component acquisition datasource so CrowdSec begins listening for forwarded HTTP requests from your reverse proxy.
    copy

    $ sudo mkdir -p /etc/crowdsec/acquis.d/
    sudo cat > /etc/crowdsec/acquis.d/appsec.yaml <<EOF
    appsec_configs:
      - crowdsecurity/appsec-default
    labels:
      type: appsec
    listen_addr: 127.0.0.1:7422
    source: appsec
    name: myAppSecComponent
    EOF
    sudo systemctl restart crowdsec

    Layer in OWASP CRSOWASP CRSA free, community-maintained ruleset for ModSecurity and compatible WAFs that detects common web attacks like SQLi and XSS, giving cyber tools a ready-made detection baseline without writing rules from scratch. out-of-band rules alongside default virtual patching by declaring multiple appsec_configs entries.
    /etc/crowdsec/acquis.d/appsec.yaml copy

    appsec_configs:
      - crowdsecurity/appsec-default
      - crowdsecurity/crs
    labels:
      type: appsec
    listen_addr: 127.0.0.1:7422
    source: appsec
    name: myAppSecComponent

    Verify end-to-end WAF detection is working by triggering the built-in test scenario and checking for the resulting alert.
    copy

    $ curl -I https://<your-service-url>/crowdsec-test-NtktlJHV4TfBSK3wvlhiOBnl
    sudo cscli alerts list | grep crowdsecurity/appsec-generic-test

    • Adds appsec_configs, listen_addr, source, and name keys to /etc/crowdsec/acquis.d/appsec.yaml to expose the AppSec Component as a new acquisition datasource listening on 127.0.0.1:7422 by default.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Supports loading multiple AppSec configurations in a single acquisition file — for example combining crowdsecurity/appsec-default (virtual patching, in-band) and crowdsecurity/crs (OWASPOWASPA nonprofit foundation that publishes open standards, guides, and ranked vulnerability lists—most famously the OWASP Top 10—giving cyber tools a vendor-neutral benchmark to test or report against. CRS, out-of-band).
    • Enables detection testing via the crowdsecurity/appsec-generic-test dummy scenario, triggerable by requesting the probe path /crowdsec-test-NtktlJHV4TfBSK3wvlhiOBnl and confirmed with sudo cscli alerts list.
    • Supports the AppSec Component as a WAF integration point for Nginx/OpenResty, Traefik, HAProxy (SPOA), and WordPress remediation components.
    • Adds appsec_configs, listen_addr, source, and name keys to /etc/crowdsec/acquis.d/appsec.yaml to expose the AppSec Component as a new acquisition datasource listening on 127.0.0.1:7422 by default.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Enables detection testing via the crowdsecurity/appsec-generic-test dummy scenario, triggerable by requesting the probe path /crowdsec-test-NtktlJHV4TfBSK3wvlhiOBnl and confirmed with sudo cscli alerts list.
    • Supports the AppSec Component as a WAF integration point for Nginx/OpenResty, Traefik, HAProxy (SPOA), and WordPress remediation components.

    1 more in Everything

26. docs update Sep 22, 2026 · issue 082

    CrowdSec Console gains Stack Health dashboard for severity-based monitoring of Security Engines, Log Processors, and blocklist integrations.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ HOW TO FIND IT
    Set up notifications so your team is alerted the moment a Critical Stack Health issue is detected, without having to poll the dashboard manually.
    📍In the CrowdSec Console, go to Notification Settings › configure your preferred channels (Email, Slack, Discord, or Webhook) › create a notification rule scoped to Stack Health events with severity Critical or Important.
    • Adds Stack Health dashboard in the CrowdSec Console, accessible from the Security Stack left bar menu, surfacing configuration issues, connectivity problems, and misconfigurations across Security Engines, Log Processors, and blocklist integrations.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Categorizes detected issues into four severity levels — Critical, Important, Recommended, and Bonus — so practitioners can triage and prioritize remediation.
    • Surfaces per-engine issue counts via a badge on each Security Engine card and a dedicated issues section in the Security Engine details view.
    • Integrates with the Console notification system to deliver alerts for critical Stack Health events via Email, Slack, Discord, and Webhook channels.

    4 details in Everything

27. docs update Sep 22, 2026 · issue 082

    CrowdSec Console gains a Remediation Metrics page showing blocked attacks, discarded traffic, and projected resources saved.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ HOW TO FIND IT
    Navigate to the Remediation Metrics page in the CrowdSec Console to review blocked attack counts, discarded traffic volumes, and resource savings across your remediation components.
    📍In the CrowdSec Console, go to Remediation Metrics. Select a time period to see Total Prevented Attacks, then scroll to Malicious Traffic Discarded for the blocklist breakdown, and Projected Resources Saved for bandwidth and storage estimates.
    • Adds the Remediation Metrics page to the CrowdSec Console, providing a unified view of malicious activity detected and remediated across your infrastructure.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Introduces a Malicious Intents section showing the total prevented attacks and a breakdown of attack types (spam, scanning, brute-force) inferred from community data for the selected time period.
    • Introduces a Malicious Traffic Discarded section with raw and estimated data on dropped requests, packets, and bytes, plus a blocklist breakdown ordered by traffic blocked — supporting Firewall, Nginx, OpenResty, Ingress Nginx, Cloudflare Workers, HAProxy SPOA, and WordPress Plugin remediation components.
    • Introduces a Projected Resources Saved section estimating bandwidth (egress traffic), log lines, and storage space preserved as a result of blocking malicious traffic, with per-blocklist attribution.
    • Requires CrowdSec Security Engine v1.6.3 or higher for metric collection and reporting to the Console.

    5 details in Everything

28. docs update Sep 22, 2026 · issue 082

    CrowdSec CTICTICyber Threat Intelligence: structured knowledge about adversaries — their tactics, infrastructure, and indicators — that tools consume to prioritize detections or enrich alerts with context. now offers three programmatic access paths: Enrichment API, Offline Replicas, and a TAXII 2.1TAXII 2.1An OASIS-standard HTTP-based protocol for exchanging cyber threat intelligence, letting cyber tools publish and subscribe to structured threat data across organizations without custom integration work./STIX 2.1STIX 2.1A JSON-based open standard maintained by OASIS for representing threat intelligence objects and relationships, letting cyber tools exchange indicators, actors, and TTPs in a common machine-readable format. feed⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • Adds x-api-key header-authenticated Enrichment API for on-demand per-IP JSON lookups, suited for SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents., SOARSOARSecurity orchestration, automation and response, coordinating incident workflows across tools. Playbooks can gather evidence, assign work or carry out approved response actions., and TIP real-time enrichment pipelines.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds Offline Replicas: a periodically refreshed full snapshot of the CrowdSec CTI database available for bulk download in mmdb, parquet, and json formats — no per-request rate limits, supports air-gapped environments.
    • Adds a TAXIITAXIIA protocol for sharing threat intelligence over HTTPS, commonly carrying STIX data. It lets tools retrieve and exchange intelligence from compatible services. 2.1 / STIXSTIXStructured Threat Information Expression, a standard format for describing threats, indicators and their relationships. It helps organizations exchange threat intelligence in a usable form. 2.1 feed for incremental, poll-based synchronization with TAXII-native platforms such as OpenCTI, MISP, and Anomali.

