Development · GitHub repo
CrowdSec
Open-source collaborative security engine and intrusion prevention system using crowdsourced threat data.
CrowdSec is an open-source intrusion detection and prevention system (IDS/IPS) and web application firewall that analyzes server logs and HTTP traffic. When it spots an attack, it blocks the malicious IP locally and contributes the reputation data back to a global community blocklist. This crowdsourced architecture lets participating servers preemptively block known bad actors before they ever target your infrastructure.
What it's for
- Protect Linux servers from automated SSH brute-force attacks
- Block malicious web traffic and scrapers using WAF rules and JS proof-of-work challenges
- Preemptively ban aggressive botnets using real-time community threat intelligence
- Centralize log parsing across a cluster while enforcing remediation at reverse proxies or firewalls
Features
- Decoupled architecture to detect threats in logs and enforce remediation at firewalls, CDNs, or reverse proxies
- Community blocklist that distributes aggregated threat intelligence globally
- AppSec WAF component compatible with Coraza and OWASP Core Rule Set
- Bot and scraper mitigation via configurable JavaScript proof-of-work challenges
- CrowdSec Hub ecosystem for downloading community scenarios, parsers, and remediation bouncers
- Cross-platform support for Linux, Windows, Docker, Kubernetes, and OPNsense
Pricing
Open source. Free and open-source under MIT license; optional commercial tiers for centralized enterprise console and premium blocklists.
Details
- Type
- GitHub repo
- Category
- Development
- Topic
- Server Security
- Open source
- Yes
- Platforms
- Linux, Windows, Command line, Self-hosted
- For
- System administrators, DevOps engineers, and self-hosters securing servers and web apps.
- Alternative to
- fail2ban, ModSecurity
- Tags
- security, ids, ips, firewall, waf, threat intelligence, devops
Why it was saved
- @brusnicadev: Acts like a crowdsourced Fail2ban: blocks bad IPs reported by other servers before they ever attempt to attack your machine.
Related
Terminal commands to count and monitor failed SSH logins on Linux
SSH tarpit written in Go with built-in Prometheus metrics and Grafana support
Log-monitoring daemon that dynamically blocks IP addresses causing repeated authentication failures.
Quick commands to detect and block SSH brute-force attacks on Linux
Discovery and security testing platform for exposed internet-facing AI endpoints.
Autonomous production engineering platform that diagnoses, triages, and fixes runtime issues
Updated