https://cybertoolchain.io/tools/crowdsec New releases and features in CrowdSec, tracked by The Cyber Toolchain. en Mon, 26 Oct 2026 14:16:43 GMT https://github.com/crowdsecurity/crowdsec/releases/tag/v1.8.2 https://github.com/crowdsecurity/crowdsec/releases/tag/v1.8.2 Mon, 26 Oct 2026 14:16:43 GMT CrowdSec v1.8.2 adds WAF rate limiting, custom JS bot fingerprinting, a new `cscli bot` subcommand, and several new expression helpers.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `cscli bot` subcommand for managing bot detection from the CLI and `FlagSubmission()` helper to bot detection for marking submission events.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `SkipProcessing()` helper to the WAF for conditionally bypassing rule evaluation and a rate limiting feature enabling request-rate-based blocking at the application layer. • Adds `GetDecisionsSinceCountByScenario` expression helper for querying per-scenario decision counts. • Adds custom JS fingerprinting to bot detection, allowing user-defined and hub-distributed detection rules, and optional `SameSite=None` and `Partitioned` flag support on bot detection cookies. • Adds optional `category` field to the AppSec request score for finer-grained scoring classification. • Adds `cs_features` Prometheus metric to track which Security Engine features are active. • Adds `kind` label to the `cs_alerts` Prometheus metric and a CAPI last-pull timestamp and error counter to metrics. • Adds optional concurrency limit for simultaneous decision stream requests via LAPI and makes decision stream page size configurable in LAPI. • Enables automatic TLS server certificate reload when certificate files change on disk. • Adds `LookupHost` DNS cache support in expression helpers to reduce repeated DNS lookups. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/crowdsec https://github.com/crowdsecurity/crowdsec/releases/tag/v1.8.1 https://github.com/crowdsecurity/crowdsec/releases/tag/v1.8.1 Thu, 03 Sep 2026 09:08:57 GMT CrowdSec v1.8.1 adds a HasValidChallengeCookie() helper for bot detection logic. • Adds HasValidChallengeCookie() helper function for use in bot detection scenarios, enabling challenge cookie validation checks. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/crowdsec https://github.com/crowdsecurity/crowdsec/releases/tag/v1.8.0 https://github.com/crowdsecurity/crowdsec/releases/tag/v1.8.0 Mon, 31 Aug 2026 11:09:08 GMT CrowdSec v1.8.0 adds WAF bot detection with challenge/fingerprinting, a Kubernetes log datasource, and HTTP expression helpers. • Adds WAF bot detection (`waf challenge mode`) that serves a challenge-and-fingerprinting page to clients before granting site access, with configurable score thresholds and cookie-disabled error messaging. • Adds a dedicated Kubernetes datasource that fetches logs directly from the k8s API server, giving CrowdSec native k8s log acquisition without an agent proxy. • Adds HTTP helpers to the expression language, enabling parsers and scenarios to query external services inline. • Adds `cs_machines_heartbeat_seconds` metric for tracking agent heartbeat timing. • Revamps `cscli console status` into an all-in-one status view. • Improves `cscli hub list` output. • Adds configurable auth timeout from WAF to LAPI. • Makes `RejectSubmission` generate an alert, surfacing WAF submission rejections in the alert stream. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/crowdsec https://github.com/crowdsecurity/crowdsec/releases/tag/v1.7.8 https://github.com/crowdsecurity/crowdsec/releases/tag/v1.7.8 Mon, 11 May 2026 07:53:36 GMT CrowdSec v1.7.8 adds WAF OpenAPI schema validation, chunked decision streaming, and a faster cscli enroll flow. • Adds OpenAPI schema validation to the WAF, enabling automatic request inspection against defined API schemas. • Enforces body size limits in the WAF to cap memory exposure on large incoming payloads. • Switches the decision stream to chunked transfer encoding by default, improving delivery of large decision sets. • Adds `--quick` flag to the `cscli enroll` command for faster enrollment workflows. • Introduces a cleaner alternative configuration format for appsec-config. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/crowdsec https://github.com/crowdsecurity/crowdsec/releases/tag/v1.7.7 https://github.com/crowdsecurity/crowdsec/releases/tag/v1.7.7 Mon, 30 Mar 2026 13:02:24 GMT CrowdSec v1.7.7 switches to RE2 regexp engine on Linux, adds flexible WAF AND/OR conditions, a new allowlist import command, and a `kind` alert attribute. • Enables RE2 as the default regexp engine on Linux, delivering significantly faster parser evaluation with the option to revert via the `re2_disable_grok_support` feature flag. • WAF rules now support arbitrary mixes of AND/OR conditions with no structural limits, enabling much more expressive rule authoring. • Adds `cscli allowlist import` command for bulk importing allowlist entries. • Introduces a new `kind` attribute on alerts to identify their source (scenario, WAF rule, manual decision, etc.). • Adds `LookupFile` and `FileMap` expression helpers for use in parsers. • Exposes additional Coraza transformations in the WAF engine. • Supports the `HTTP_PROXY` environment variable in the `notification-http` plugin for proxy-aware HTTP notifications. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/crowdsec https://github.com/crowdsecurity/crowdsec/releases/tag/v1.7.5 https://github.com/crowdsecurity/crowdsec/releases/tag/v1.7.5 Thu, 22 Jan 2026 12:08:54 GMT CrowdSec v1.7.5 adds flexible key-value parsing and AppSec transaction ID tracing for improved log analysis and request correlation. • Adds `ParseKVLax` for flexible, lenient key-value parsing in parser expressions. • Supports transaction ID header injection in AppSec for end-to-end request tracing. • Adds JSON schema validation for the Docker datasource configuration. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/crowdsec https://github.com/crowdsecurity/crowdsec/releases/tag/v1.7.4 https://github.com/crowdsecurity/crowdsec/releases/tag/v1.7.4 Thu, 04 Dec 2025 13:56:39 GMT CrowdSec v1.7.4 adds a WAF DropRequest hook helper, syslog log media support, and a new option to disable usage metrics export. • Adds `DropRequest` helper to WAF hooks, enabling rules to programmatically block requests directly within AppSec hook logic. • Adds `log_media="syslog"` logging configuration option, allowing CrowdSec to route log output to syslog. • Adds `api.server.disable_usage_metrics_export` option to suppress usage metrics export from the LAPI server. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/crowdsec https://github.com/crowdsecurity/crowdsec/releases/tag/v1.7.1 https://github.com/crowdsecurity/crowdsec/releases/tag/v1.7.1 Wed, 15 Oct 2025 10:44:03 GMT CrowdSec v1.7.1 adds WAF glob includes, FQDN alert metadata, auditd detection, and AWS SDK v2 for cloud datasources. • WAF: stores the target FQDN in alert metadata for richer context in WAF-triggered alerts. • WAF: supports glob patterns when including SecLang rule files, enabling flexible rule-set organization. • WAF: adds `fromFile` match type for WAF rules, allowing match lists to be loaded from external files. • Adds `cscli setup` detection support for auditd, expanding automatic service discovery. • Updates Kinesis, CloudWatch, and S3 datasources to AWS SDK v2. • Adds Docker acquisition timeout resilience to handle socket proxy errors gracefully. • `cscli support dump` now collects detailed system information via gopsutil. • Replaces cron-based scheduling with a systemd timer for improved lifecycle management. • `cscli hubtest --appsec` now exits early with a clear error when nuclei cannot be invoked. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/crowdsec https://github.com/crowdsecurity/crowdsec/releases/tag/v1.6.10 https://github.com/crowdsecurity/crowdsec/releases/tag/v1.6.10 Thu, 10 Jul 2025 12:04:30 GMT CrowdSec v1.6.10 adds allowlist IP checking, SNS support for S3, and GET/HEAD for HTTP datasource • Adds `cscli allowlists check` command to check whether an IP or range belongs to an allowlist. • Supports SNS notification format in the S3 datasource, enabling log ingestion triggered by SNS events. • Supports GET and HEAD requests in the HTTP datasource so log providers can confirm the datasource is reachable. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/crowdsec https://github.com/crowdsecurity/crowdsec/releases/tag/v1.6.9 https://github.com/crowdsecurity/crowdsec/releases/tag/v1.6.9 Tue, 17 Jun 2025 11:54:50 GMT CrowdSec v1.6.9 adds self-unregistering log processors, automatic allowlist decision cleanup, PAPI auto-enable, and Docker event-driven acquisition. • Adds option for a log processor to unregister itself from LAPI on shutdown, keeping active processor lists clean in dynamic environments like Kubernetes. • Allowlists now automatically delete matching active decisions when an allowlist is created or updated. • PAPI (Polling API) is now automatically enabled or disabled when CrowdSec detects a console plan change, simplifying initial setup. • Docker datasource now uses Docker events instead of polling to detect new containers, improving performance. • Kafka datasource exposes batching configuration options. • HTTP acquisition now supports a `listen_socket` option for Unix socket listeners. • Adds support for 'd' (day) suffix in profile duration fields. • LAPI now returns a specific error when a Unix socket path exceeds the OS limit. Breaking changes: • Docker acquisition now requires access to the Docker events API endpoint — if you are using a socket proxy, its configuration must be updated to allow this endpoint. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/crowdsec https://github.com/crowdsecurity/crowdsec/releases/tag/v1.6.6 https://github.com/crowdsecurity/crowdsec/releases/tag/v1.6.6 Tue, 18 Mar 2025 13:05:01 GMT CrowdSec v1.6.6 adds centralized allowlists, JA4H fingerprinting, mTLS/custom CA for databases, and new AppSec expr helpers. • Adds centralized allowlists managed via LAPI or the console, automatically applied to local decisions, AppSec rules, and blocklists without per-machine deployment. • Adds JA4H expression helper for AppSec to compute JA4H fingerprint hashes for HTTP requests. • Adds custom CA and mTLS authentication support for PostgreSQL and MySQL database connections via new SSL options in db configuration. • Adds `ExtractQueryParam` expression helper (alongside relocated `ParseQuery`) for use in AppSec and parsing rules. • Adds enable/disable options for console enrollment; makes alert context a default enrollment option. • Adds option to disable magic syslog RFC parsers. • Adds parallel hubtest execution for faster hub testing workflows. Breaking changes: • `capi_whitelists_path` is deprecated; users should migrate to centralized allowlists. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/crowdsec https://github.com/crowdsecurity/crowdsec/releases/tag/v1.6.5 https://github.com/crowdsecurity/crowdsec/releases/tag/v1.6.5 Fri, 07 Feb 2025 13:44:35 GMT CrowdSec v1.6.5 adds VictoriaLogs datasource, configurable log formats, and an overhauled cscli hub command. • New VictoriaLogs datasource lets CrowdSec ingest logs directly from a VictoriaLogs instance. • Configurable log format support allows operators to set the output log format for CrowdSec. • Revamped `cscli hub` command with improved hub management, richer output, and built-in examples. • Environment variable expansion now supported when loading acquisition configuration. • New `--interactive` flag on applicable `cscli` commands replaces the former `--yes` flag for guided prompts. • Autocomplete added for `cscli metrics show` subcommand. • Dashboard setup now accepts environment variable configuration via a dedicated flag in `cscli`. • Expired decisions are now highlighted in red in `cscli` decision output for faster triage. • `hub upgrade` now runs automatically during rpm/deb post-installation steps. Breaking changes: • The `--yes` option in `cscli` is replaced by `--interactive`; scripts or automation using `--yes` will break. • The `cscli config backup` and `cscli config restore` commands have been removed; any workflows relying on them will fail. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/crowdsec https://github.com/crowdsecurity/crowdsec/releases/tag/v1.6.4 https://github.com/crowdsecurity/crowdsec/releases/tag/v1.6.4 Wed, 20 Nov 2024 11:19:55 GMT CrowdSec v1.6.4 adds HTTP datasource ingestion, AppSec alert context, EVTX replay, and bouncer API key sharing. • New HTTP datasource enables CrowdSec to ingest logs from HTTP endpoints such as Datadog or Vector. • Alert context is now available when using the AppSec component, enriching alerts with request-level context. • Windows users can replay WinEvent EVTX files for historical log analysis. • Bouncers on different machines can share the same API key without interference; each appears as `bouncer_name@IP` in the bouncer list. • Supports multiple AppSec configurations simultaneously. • New `no_ready_check` option for the Loki datasource. • Adds explicit configuration options for signals sharing and blocklist pull behavior. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/crowdsec https://github.com/crowdsecurity/crowdsec/releases/tag/v1.6.3 https://github.com/crowdsecurity/crowdsec/releases/tag/v1.6.3 Tue, 10 Sep 2024 09:46:08 GMT CrowdSec v1.6.3 adds bouncer efficiency metrics, richer machine/bouncer inspection, and a new Hub API backend. • New `cscli metrics show bouncers` command surfaces remediation component efficiency stats (blocked packets/bytes, HTTP requests) in the CLI and console. • Remediation components (starting with firewall-bouncer 0.0.30) can now report detailed metrics — visible per-instance in the CrowdSec console. • New `cscli machines inspect` and `cscli bouncers inspect` commands expose detailed info including underlying OS for easier management of larger deployments. • Machines can now auto-register with the Local API, simplifying Kubernetes and Docker onboarding. • New `--ignore-missing` option for `cscli bouncers delete` and `cscli machines delete` enables idempotent scripted teardowns. • New `cscli doc --target /path/to/dir` command generates CLI documentation to a specified directory. • New `default_range_remediation` configuration option added for more granular remediation control. • Hub now backed by a new Hub API, enabling new item types (acquisition files, notification templates) and larger collections (e.g., Sigma). • `cscli hub update` gains `--with-content` option to retain embedded items in the index, used by default in Docker. • Environment variables can now be expanded in `local_api_credentials.yaml` and `.yaml.local` config files. • OpenBSD support added for filesystem type detection via correct `statfs` struct member. • LAPI CAPI status query can now also return enrollment status. • Improved TLS middleware with stronger revocation checks. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/crowdsec https://github.com/crowdsecurity/crowdsec/releases/tag/v1.6.2 https://github.com/crowdsecurity/crowdsec/releases/tag/v1.6.2 Fri, 31 May 2024 08:28:19 GMT Adds File notification plugin and Slack configuration options • Introduces the File notification plugin as a new integration point. • Adds `channel`, `username`, and `icon_emoji`/`icon_url` config keys in `.cs/config.yaml` under `notifications.slack` to customize Slack bot appearance. • Adds GetActiveDecisionsCount() and GetActiveDecisionsTimeLeft() expression helpers for decision queries. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/crowdsec https://github.com/crowdsecurity/crowdsec/releases/tag/v1.6.1 https://github.com/crowdsecurity/crowdsec/releases/tag/v1.6.1 Tue, 16 Apr 2024 09:44:10 GMT CrowdSec v1.6.1 adds local API unix socket support, high availability mode, and patterns_dir config. • Adds `patterns_dir` configuration option to specify where custom pattern files are loaded from • LAPI: local api unix socket support allows connecting via Unix domain socket instead of TCP • Implement highAvailability feature for service redundancy • appsec unix socket support enables the application security