    3 details in Everything

29. docs update Sep 22, 2026 · issue 082

    CrowdSec adds an Application Security Component (AppSecAppSecApplication security: the practice of finding and fixing vulnerabilities in software during design, development, and testing. Cyber tools build on AppSec workflows to shift vulnerability detection earlier in the development lifecycle.) that turns the Security Engine into a full WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server. with virtual patching, ModSecurityModSecurityAn open-source web application firewall engine, maintained by the OWASP community, that inspects HTTP traffic against rule sets to block malicious requests before they reach an application. rule support, and bot detection.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ TRY IT
    Review in-band AppSec rule alerts from the command line after a WAF rule blocks a request.
    copy

    $ cscli alerts list

    • Adds listen_addr configuration in the AppSec acquisition datasource to receive forwarded HTTP requests from remediation components (Nginx, Traefik, HAProxy, Envoy Gateway, OpenResty, WordPress).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Introduces the AppSec Component — a WAF capability built into the CrowdSec Security Engine supporting in-band (blocking) and out-of-band (async, non-blocking) rule evaluation against HTTP requests.
    • Supports virtual patching with low-effort rule deployment via collections from the CrowdSec Hub.
    • Supports legacy ModSecurity rules within the AppSec Component.
    • Adds bot detection to filter automated traffic using a browser challenge.

    +3 more show less

    • Exposes in-band rule alerts via cscli alerts list and the CrowdSec console dashboard.
    • Enables WAF rule events to feed CrowdSec scenarios, allowing behaviors like extending IP bans when multiple virtual patching rules trigger.
    • Supports a single AppSec Component instance protecting multiple web servers and reverse proxies simultaneously, with one shared rule set.

    8 details in Everything

30. docs update Sep 22, 2026 · issue 082

    CrowdSec adds alpha bot detection to its WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server., blocking headless browsers and automation frameworks before they reach your app.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ TRY IT
    Check for active bot detection alerts after enabling the feature, to confirm the AppSecAppSecApplication security: the practice of finding and fixing vulnerabilities in software during design, development, and testing. Cyber tools build on AppSec workflows to shift vulnerability detection earlier in the development lifecycle. component is intercepting automated traffic.
    copy

    $ cscli alerts list

    • Adds alpha bot detection to the AppSec component, using browser-side proof-of-work and device fingerprinting to distinguish real browsers from automated clients.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Detections from bot detection surface in cscli alerts list and as alerts in the CrowdSec console, and the fingerprint verdict is available to custom scenarios and appsec-configs.
    • Verified search-engine crawlers, uptime probes, and similar good bots are recognised and passed through without a challenge.
    • Persistent bot probing is converted into CrowdSec decisions by shipped behavioral scenarios, enabling bouncers to block repeat offenders over time.
    • Compatible bouncers supporting bot detection include Nginx, OpenResty, HAProxy SPOA, Traefik, and Envoy (identified by a Bot Detection badge on their documentation page).

    +1 more show less

    • Requires a WebAssemblyWebAssemblyA binary instruction format that runs in browsers and server runtimes at near-native speed, letting developers compile C, Rust, or other languages into a portable, sandboxed module any compliant host can execute. runtime in compiler mode on arm64 or amd64 with SSE4.1 support; hosts unable to satisfy this fail with wasm compiler mode unavailable or failed to create wasm runtime in compiler mode.
    • Adds alpha bot detection to the AppSec component, using browser-side proof-of-work and device fingerprinting to distinguish real browsers from automated clients.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Verified search-engine crawlers, uptime probes, and similar good bots are recognised and passed through without a challenge.
    • Persistent bot probing is converted into CrowdSec decisions by shipped behavioral scenarios, enabling bouncers to block repeat offenders over time.
    • Compatible bouncers supporting bot detection include Nginx, OpenResty, HAProxy SPOA, Traefik, and Envoy (identified by a Bot Detection badge on their documentation page).
    • Requires a WebAssemblyWebAssemblyA binary instruction format that runs in browsers and server runtimes at near-native speed, letting developers compile C, Rust, or other languages into a portable, sandboxed module any compliant host can execute. runtime in compiler mode on arm64 or amd64 with SSE4.1 support; hosts unable to satisfy this fail with wasm compiler mode unavailable or failed to create wasm runtime in compiler mode.

    1 more in Everything

31. v1.8.1 Sep 3, 2026 · issue 063

    CrowdSec v1.8.1 adds a HasValidChallengeCookie() helper for bot detection logic.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.8.1 https://github.com/crowdsecurity/crowdsec.git
    # already have the repo? check out this version:
    $ git checkout v1.8.1

32. docs update Aug 31, 2026 · issue 060

    CrowdSec adds appsec-challenge and appsec-challenge-infra bot-detection metric categories to cscli

    • Adds appsec-challenge-infra metric category to cscli, exposing internal AppSecAppSecApplication security: the practice of finding and fixing vulnerabilities in software during design, development, and testing. Cyber tools build on AppSec workflows to shift vulnerability detection earlier in the development lifecycle. challenge runtime upkeep metrics: signing-key rotation, JS re-obfuscation, and cache eviction.

    1 detail in Everything

33. docs update Aug 31, 2026 · issue 060

    CrowdSec adds Prometheus metrics for AppSecAppSecApplication security: the practice of finding and fixing vulnerabilities in software during design, development, and testing. Cyber tools build on AppSec workflows to shift vulnerability detection earlier in the development lifecycle. challenge lifecycle, fingerprint mismatches, and Kubernetes datasource hits.

    • Adds cs_appsec_challenge_requested_total counter tracking challenges served by the AppSec component.
    • Adds cs_appsec_challenge_submitted_total counter tracking challenge responses received by the AppSec component.
    • Adds cs_appsec_challenge_accepted_total counter tracking challenge cookies issued, with kind label distinguishing kind=solved (valid submissions) from kind=granted (via GrantChallengeCookie(reason)).
    • Adds cs_appsec_challenge_rejected_total counter tracking challenge/cookie rejections, with kind label values kind=protocol (crypto-PoW failures), kind=submission (via RejectSubmission(reason)), and kind=cookie (invalid incoming cookies).
    • Adds cs_appsec_challenge_exempt_total counter tracking requests exempted from challenges via ExemptFromChallenge(reason) — covering verified known bots (e.g. gptbot) and well-known path classes, counted once per request.

