# CrowdSec

> Open-source collaborative security engine and intrusion prevention system using crowdsourced threat data.

CrowdSec is an open-source intrusion detection and prevention system (IDS/IPS) and web application firewall that analyzes server logs and HTTP traffic. When it spots an attack, it blocks the malicious IP locally and contributes the reputation data back to a global community blocklist. This crowdsourced architecture lets participating servers preemptively block known bad actors before they ever target your infrastructure.

Website: https://github.com/crowdsecurity/crowdsec

## What it is for

- Protect Linux servers from automated SSH brute-force attacks
- Block malicious web traffic and scrapers using WAF rules and JS proof-of-work challenges
- Preemptively ban aggressive botnets using real-time community threat intelligence
- Centralize log parsing across a cluster while enforcing remediation at reverse proxies or firewalls

## Features

- Decoupled architecture to detect threats in logs and enforce remediation at firewalls, CDNs, or reverse proxies
- Community blocklist that distributes aggregated threat intelligence globally
- AppSec WAF component compatible with Coraza and OWASP Core Rule Set
- Bot and scraper mitigation via configurable JavaScript proof-of-work challenges
- CrowdSec Hub ecosystem for downloading community scenarios, parsers, and remediation bouncers
- Cross-platform support for Linux, Windows, Docker, Kubernetes, and OPNsense

## Pricing

Open source. Free and open-source under MIT license; optional commercial tiers for centralized enterprise console and premium blocklists.

## Details

- Type: GitHub repo
- Category: [Development](https://xiry.app/topics/development.md)
- Topic: [Server Security](https://xiry.app/topics/development/server-security.md)
- Open source: yes
- Platforms: Linux, Windows, Command line, Self-hosted
- For: System administrators, DevOps engineers, and self-hosters securing servers and web apps.
- Alternative to: fail2ban, ModSecurity
- Tags: security, ids, ips, firewall, waf, threat intelligence, devops

## Why it was saved

- [@brusnicadev, 16 August 2026](https://www.instagram.com/reel/DcGacI2D1gF/): Acts like a crowdsourced Fail2ban: blocks bad IPs reported by other servers before they ever attempt to attack your machine.

## Related

- [Check SSH Brute-Force Login Attempts](https://xiry.app/resources/check-ssh-brute-force-login-attempts): Terminal commands to count and monitor failed SSH logins on Linux (Tip, Free)
- [endlessh-go](https://xiry.app/resources/endlessh-go): SSH tarpit written in Go with built-in Prometheus metrics and Grafana support (GitHub repo, Open source)
- [Fail2Ban](https://xiry.app/resources/fail2ban): Log-monitoring daemon that dynamically blocks IP addresses causing repeated authentication failures. (GitHub repo, Open source)
- [SSH Brute-Force Protection with fail2ban and ufw](https://xiry.app/resources/ssh-brute-force-protection-with-fail2ban-and-ufw): Quick commands to detect and block SSH brute-force attacks on Linux (Tip, Free)
- [AIMap](https://xiry.app/resources/aimap): Discovery and security testing platform for exposed internet-facing AI endpoints. (Web app, Open source)
- [Antimetal](https://xiry.app/resources/antimetal): Autonomous production engineering platform that diagnoses, triages, and fixes runtime issues (Web app, Paid)

Updated 3 October 2026. Page: https://xiry.app/resources/crowdsec

Make your own library: Xiry takes your saved reels, tweets, Reddit bookmarks and Watch Later videos, makes them searchable and pulls the useful stuff out, like this library. It's invite-only for now; join the waitlist at https://xiry.app/#waitlist.