Application Security Component

This module allows you to enable the Application Security Component as a data source.

More detailed documentation is available in the AppSec documentation.

A quickstart tutorial is available for Nginx/OpenResty and Traefik.

Configuration example

To start an Application Security Component on port 7422, listening on 127.0.0.1, using the crowdsecurity/appsec-default configuration:

YAML

source: appsec
listen_addr: 127.0.0.1:7422
path: /
appsec_configs:
  - crowdsecurity/appsec-default
labels:
  type: appsec

Parameters

listen_addr

The address and port to listen on. Defaults to 127.0.0.1:7422.

path

The path the Application Security Component will respond to. Defaults to /.

appsec_configs

The list of appsec-configs to use (as seen in cscli appsec-configs list).

An entry can also be a glob pattern (* and ?), which is expanded to all the installed appsec-configs matching it, for example crowdsecurity/appsec-bot-challenge-exclude-*. A pattern matching no installed appsec-config is an error.

appsec_config

Deprecated, use appsec_configs

appsec_config_path

Deprecated, use appsec_configs

routines

Number of routines to use to process the requests. Defaults to 1.

auth_cache_duration

How long to cache the auth token for. Accepts values supported by time.ParseDuration. Defaults to 1m.

auth_timeout

How long to wait for the local API to validate the API key of a remediation component. Accepts value supported by time.ParseDuration. Set to 0 to disable the timeout. Increase it if your local API is not on the same machine or is a few network hops away. Defaults to 200ms.

body_read_timeout

How long to wait for the remediation component to finish sending the request body before giving up and processing whatever was received. Accepts value supported by time.ParseDuration. Set to 0 to disable the timeout. Defaults to 1s.

cert_file

Path to the cert file to allow HTTPS communication between the remediation component and the appsec component.

key_file

Path to the key file to allow HTTPS communication between the remediation component and the appsec component.

DSN and command-line

This module does not support acquisition from the command line.