    +4 more show less

    • Adds cs_appsec_fingerprint_mismatch_total counter exposing fingerprint mismatch signals fired by EvaluateMismatches(), labeled by severity.
    • Adds challenge runtime internals metrics for CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware./memory troubleshooting: cs_appsec_challenge_kepoch_generated_total (signing keys derived per epoch), cs_appsec_challenge_kepoch_evicted_total (signing keys evicted from keyring cache — difference gives live cache size), cs_appsec_challenge_reobfuscation_total (JS obfuscation passes, labeled by bundle, with bundle=dynamic for the per-epoch sign-key module), and cs_appsec_challenge_dynamic_module_evicted_total (per-epoch dynamic modules evicted when their epoch leaves the live window).
    • Adds cs_kubernetessource_hits_total counter for the Kubernetes datasource, labeled by datasource_type.
    • Adds cs_machines_last_heartbeat_timestamp gauge exposing the Unix timestamp of the last heartbeat received from each machine.

    9 details in Everything

34. docs update Aug 31, 2026 · issue 060

    CrowdSec adds a Kubernetes data source to stream container logs from pods selected by labels.

35. docs update Aug 31, 2026 · issue 060

    CrowdSec adds dns_cache config block with ttl, negative_ttl, and size controls for DNS lookup caching.

    └──▷ USE IT
    Tune DNS caching when resolving a large, diverse set of addresses or when a vendor rotates DNS records frequently.
    yaml copy

    dns_cache:
      ttl: 30m
      negative_ttl: 5m
      size: 32768

    • Adds dns_cache configuration block with ttl (default 1h), negative_ttl (default 5m), and size (default 16384) keys to cache DNS lookups using an LRU cache, reducing repeated resolver calls.

    1 detail in Everything

36. v1.8.0 Aug 31, 2026 · issue 060

    CrowdSec v1.8.0 adds WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server. bot detection with challenge/fingerprinting, a Kubernetes log datasource, and HTTP expression helpers.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.8.0 https://github.com/crowdsecurity/crowdsec.git
    # already have the repo? check out this version:
    $ git checkout v1.8.0

    └──▷ TRY IT
    Check the all-in-one CrowdSec console enrollment and feature status after upgrading.
    copy

    $ cscli console status

    • Adds WAF bot detection (waf challenge mode) that serves a challenge-and-fingerprinting page to clients before granting site access, with configurable score thresholds and cookie-disabled error messaging.
    • Adds a dedicated Kubernetes datasource that fetches logs directly from the k8s API server, giving CrowdSec native k8s log acquisition without an agent proxy.
    • Adds HTTP helpers to the expression language, enabling parsers and scenarios to query external services inline.
    • Adds cs_machines_heartbeat_seconds metric for tracking agent heartbeat timing.
    • Revamps cscli console status into an all-in-one status view.

    +3 more show less

    • Improves cscli hub list output.
    • Adds configurable auth timeout from WAF to LAPI.
    • Makes RejectSubmission generate an alert, surfacing WAF submission rejections in the alert stream.

    8 details in Everything

37. advisory CVE-2026-44982 May 27, 2026 · issue 128
    • CVE-2026-44982: CrowdSec AppSecAppSecApplication security: the practice of finding and fixing vulnerabilities in software during design, development, and testing. Cyber tools build on AppSec workflows to shift vulnerability detection earlier in the development lifecycle. silently drops request body for chunked / HTTP-2 requests (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 7.2, affects =>1.5.0, =<1.7.7)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
38. advisory CVE-2026-44981 May 27, 2026 · issue 128
    • CVE-2026-44981: CrowdSec LAPI: Denial of Service via Unbounded Gzip Decompression (affects >= 1.7.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
39. v1.7.8 May 11, 2026 · release notes

    CrowdSec v1.7.8 adds WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server. OpenAPIOpenAPIA vendor-neutral specification for describing REST APIs in a machine-readable format, maintained by the OpenAPI Initiative. Cyber tools use it to auto-generate clients, documentation, and validation from a single source of truth. schema validation, chunked decision streaming, and a faster cscli enroll flow.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.7.8 https://github.com/crowdsecurity/crowdsec.git
    # already have the repo? check out this version:
    $ git checkout v1.7.8

    • Adds OpenAPI schema validation to the WAF, enabling automatic request inspection against defined API schemas.
    • Enforces body size limits in the WAF to cap memory exposure on large incoming payloads.
    • Switches the decision stream to chunked transfer encoding by default, improving delivery of large decision sets.
    • Adds --quick flag to the cscli enroll command for faster enrollment workflows.
    • Introduces a cleaner alternative configuration format for appsec-config.

    5 details in Everything

40. v1.7.7 Mar 30, 2026 · release notes

    CrowdSec v1.7.7 switches to RE2RE2A regular-expression engine developed by Google that guarantees linear-time matching, preventing the catastrophic backtracking that plagues PCRE-style engines and making it safe to run untrusted patterns. regexp engine on Linux, adds flexible WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server. AND/OR conditions, a new allowlist import command, and a kind alert attribute.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.7.7 https://github.com/crowdsecurity/crowdsec.git
    # already have the repo? check out this version:
    $ git checkout v1.7.7

    └──▷ HOW TO FIND IT
    Revert to the Go regexp engine if the new RE2 default causes issues with existing parsers on Linux.
    📍In the CrowdSec console or config, enable the feature flag re2_disable_grok_support (see https://docs.crowdsec.net/docs/next/configuration/feature_flags/#enabling-a-feature-flag).
    • Enables RE2 as the default regexp engine on Linux, delivering significantly faster parser evaluation with the option to revert via the re2_disable_grok_support feature flag.
    • WAF rules now support arbitrary mixes of AND/OR conditions with no structural limits, enabling much more expressive rule authoring.
    • Adds cscli allowlist import command for bulk importing allowlist entries.
    • Introduces a new kind attribute on alerts to identify their source (scenario, WAF rule, manual decision, etc.).
    • Adds LookupFile and FileMap expression helpers for use in parsers.

    +2 more show less

    • Exposes additional Coraza transformations in the WAF engine.
    • Supports the HTTP_PROXY environment variable in the notification-http plugin for proxy-aware HTTP notifications.