engine to listen on a Unix socket Full history on Cyber Toolchain: https://cybertoolchain.io/tools/crowdsec https://github.com/crowdsecurity/crowdsec/releases/tag/v1.6.0 https://github.com/crowdsecurity/crowdsec/releases/tag/v1.6.0 Wed, 24 Jan 2024 09:22:49 GMT CrowdSec v1.6.0 adds AppSec engine support, Loki integration, and a new `cpu-profile` flag • Adds support for the Application Security Engine to detect web application attacks. • Adds Loki integration for log forwarding. • Adds `--cpu-profile` flag to `crowdsec` CLI commands for profiling. • Enables console management via the `CS_CONSOLE_MANAGEMENT` environment variable. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/crowdsec https://github.com/crowdsecurity/crowdsec/releases/tag/v1.5.5 https://github.com/crowdsecurity/crowdsec/releases/tag/v1.5.5 Mon, 23 Oct 2023 12:16:02 GMT CrowdSec v1.5.5 adds configurable timeouts to email notifications and alert aliases in cscli. • Adds `timeout` configuration options to the notification-email plugin for controlling send delays • Adds `alert alias` subcommand to `cscli` for managing alert annotations Full history on Cyber Toolchain: https://cybertoolchain.io/tools/crowdsec https://github.com/crowdsecurity/crowdsec/releases/tag/v1.5.3 https://github.com/crowdsecurity/crowdsec/releases/tag/v1.5.3 Mon, 18 Sep 2023 12:10:36 GMT Adds Sentinel notification plugin, bayesian bucket type, cscli explain labels, and bouncer/machine prune commands. • Adds sentinel notification plugin for alert forwarding • Adds bayesian bucket type (new scenario engine) • Adds `--labels` flag to `cscli explain` command • Adds `cscli bouncer prune` subcommand to remove stale bouncers • Adds `cscli machine prune` subcommand to remove stale machines • `cscli metrics` output format changes from plain list to a map keyed by table name Breaking changes: • `cscli metrics -o json|raw` output structure changed from a plain list to a map with table names as keys. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/crowdsec https://github.com/crowdsecurity/crowdsec/releases/tag/v1.5.2 https://github.com/crowdsecurity/crowdsec/releases/tag/v1.5.2 Fri, 26 May 2023 14:37:26 GMT Adds support for capi_whitelists.yaml configuration file. • Supports `capi_whitelists.yaml` to define whitelists for CrowdSec API integration Full history on Cyber Toolchain: https://cybertoolchain.io/tools/crowdsec https://github.com/crowdsecurity/crowdsec/releases/tag/v1.4.3 https://github.com/crowdsecurity/crowdsec/releases/tag/v1.4.3 Wed, 30 Nov 2022 13:42:49 GMT CrowdSec v1.4.3 adds USE_WAL docker arg, cscli pgx config visibility, and agent reauth on 403. • Adds `USE_WAL` environment variable to Docker arguments for enabling Write-Ahead Log mode • `cscli config show` now prints host/port/user/dbname fields when the database driver is set to `pgx` • Force agent reauthentication on 403 HTTP response codes instead of failing silently Full history on Cyber Toolchain: https://cybertoolchain.io/tools/crowdsec https://github.com/crowdsecurity/crowdsec/releases/tag/v1.4.2 https://github.com/crowdsecurity/crowdsec/releases/tag/v1.4.2 Tue, 15 Nov 2022 11:10:44 GMT CrowdSec v1.4.2 adds Kafka data source support, `cscli support dump`, `reinject` CLI commands, and LookupHost expression lib func. • Adds `cscli support dump` command to generate support artifacts • Adds `LookupHost` function to the expression language library • Adds `helo` config key to the email notification plugin configuration • Adds environment variable loading capability for plugins • Adds Docker build flavors: slim, with-plugins, with-geoip, full • Adds config option to enable or disable local API and agent Full history on Cyber Toolchain: https://cybertoolchain.io/tools/crowdsec https://github.com/crowdsecurity/crowdsec/releases/tag/v1.4.1 https://github.com/crowdsecurity/crowdsec/releases/tag/v1.4.1 Mon, 25 Jul 2022 08:13:34 GMT CrowdSec v1.4.1 adds Windows support, .local config files, cert auth for agents/bouncers, and dynamic decision duration • Support for `.local` configuration files to customize settings without breaking upgrades. • `profiles.yaml` now accepts the `dynamic_duration` field in ban actions to set incremental decision durations. • CrowdSec agent runs natively on Windows. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/crowdsec https://github.com/crowdsecurity/crowdsec/releases/tag/v1.4.0 https://github.com/crowdsecurity/crowdsec/releases/tag/v1.4.0 Tue, 19 Jul 2022 07:50:18 GMT CrowdSec v1.4.0 adds Windows support, cert auth for agents/bouncers, dynamic profile durations, and notifications command • Adds `.local` configuration file support for upgrade-resilient customization • Enables certificate-based client authentication for agents and bouncers • Allows incremental duration settings in `profiles.yaml` profiles • Introduces the `cscli notifications` command for managing notifications Full history on Cyber Toolchain: https://cybertoolchain.io/tools/crowdsec https://github.com/crowdsecurity/crowdsec/releases/tag/v1.3.3 https://github.com/crowdsecurity/crowdsec/releases/tag/v1.3.3 Mon, 25 Apr 2022 19:55:42 GMT CrowdSec v1.3.3 adds -m flag to decisions list, query params for filtering, trusted IPs for admin API, and force enroll. • Add `-m` flag to `cscli decisions list` to display the machine name • Add query parameters `scenarios` and `origin` to filter decisions in the API stream • Add `force` subcommand to `cscli enroll` for automated unattended setup Full history on Cyber Toolchain: https://cybertoolchain.io/tools/crowdsec https://github.com/crowdsecurity/crowdsec/releases/tag/v1.3.0 https://github.com/crowdsecurity/crowdsec/releases/tag/v1.3.0 Tue, 25 Jan 2022 10:29:52 GMT Adds Kinesis datasource, Lists support from central API, PGX DB driver, and custom decision push to crowdsec v1.3.0 • `Kinesis datasource` enables ingesting logs directly from AWS Kinesis streams • Adds `PGX` as a supported PostgreSQL driver (`pgx`) • Allows pushing custom, tainted, or manual decisions via the central API Breaking changes: • The configuration file `console_config.yaml` has been renamed to `console.yaml` Full history on Cyber Toolchain: https://cybertoolchain.io/tools/crowdsec https://github.com/crowdsecurity/crowdsec/releases/tag/v1.2.3 https://github.com/crowdsecurity/crowdsec/releases/tag/v1.2.3 Thu, 06 Jan 2022 10:23:28 GMT CrowdSec v1.2.3 adds email notification plugin, log rotation config, and wizard support for Raspbian • Adds email notification plugin to alert on security events • Allows configuring log rotation behavior via service settings • Enables the installation wizard to run on Raspbian OS Full history on Cyber Toolchain: https://cybertoolchain.io/tools/crowdsec https://github.com/crowdsecurity/crowdsec/releases/tag/v1.2.2 https://github.com/crowdsecurity/crowdsec/releases/tag/v1.2.2 Tue, 21 Dec 2021 16:01:53 GMT Adds `cscli decisions import`, Docker datasource support, and `cancel_on` decision configuration • `cscli decisions import` subcommand to load decisions from external sources for immediate enforcement. • New `docker` datasource type enables ingesting CrowdSec events directly from Docker daemon logs. • Support for the `cancel_on` configuration field in decision objects, allowing automated expiration of blocks based on event criteria. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/crowdsec https://github.com/crowdsecurity/crowdsec/releases/tag/v1.2.1 https://github.com/crowdsecurity/crowdsec/releases/tag/v1.2.1 Wed, 17 Nov 2021 14:24:44 GMT CrowdSec v1.2.1 adds `cscli explain`, new CLI flags, and IAM role support for Cloudwatch. • Adds the `cscli explain` command to debug log processing and parser execution • Allows specifying an AWS IAM role for Cloudwatch collection via environment variables instead of hardcoded tokens • Adds the `--key` flag to `cscli config show` to filter configuration output • Adds `name` and `alias` parameters to `cscli console enroll` for bouncer identification • Adds the `--limit` flag to `cscli decisions list` to cap the number of returned results Full history on Cyber Toolchain: https://cybertoolchain.io/tools/crowdsec