Getting Started

Getting an API Key

When logged on the console, you can create an API Key from the "CTI API" section :

Accessing the API

You can query the API about a given IP from the command line:

curl -H "x-api-key: YOUR_API_KEY" https://cti.api.crowdsec.net/v2/smoke/185.7.214.104 | jq .

And the default output looks something like this:

{  "ip_range_score": 5,  "ip": "185.7.214.104",  "ip_range": "185.7.214.0/24",  "as_name": "Chang Way Technologies Co. Limited",  "as_num": 57523,  "location": {    "country": "RU",    "city": null,    "latitude": 55.7386,    "longitude": 37.6068  },  "reverse_dns": null,  "behaviors": [    {      "name": "http:exploit",      "label": "HTTP Exploit",      "description": "IP has been reported for attempting to exploit a vulnerability in a web application."    },    {      "name": "http:scan",      "label": "HTTP Scan",      "description": "IP has been reported for performing actions related to HTTP vulnerability scanning and discovery."    }  ],  "history": {    "first_seen": "2022-06-14T21:30:00+00:00",    "last_seen": "2022-07-22T11:45:00+00:00",    "full_age": 39,    "days_age": 38  },  "classifications": {    "false_positives": [],    "classifications": [      {        "name": "community-blocklist",        "label": "CrowdSec Community Blocklist",        "description": "IP belong to the CrowdSec Community Blocklist"      }    ]  },  "attack_details": [    {      "name": "crowdsecurity/http-cve-2021-41773",      "label": "Apache CVE-2021-41773",      "description": "Detect Apache CVE-2021-41773 exploitation attemtps",      "references": [        "https://nvd.nist.gov/vuln/detail/CVE-2021-41773"      ]    },    {      "name": "crowdsecurity/thinkphp-cve-2018-20062",      "label": "ThinkPHP CVE-2018-20062",      "description": "Detect ThinkPHP CVE-2018-20062 exploitation attemps",      "references": []    },    {      "name": "crowdsecurity/modsecurity",      "label": "ModSecurity CRS",      "description": "Detect web exploitation via modsecurity",      "references": []    },    {      "name": "crowdsecurity/http-probing",      "label": "HTTP Scanner",      "description": "Detect site scanning/probing from a single ip",      "references": []    }  ],  "target_countries": {    "FR": 35,    "US": 19,    "DE": 18,    "NL": 6,    "GB": 5,    "CA": 4,    "AU": 2,    "RU": 2,    "SE": 2,    "CH": 1  },  "scores": {    "overall": {      "aggressiveness": 5,      "threat": 5,      "trust": 5,      "anomaly": 1,      "total": 5    },    "last_day": {      "aggressiveness": 5,      "threat": 5,      "trust": 5,      "anomaly": 1,      "total": 5    },    "last_week": {      "aggressiveness": 5,      "threat": 5,      "trust": 5,      "anomaly": 1,      "total": 5    },    "last_month": {      "aggressiveness": 5,      "threat": 5,      "trust": 5,      "anomaly": 1,      "total": 5    }  },  "references": []}