    7 details in Everything

41. v1.7.5 Jan 22, 2026 · release notes

    CrowdSec v1.7.5 adds flexible key-value parsing and AppSecAppSecApplication security: the practice of finding and fixing vulnerabilities in software during design, development, and testing. Cyber tools build on AppSec workflows to shift vulnerability detection earlier in the development lifecycle. transaction ID tracing for improved log analysis and request correlation.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.7.5 https://github.com/crowdsecurity/crowdsec.git
    # already have the repo? check out this version:
    $ git checkout v1.7.5

    • Adds ParseKVLax for flexible, lenient key-value parsing in parser expressions.
    • Supports transaction ID header injection in AppSec for end-to-end request tracing.
    • Adds JSON schema validation for the Docker datasource configuration.

    3 details in Everything

42. v1.7.4 Dec 4, 2025 · release notes

    CrowdSec v1.7.4 adds a WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server. DropRequest hook helper, syslog log media support, and a new option to disable usage metrics export.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.7.4 https://github.com/crowdsecurity/crowdsec.git
    # already have the repo? check out this version:
    $ git checkout v1.7.4

    └──▷ USE IT
    Block a request directly inside a WAF hook without relying on a detection rule match — useful for custom pre/post-processing logic.
    json copy

    {
      "name": "my-block-hook",
      "filter": "IsInBand == true",
      "apply": [
        "DropRequest()"
      ]
    }

    Disable usage metrics export on a self-hosted LAPI server to prevent telemetry data from leaving the environment.
    yaml copy

    api:
      server:
        disable_usage_metrics_export: true

    Route all CrowdSec log output to syslog instead of a file, useful in containerised or systemd-managed deployments.
    yaml copy

    common:
      log_media: syslog

    • Adds DropRequest helper to WAF hooks, enabling rules to programmatically block requests directly within AppSecAppSecApplication security: the practice of finding and fixing vulnerabilities in software during design, development, and testing. Cyber tools build on AppSec workflows to shift vulnerability detection earlier in the development lifecycle. hook logic.
    • Adds log_media="syslog" logging configuration option, allowing CrowdSec to route log output to syslog.
    • Adds api.server.disable_usage_metrics_export option to suppress usage metrics export from the LAPI server.

    3 details in Everything

43. v1.7.1 Oct 15, 2025 · release notes

    CrowdSec v1.7.1 adds WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server. glob includes, FQDN alert metadata, auditd detection, and AWS SDK v2 for cloud datasources.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.7.1 https://github.com/crowdsecurity/crowdsec.git
    # already have the repo? check out this version:
    $ git checkout v1.7.1

    • WAF: stores the target FQDN in alert metadata for richer context in WAF-triggered alerts.
    • WAF: supports glob patterns when including SecLang rule files, enabling flexible rule-set organization.
    • WAF: adds fromFile match type for WAF rules, allowing match lists to be loaded from external files.
    • Adds cscli setup detection support for auditd, expanding automatic service discovery.
    • Updates Kinesis, CloudWatch, and S3 datasources to AWS SDK v2.

    +4 more show less

    • Adds Docker acquisition timeout resilience to handle socket proxy errors gracefully.
    • cscli support dump now collects detailed system information via gopsutil.
    • Replaces cron-based scheduling with a systemd timer for improved lifecycle management.
    • cscli hubtest --appsec now exits early with a clear error when nuclei cannot be invoked.

    9 details in Everything

44. v1.7.0 Sep 1, 2025 · release notes

    CrowdSec v1.7.0 adds flexible service auto-detection via cscli setup, per-datasource acquisition metrics, Docker Swarm support, and new time-based expr helpers.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.7.0 https://github.com/crowdsecurity/crowdsec.git
    # already have the repo? check out this version:
    $ git checkout v1.7.0

    └──▷ TRY IT
    Inspect acquisition and parser metrics reported by a Log Processor to spot misconfigured or silent datasources.
    copy

    $ cscli machines inspect <machine-id>

    • New cscli setup command for service auto-detection supports Linux, BSD, and Windows, allows custom detection configs, and can be skipped for Ansible-managed installs.
    • Log Processors now report acquisition and parser metrics (lines read, parsed, unparsed, whitelisted per datasource) to LAPI, visible via cscli machines inspect.
    • Adds Docker Swarm support to the Docker datasource acquisition.
    • New average and median time-between-events expr helpers for use in bucket scenarios.
    • Improved CRS and ModSecurityModSecurityAn open-source web application firewall engine, maintained by the OWASP community, that inspects HTTP traffic against rule sets to block malicious requests before they reach an application. rules integration in the WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server. (AppSecAppSecApplication security: the practice of finding and fixing vulnerabilities in software during design, development, and testing. Cyber tools build on AppSec workflows to shift vulnerability detection earlier in the development lifecycle. component).

    +1 more show less

    • Improved output for AppSec cscli hubtest command.

    6 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !When CrowdSec runs in a Docker or Podman container, a volume must now be mounted at /var/lib/crowdsec/data/ or the container will refuse to start (does not apply to Kubernetes).
    • !The cscli dashboard command has been removed; users relying on the Metabase dashboard must migrate to https://app.crowdsec.net.
45. v1.6.10 Jul 10, 2025 · release notes

    CrowdSec v1.6.10 adds allowlist IP checking, SNSSNSAmazon Simple Notification Service, a managed pub/sub messaging service from AWS that lets tools fan out alerts or events to multiple subscribers — queues, email, HTTP endpoints, or Lambda functions — without managing broker infrastructure. support for S3, and GET/HEAD for HTTP datasource

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.6.10 https://github.com/crowdsecurity/crowdsec.git
    # already have the repo? check out this version:
    $ git checkout v1.6.10

    • Adds cscli allowlists check command to check whether an IP or range belongs to an allowlist.
    • Supports SNS notification format in the S3 datasource, enabling log ingestion triggered by SNS events.
    • Supports GET and HEAD requests in the HTTP datasource so log providers can confirm the datasource is reachable.

    3 details in Everything

46. v1.6.9 Jun 17, 2025 · release notes

    CrowdSec v1.6.9 adds self-unregistering log processors, automatic allowlist decision cleanup, PAPI auto-enable, and Docker event-driven acquisition.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.6.9 https://github.com/crowdsecurity/crowdsec.git
    # already have the repo? check out this version:
    $ git checkout v1.6.9

    └──▷ USE IT
    Enable self-unregistration of a log processor on shutdown to keep Kubernetes node lists clean in LAPI.
    yaml copy

    In the log processor's configuration, set the self-delete on shutdown option so the node automatically removes itself from LAPI when it exits.

