Repolode
Submit
crowdsecurity

crowdsecurity/crowdsec

Open-source intrusion detection and prevention engine that parses logs and HTTP traffic, blocks malicious IPs, and shares threat signals in a crowdsourced blocklist.

Open-source alternative to:Cloudflare WAFfail2ban

View on GitHubWebsite
Stars
15,265
Forks
751
Open issues
297
Last commit
yesterday

What is it?

CrowdSec is a security engine that detects malicious behavior by analyzing log sources and HTTP requests, then blocks attackers through remediation components such as firewall, reverse proxy, or CDN bouncers. It covers IDS/IPS duties through log-based scenarios and a WAF through its AppSec component, which is built on Coraza and can load SecLang rules and the OWASP Core Rule Set.

Detection and remediation are decoupled, so logs can be parsed on one machine while blocking happens on another. IPs reported by installations feed a community blocklist, so an address that attacks one user can be blocked for others. The AppSec component can also issue a JavaScript proof-of-work challenge to suspicious requests to slow headless browsers and scrapers, while allowing verified crawlers.

Default scenarios cover brute force, port scanning, and web scanning, and more can be installed from the CrowdSec Hub. The engine runs on Linux, Windows, Docker, Kubernetes, and other platforms, with a web console for monitoring and management.

Key features

  • 01Parses logs and analyzes HTTP requests to detect malicious behavior.
  • 02AppSec WAF compatible with SecLang rules and the OWASP Core Rule Set.
  • 03Community blocklist that proactively blocks IPs reported by other users.
  • 04Decoupled detection and remediation across machines via bouncers.
  • 05Proof-of-work JavaScript challenges for suspicious bots and scrapers.
  • 06Detection scenarios installable from the CrowdSec Hub under MIT license.

Use cases

  • Protecting Linux or Windows servers from brute force and port scanning.
  • Adding a WAF in front of web applications using existing OWASP rules.
  • Blocking known malicious IPs at firewalls, proxies, or CDNs across a fleet.
  • Mitigating scrapers and headless bots on public websites.

Quick start

  1. 1

    Follow the official documentation at docs.crowdsec.net to install CrowdSec on your platform

Topics

#intrusion-detection#waf#firewall#threat-intelligence#bot-detection#cybersecurity#kubernetes#docker#anti-bot#blocklist

FAQ

What is crowdsec?
Open-source intrusion detection and prevention engine that parses logs and HTTP traffic, blocks malicious IPs, and shares threat signals in a crowdsourced blocklist. CrowdSec is a security engine that detects malicious behavior by analyzing log sources and HTTP requests, then blocks attackers through remediation components such as firewall, reverse proxy, or CDN bouncers. It covers IDS/IPS duties through log-based scenarios and a WAF through its AppSec component, which is built on Coraza and can load SecLang rules and the OWASP Core Rule Set.
Is crowdsec free to use? What license does it have?
crowdsec is open source under the MIT license. Check the license terms before using it in commercial products.
Is crowdsec still maintained?
Actively maintained. The last commit to crowdsec was on Oct 22, 2026.
What can I use crowdsec for?
Protecting Linux or Windows servers from brute force and port scanning. Adding a WAF in front of web applications using existing OWASP rules. Blocking known malicious IPs at firewalls, proxies, or CDNs across a fleet. Mitigating scrapers and headless bots on public websites.
How do I install crowdsec?
Follow the official documentation at docs.crowdsec.net to install CrowdSec on your platform
Where can I get crowdsec?
The source code and installation instructions are on GitHub: https://github.com/crowdsecurity/crowdsec

Summary generated by AI from the project's README. GitHub stats refresh daily.

Related projects