    Configure the HTTP acquisition to listen on a Unix socket instead of a TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. port, useful for local log forwarding without network exposure.
    yaml copy

    source: http
    listen_socket: /var/run/crowdsec/http_acquis.sock
    labels:
      type: nginx

    • Adds option for a log processor to unregister itself from LAPI on shutdown, keeping active processor lists clean in dynamic environments like Kubernetes.
    • Allowlists now automatically delete matching active decisions when an allowlist is created or updated.
    • PAPI (Polling API) is now automatically enabled or disabled when CrowdSec detects a console plan change, simplifying initial setup.
    • Docker datasource now uses Docker events instead of polling to detect new containers, improving performance.
    • Kafka datasource exposes batching configuration options.

    +3 more show less

    • HTTP acquisition now supports a listen_socket option for Unix socket listeners.
    • Adds support for d (day) suffix in profile duration fields.
    • LAPI now returns a specific error when a Unix socket path exceeds the OS limit.

    8 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Docker acquisition now requires access to the Docker events API endpoint — if you are using a socket proxy, its configuration must be updated to allow this endpoint.
47. v1.6.6 Mar 18, 2025 · release notes

    CrowdSec v1.6.6 adds centralized allowlists, JA4H fingerprinting, mTLSmTLSMutual TLS, an encrypted connection where both client and server present certificates to prove their identity. It helps services verify who they are communicating with./custom CA for databases, and new AppSecAppSecApplication security: the practice of finding and fixing vulnerabilities in software during design, development, and testing. Cyber tools build on AppSec workflows to shift vulnerability detection earlier in the development lifecycle. expr helpers.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.6.6 https://github.com/crowdsecurity/crowdsec.git
    # already have the repo? check out this version:
    $ git checkout v1.6.6

    └──▷ HOW TO FIND IT
    Enable centralized allowlists from the CrowdSec console so a trusted IP is exempted across all LAPI-connected agents without touching individual machines.
    📍In the console, go to Allowlists and create a new allowlist entry (IP, range, or country). It will be automatically pulled by LAPI and applied to local decisions, AppSec rules, and blocklists.
    Add mTLS and a custom CA for a PostgreSQL database connection to harden LAPI-to-database communication.
    yaml copy

    db_config:
      type: postgresql
      host: db.example.com
      port: 5432
      user: crowdsec
      password: <password>
      db_name: crowdsec
      ssl_ca_cert: /etc/crowdsec/ca.crt
      ssl_client_cert: /etc/crowdsec/client.crt
      ssl_client_key: /etc/crowdsec/client.key

    • Adds centralized allowlists managed via LAPI or the console, automatically applied to local decisions, AppSec rules, and blocklists without per-machine deployment.
    • Adds JA4H expression helper for AppSec to compute JA4H fingerprint hashes for HTTP requests.
    • Adds custom CA and mTLS authentication support for PostgreSQL and MySQL database connections via new SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. options in db configuration.
    • Adds ExtractQueryParam expression helper (alongside relocated ParseQuery) for use in AppSec and parsing rules.
    • Adds enable/disable options for console enrollment; makes alert context a default enrollment option.

    +2 more show less

    • Adds option to disable magic syslog RFC parsers.
    • Adds parallel hubtest execution for faster hub testing workflows.

    7 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !capi_whitelists_path is deprecated; users should migrate to centralized allowlists.
48. v1.6.5 Feb 7, 2025 · release notes

    CrowdSec v1.6.5 adds VictoriaLogs datasource, configurable log formats, and an overhauled cscli hub command.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.6.5 https://github.com/crowdsecurity/crowdsec.git
    # already have the repo? check out this version:
    $ git checkout v1.6.5

    └──▷ USE IT
    Set a structured JSON log format for CrowdSec to integrate with log aggregators.
    yaml copy

    common:
      log_format: json

    • New VictoriaLogs datasource lets CrowdSec ingest logs directly from a VictoriaLogs instance.
    • Configurable log format support allows operators to set the output log format for CrowdSec.
    • Revamped cscli hub command with improved hub management, richer output, and built-in examples.
    • Environment variable expansion now supported when loading acquisition configuration.
    • New --interactive flag on applicable cscli commands replaces the former --yes flag for guided prompts.

    +4 more show less

    • Autocomplete added for cscli metrics show subcommand.
    • Dashboard setup now accepts environment variable configuration via a dedicated flag in cscli.
    • Expired decisions are now highlighted in red in cscli decision output for faster triage.
    • hub upgrade now runs automatically during rpm/deb post-installation steps.

    9 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The --yes option in cscli is replaced by --interactive; scripts or automation using --yes will break.
    • !The cscli config backup and cscli config restore commands have been removed; any workflows relying on them will fail.
49. v1.6.4 Nov 20, 2024 · release notes

    CrowdSec v1.6.4 adds HTTP datasource ingestion, AppSecAppSecApplication security: the practice of finding and fixing vulnerabilities in software during design, development, and testing. Cyber tools build on AppSec workflows to shift vulnerability detection earlier in the development lifecycle. alert context, EVTXEVTXWindows XML-based binary log format used by the Event Log service to store system, application, and security events; cyber tools parse it to extract forensic artifacts from live systems or offline disk images. replay, and bouncer API key sharing.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.6.4 https://github.com/crowdsecurity/crowdsec.git
    # already have the repo? check out this version:
    $ git checkout v1.6.4

    • New HTTP datasource enables CrowdSec to ingest logs from HTTP endpoints such as Datadog or Vector.
    • Alert context is now available when using the AppSec component, enriching alerts with request-level context.
    • Windows users can replay WinEvent EVTX files for historical log analysis.
    • Bouncers on different machines can share the same API key without interference; each appears as bouncer_name@IP in the bouncer list.
    • Supports multiple AppSec configurations simultaneously.

    +2 more show less

    • New no_ready_check option for the Loki datasource.
    • Adds explicit configuration options for signals sharing and blocklist pull behavior.

    7 details in Everything

50. v1.6.3 Sep 10, 2024 · release notes

    CrowdSec v1.6.3 adds bouncer efficiency metrics, richer machine/bouncer inspection, and a new Hub API backend.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.6.3 https://github.com/crowdsecurity/crowdsec.git
    # already have the repo? check out this version:
    $ git checkout v1.6.3

    └──▷ TRY IT
    Check how many packets/bytes your firewall bouncer has blocked since last restart — useful for proving ROI or debugging remediation gaps.
    copy

    $ cscli metrics show bouncers

    Inspect a specific bouncer's OS, version, and connection details when auditing a larger multi-host deployment.
    copy

    $ cscli bouncers inspect <bouncer-name>

    Safely remove a bouncer in a CI/CD teardown script without failing when the bouncer doesn't exist.
    copy

    $ cscli bouncers delete <bouncer-name> --ignore-missing

    • New cscli metrics show bouncers command surfaces remediation component efficiency stats (blocked packets/bytes, HTTP requests) in the CLI and console.
    • Remediation components (starting with firewall-bouncer 0.0.30) can now report detailed metrics — visible per-instance in the CrowdSec console.
    • New cscli machines inspect and cscli bouncers inspect commands expose detailed info including underlying OS for easier management of larger deployments.
    • Machines can now auto-register with the Local API, simplifying Kubernetes and Docker onboarding.
    • New --ignore-missing option for cscli bouncers delete and cscli machines delete enables idempotent scripted teardowns.

    +8 more show less

    • New cscli doc --target /path/to/dir command generates CLI documentation to a specified directory.
    • New default_range_remediation configuration option added for more granular remediation control.
    • Hub now backed by a new Hub API, enabling new item types (acquisition files, notification templates) and larger collections (e.g., Sigma).
    • cscli hub update gains --with-content option to retain embedded items in the index, used by default in Docker.
    • Environment variables can now be expanded in local_api_credentials.yaml and .yaml.local config files.
    • OpenBSD support added for filesystem type detection via correct statfs struct member.
    • LAPI CAPI status query can now also return enrollment status.
    • Improved TLS middleware with stronger revocation checks.

    13 details in Everything

51. v1.6.2 May 31, 2024 · release notes

    Adds File notification plugin and Slack configuration options

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.6.2 https://github.com/crowdsecurity/crowdsec.git
    # already have the repo? check out this version:
    $ git checkout v1.6.2

    • Introduces the File notification plugin as a new integration point.
    • Adds channel, username, and icon_emoji/icon_url config keys in .cs/config.yaml under notifications.slack to customize Slack bot appearance.
    • Adds GetActiveDecisionsCount() and GetActiveDecisionsTimeLeft() expression helpers for decision queries.

    3 details in Everything

52. v1.6.1 Apr 16, 2024 · release notes

    CrowdSec v1.6.1 adds local API unix socket support, high availability mode, and patterns_dir config.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.6.1 https://github.com/crowdsecurity/crowdsec.git
    # already have the repo? check out this version:
    $ git checkout v1.6.1

    • Adds patterns_dir configuration option to specify where custom pattern files are loaded from
    • LAPI: local api unix socket support allows connecting via Unix domain socket instead of TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it.
    • Implement highAvailability feature for service redundancy
    • appsec unix socket support enables the application security engine to listen on a Unix socket

    4 details in Everything

53. v1.6.0 Jan 24, 2024 · release notes

    CrowdSec v1.6.0 adds AppSecAppSecApplication security: the practice of finding and fixing vulnerabilities in software during design, development, and testing. Cyber tools build on AppSec workflows to shift vulnerability detection earlier in the development lifecycle. engine support, Loki integration, and a new cpu-profile flag

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.6.0 https://github.com/crowdsecurity/crowdsec.git
    # already have the repo? check out this version:
    $ git checkout v1.6.0

    └──▷ USE IT
    Profile CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. usage while CrowdSec is running to identify bottlenecks.
    shell copy

    crowdsec --cpu-profile profile.cpuprof

    Enable console management features in the CrowdSec service.
    shell copy

    export CS_CONSOLE_MANAGEMENT=true

    • Adds support for the Application Security Engine to detect web application attacks.
    • Adds Loki integration for log forwarding.
    • Adds --cpu-profile flag to crowdsec CLI commands for profiling.
    • Enables console management via the CS_CONSOLE_MANAGEMENT environment variable.

    4 details in Everything

54. v1.5.5 Oct 23, 2023 · release notes

    CrowdSec v1.5.5 adds configurable timeouts to email notifications and alert aliases in cscli.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.5.5 https://github.com/crowdsecurity/crowdsec.git
    # already have the repo? check out this version:
    $ git checkout v1.5.5

    • Adds timeout configuration options to the notification-email plugin for controlling send delays
    • Adds alert alias subcommand to cscli for managing alert annotations

    2 details in Everything

55. v1.5.3 Sep 18, 2023 · release notes

    Adds Sentinel notification plugin, bayesian bucket type, cscli explain labels, and bouncer/machine prune commands.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.5.3 https://github.com/crowdsecurity/crowdsec.git
    # already have the repo? check out this version:
    $ git checkout v1.5.3

    └──▷ USE IT
    Investigate why a specific scenario triggered by inspecting its label configuration.
    shell copy

    cscli explain --labels

    Clean up the database from bouncers that no longer exist to reduce state bloat.
    shell copy

    cscli bouncer prune

    • Adds sentinel notification plugin for alert forwarding
    • Adds bayesian bucket type (new scenario engine)
    • Adds --labels flag to cscli explain command
    • Adds cscli bouncer prune subcommand to remove stale bouncers
    • Adds cscli machine prune subcommand to remove stale machines

    +1 more show less

    • cscli metrics output format changes from plain list to a map keyed by table name

    6 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !cscli metrics -o json|raw output structure changed from a plain list to a map with table names as keys.
56. v1.5.2 May 26, 2023 · release notes

    Adds support for capi_whitelists.yaml configuration file.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.5.2 https://github.com/crowdsecurity/crowdsec.git
    # already have the repo? check out this version:
    $ git checkout v1.5.2

    • Supports capi_whitelists.yaml to define whitelists for CrowdSec API integration

    1 detail in Everything

57. v1.5.0 May 16, 2023 · release notes

    CrowdSec v1.5.0 adds S3 acquisition, papi subcommands, and several expr helpers.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.5.0 https://github.com/crowdsecurity/crowdsec.git
    # already have the repo? check out this version:
    $ git checkout v1.5.0

    └──▷ USE IT
    Configure an S3 source for log acquisition
    yaml copy

    acquis.d/s3.yaml: bucket: 'my-bucket', path: 'logs/*.log'

    Check the status of the PAPI connection
    copy

    $ cscli papi status

    Show configuration in YAML format via CLI
    copy

    $ cscli config show-yaml

    • Adds transform configuration option for acquisition
    • Adds experimental support for re2
    • Adds S3 acquisition datasource
    • Supports ip and cidr based whitelists for capi and 3rd party blocklists
    • Implements cscli config show-yaml command

    +7 more show less

    • Adds match, Hostname, B64decode, LogInfo, ToString, IsIPV4(), and IsIP() helpers in expr and templating
    • Adds cscli papi status and cscli papi sync commands
    • Adds papi_url configuration in credentials file for console management
    • Adds reauth and force_pull subcommands for papi
    • Allows running functional tests while containers are active
    • Enables disabling remote lapi registration via option
    • Streams decisions from db with batch import support

    12 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The k8s_audit acquisition type is renamed to k8s-audit
58. v1.4.3 Nov 30, 2022 · release notes

    CrowdSec v1.4.3 adds USE_WAL docker arg, cscli pgx config visibility, and agent reauth on 403.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.4.3 https://github.com/crowdsecurity/crowdsec.git
    # already have the repo? check out this version:
    $ git checkout v1.4.3

    └──▷ TRY IT
    Enable WALWALWrite-Ahead Log: a durability mechanism in databases where changes are recorded to an append-only log before being applied to main storage, giving tools crash recovery and atomic transactions without full-page rewrites. support in a CrowdSec Docker container using the new environment variable.
    copy

    $ docker run -e USE_WAL=true crowdsecurity/crowdsec

    View database connection details for a PostgreSQL (pgx) backend via the CLI.
    copy

    $ cscli config show | grep -A 4 'driver=pgx'

    • Adds USE_WAL environment variable to Docker arguments for enabling Write-Ahead Log mode
    • cscli config show now prints host/port/user/dbname fields when the database driver is set to pgx
    • Force agent reauthentication on 403 HTTP response codes instead of failing silently

    3 details in Everything

59. v1.4.2 Nov 15, 2022 · release notes

    CrowdSec v1.4.2 adds Kafka data source support, cscli support dump, reinject CLI commands, and LookupHost expression lib func.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.4.2 https://github.com/crowdsecurity/crowdsec.git
    # already have the repo? check out this version:
    $ git checkout v1.4.2

    • Adds cscli support dump command to generate support artifacts
    • Adds LookupHost function to the expression language library
    • Adds helo config key to the email notification plugin configuration
    • Adds environment variable loading capability for plugins
    • Adds Docker build flavors: slim, with-plugins, with-geoip, full

    +1 more show less

    • Adds config option to enable or disable local API and agent

    6 details in Everything

60. v1.4.1 Jul 25, 2022 · release notes

    CrowdSec v1.4.1 adds Windows support, .local config files, cert auth for agents/bouncers, and dynamic decision duration

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.4.1 https://github.com/crowdsecurity/crowdsec.git
    # already have the repo? check out this version:
    $ git checkout v1.4.1

    • Support for .local configuration files to customize settings without breaking upgrades.
    • profiles.yaml now accepts the dynamic_duration field in ban actions to set incremental decision durations.
    • CrowdSec agent runs natively on Windows.

    3 details in Everything

61. v1.4.0 Jul 19, 2022 · release notes

    CrowdSec v1.4.0 adds Windows support, cert auth for agents/bouncers, dynamic profile durations, and notifications command

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.4.0 https://github.com/crowdsecurity/crowdsec.git
    # already have the repo? check out this version:
    $ git checkout v1.4.0

    • Adds .local configuration file support for upgrade-resilient customization
    • Enables certificate-based client authentication for agents and bouncers
    • Allows incremental duration settings in profiles.yaml profiles
    • Introduces the cscli notifications command for managing notifications

    4 details in Everything

62. v1.3.3 Apr 25, 2022 · release notes

    CrowdSec v1.3.3 adds -m flag to decisions list, query params for filtering, trusted IPs for admin API, and force enroll.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.3.3 https://github.com/crowdsecurity/crowdsec.git
    # already have the repo? check out this version:
    $ git checkout v1.3.3

    └──▷ USE IT
    Inspect which machine generated specific bans in the CLI output
    shell copy

    cscli decisions list -m <machine_id>

    Filter the decision stream to see only blocks originating from a specific bouncer or scenario
    api copy

    curl "http://localhost:8080/decisions/stream?scenarios=example_scenario&origin=bouncer_name"

    Allow a monitoring agent IP to call the admin API without authentication
    config copy

    # In crowdsec/config.yaml
    trusted_ips:
      - "192.168.1.50"

    Enroll a new bouncer without interactive prompts for automation
    shell copy

    cscli enroll -k <api_key> --force

    • Add -m flag to cscli decisions list to display the machine name
    • Add query parameters scenarios and origin to filter decisions in the API stream
    • Add force subcommand to cscli enroll for automated unattended setup

    3 details in Everything

63. v1.3.1 Mar 2, 2022 · release notes

    Adds expression-based range scopes for IP lookups and multi-arch Docker images

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.3.1 https://github.com/crowdsecurity/crowdsec.git
    # already have the repo? check out this version:
    $ git checkout v1.3.1

    • Docker image supports multiple architecture platforms via the new multi-arch build pipeline.

    1 detail in Everything

64. v1.3.0 Jan 25, 2022 · release notes

    Adds Kinesis datasource, Lists support from central API, PGX DB driver, and custom decision push to crowdsec v1.3.0

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.3.0 https://github.com/crowdsecurity/crowdsec.git
    # already have the repo? check out this version:
    $ git checkout v1.3.0

    • Kinesis datasource enables ingesting logs directly from AWS Kinesis streams
    • Adds PGX as a supported PostgreSQL driver (pgx)
    • Allows pushing custom, tainted, or manual decisions via the central API

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The configuration file console_config.yaml has been renamed to console.yaml
65. v1.2.3 Jan 6, 2022 · release notes

    CrowdSec v1.2.3 adds email notification plugin, log rotation config, and wizard support for Raspbian

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.2.3 https://github.com/crowdsecurity/crowdsec.git
    # already have the repo? check out this version:
    $ git checkout v1.2.3

    • Adds email notification plugin to alert on security events
    • Allows configuring log rotation behavior via service settings
    • Enables the installation wizard to run on Raspbian OS

    3 details in Everything

66. v1.2.2 Dec 21, 2021 · release notes

    Adds cscli decisions import, Docker datasource support, and cancel_on decision configuration

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.2.2 https://github.com/crowdsecurity/crowdsec.git
    # already have the repo? check out this version:
    $ git checkout v1.2.2

    • cscli decisions import subcommand to load decisions from external sources for immediate enforcement.
    • New docker datasource type enables ingesting CrowdSec events directly from Docker daemon logs.
    • Support for the cancel_on configuration field in decision objects, allowing automated expiration of blocks based on event criteria.

    3 details in Everything

67. v1.2.1 Nov 17, 2021 · release notes

    CrowdSec v1.2.1 adds cscli explain, new CLI flags, and IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. role support for Cloudwatch.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.2.1 https://github.com/crowdsecurity/crowdsec.git
    # already have the repo? check out this version:
    $ git checkout v1.2.1

    • Adds the cscli explain command to debug log processing and parser execution
    • Allows specifying an AWS IAMAWS IAMAWS Identity and Access Management is Amazon's service for controlling who and what can call AWS APIs, by attaching policies that allow or deny actions on resources. Cyber tools use it to scope credentials to least privilege. role for Cloudwatch collection via environment variables instead of hardcoded tokens
    • Adds the --key flag to cscli config show to filter configuration output
    • Adds name and alias parameters to cscli console enroll for bouncer identification
    • Adds the --limit flag to cscli decisions list to cap the number of returned results

    5 details in Everything

68. v1.2.0 Sep 14, 2021 · release notes

    CrowdSec v1.2.0 adds notification plugin support and a local API health endpoint

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.2.0 https://github.com/crowdsecurity/crowdsec.git
    # already have the repo? check out this version:
    $ git checkout v1.2.0

    • Adds support for notification plugins (Slack, Splunk, Elasticsearch, HTTP push) to route alerts externally.
    • Adds /health endpoint to the local API for service monitoring.

    2 details in Everything

69. v1.1.0 Jul 6, 2021 · release notes

    CrowdSec v1.1.0 adds console enroll CLI subcommand, bouncer scope filtering, and grok expression support

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.1.0 https://github.com/crowdsecurity/crowdsec.git
    # already have the repo? check out this version:
    $ git checkout v1.1.0

    └──▷ USE IT
    Enroll the local console service instance via CLI
    shell copy

    cscli console enroll <enrollment_token>

    • Adds console enroll subcommand to cscli for console enrollment workflow
    • Allows bouncers to filter decisions by scope via new configuration option
    • Adds expression support in grok patterns for log parsing

    3 details in Everything

70. v1.0.13 Apr 27, 2021 · release notes

    Adds autocompletion for cscli and exposes TimeNow in exprlib helpers.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.0.13 https://github.com/crowdsecurity/crowdsec.git
    # already have the repo? check out this version:
    $ git checkout v1.0.13

    • Add autocompletion for cscli to enable tab-completion of commands and flags
    • Add TimeNow in the exprlib helpers to get current timestamp during scenario evaluation

    2 details in Everything

71. v1.0.9 Mar 4, 2021 · release notes

    CrowdSec v1.0.9 adds prometheus_uri to cscli config and supports acquisition files from a directory

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.0.9 https://github.com/crowdsecurity/crowdsec.git
    # already have the repo? check out this version:
    $ git checkout v1.0.9

    • prometheus_uri config key is added to cscli's configuration file for configuring the Prometheus URI endpoint.
    • Acquisition files can now be specified from a directory instead of only individual files.

    2 details in Everything

72. v1.0.7 Feb 10, 2021 · release notes

    CrowdSec v1.0.7 adds environment variable support in config and use_forwarded_for_headers for LAPI

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.0.7 https://github.com/crowdsecurity/crowdsec.git
    # already have the repo? check out this version:
    $ git checkout v1.0.7

    • allow_env_in_config: true (or env var syntax) is now supported in configuration files to inject values from the environment

    1 detail in Everything

73. v1.0.0 Dec 7, 2020 · release notes

    CrowdSec v1.0 introduces Local API (LAPI), cscli subcommands for API/bouncer management, and journald acquisition support.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.0.0 https://github.com/crowdsecurity/crowdsec.git
    # already have the repo? check out this version:
    $ git checkout v1.0.0

    └──▷ TRY IT
    Inspect details of a specific alert by its ID.
    copy

    $ cscli alerts inspect <alert_id>

    • Exposes the Local API (LAPI) for centralized alert handling and decision sharing across multiple CrowdSec instances
    • Adds cscli bouncers command to manage bouncers and generate API tokens
    • Adds cscli capi command to register with or check status to the Central Crowdsec API
    • Adds cscli hub command to update the hub cache and list installed configurations
    • Adds cscli lapi command to register with or check status to a Local API instance

    +3 more show less

    • Adds cscli machines command to create, delete, and list registered machines
    • Adds cscli alerts inspect <alert_id> to view detailed information about specific alerts
    • Supports journald as an acquisition datasource via the journalctl_filter configuration key

    8 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The runtime object SignalOccurences is replaced by Alerts
    • !The runtime object ban is replaced by Decisions
    • !The profile.yaml field Sig becomes Alert
    • !The command cscli ban list is renamed to cscli alerts list
74. v0.3.7 Nov 20, 2020 · release notes

    Adds systemd integration to enable/disable CrowdSec service

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.3.7 https://github.com/crowdsecurity/crowdsec.git
    # already have the repo? check out this version:
    $ git checkout v0.3.7

    • Enables/disables CrowdSec through systemd

    1 detail in Everything

75. v0.3.1 Aug 24, 2020 · release notes

    Adds Prometheus metric aggregation support

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.3.1 https://github.com/crowdsecurity/crowdsec.git
    # already have the repo? check out this version:
    $ git checkout v0.3.1

76. v0.3.0 Aug 5, 2020 · release notes

    CrowdSec v0.3.0 adds MySQL backend support and scenario simulation capability.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.3.0 https://github.com/crowdsecurity/crowdsec.git
    # already have the repo? check out this version:
    $ git checkout v0.3.0

    • Add mysql as a supported output backend for storing Crowdsec data
    • Add simulation mode to test scenarios without applying real bans

    2 details in Everything

77. v0.2.0 Jun 19, 2020 · release notes

    CrowdSec v0.2.0 adds SIGHUP reload support for the daemon and new instance count metrics.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.2.0 https://github.com/crowdsecurity/crowdsec.git
    # already have the repo? check out this version:
    $ git checkout v0.2.0

    └──▷ HOW TO FIND IT
    Reload CrowdSec configuration without downtime by sending the SIGHUP signal to the process.
    📍kill -SIGHUP <crowdsec_pid>
    • Adds SIGHUP signal support to reload configuration without restarting the CrowdSec service
    • Exposes a new metric counting the current number of instances for a given bucket

    2 details in Everything

78. v0.1.0 Jun 2, 2020 · release notes

    CrowdSec v0.1.0 adds File, RegexpInFile, and JsonExtract expression helpers for parsers and scenarios

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.1.0 https://github.com/crowdsecurity/crowdsec.git
    # already have the repo? check out this version:
    $ git checkout v0.1.0

    • Adds File and RegexpInFile expr helpers to allow constructs such as filter: evt.Parsed.user_agent in File("bad_user_agents.txt")
    • Adds JsonExtract exp helper to allow constructs such as JsonExtract(evt.Parsed.some_field, "one_item.sub_item.array_entry[0]")

    2 details in Everything

79. v0.0.3 May 26, 2020 · release notes

    CrowdSec v0.0.3 adds JSON support via expr helpers and merges cscli crowdsec config

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.0.3 https://github.com/crowdsecurity/crowdsec.git
    # already have the repo? check out this version:
    $ git checkout v0.0.3

    └──▷ USE IT
    Access the unified configuration interface previously available under the old command path
    shell copy

    cscli crowdsec config get

    • Adds expr helper functions for JSON processing to expand detection logic capabilities
    • Merges the previous crowdsec-config subcommand into the new cscli crowdsec config command structure

    2 details in Everything