# CrowdSec Documentation

> Real-time & crowdsourced protection against aggressive IPs - Complete documentation for CrowdSec Security Engine, WAF, Bouncers, CTI API, and Console


## docs


### next

- [WAF Deployment Strategies](https://docs.crowdsec.net/docs/next/appsec/advanced_deployments.md): This guide covers advanced CrowdSec WAF deployment strategies for organizations looking to gradually enhance their web application security posture. Learn how to progressively improve your WAF configuration from basic virtual patching to comprehensive multi-layer protection.
- [Alerts & Scenarios](https://docs.crowdsec.net/docs/next/appsec/alerts_and_scenarios.md): Generated Events Layout
- [OpenAPI Schema Validation](https://docs.crowdsec.net/docs/next/appsec/api_validation.md): The Application Security Component can validate incoming HTTP requests against an OpenAPI 3 schema you provide. Requests that do not conform to the schema (unknown route, unexpected method, missing or malformed parameters, invalid request body, missing/invalid authentication credentials, …) can be rejected before they ever reach the protected application.
- [Basic Benchmark](https://docs.crowdsec.net/docs/next/appsec/benchmark.md): <!--
- [Syntax](https://docs.crowdsec.net/docs/next/appsec/configuration.md): AppSec Configuration Files
- [Creation & Testing](https://docs.crowdsec.net/docs/next/appsec/configuration_creation_testing.md): AppSec Acquisition
- [Allowlisting and Rule Overrides](https://docs.crowdsec.net/docs/next/appsec/configuration_rule_management.md): Disabling Rules at Runtime
- [Creation & Testing](https://docs.crowdsec.net/docs/next/appsec/create_rules.md): Foreword
- [Customization](https://docs.crowdsec.net/docs/next/appsec/crs/crs_config.md): In most cases, CRS will need some custom configuration to work properly without false positives on any moderatly complex application.
- [Installation](https://docs.crowdsec.net/docs/next/appsec/crs/installation.md): Installing the CRS
- [CRS Support](https://docs.crowdsec.net/docs/next/appsec/crs/intro.md): The CrowdSec WAF is compatible with the OWASP CRS project.
- [Plugin support](https://docs.crowdsec.net/docs/next/appsec/crs/plugin_support.md): The CRS provides a plugin mechanism, allowing you to extend the CRS or fine-tune its behaviour for specific applications.
- [FAQ](https://docs.crowdsec.net/docs/next/appsec/faq.md)
- [Hooks](https://docs.crowdsec.net/docs/next/appsec/hooks.md): The Application Security Component lets you hook into different stages to change behavior at runtime.
- [AppSec Component - CrowdSec WAF](https://docs.crowdsec.net/docs/next/appsec/intro.md): What is CrowdSec?
- [WAF / Bouncer Communication Protocol](https://docs.crowdsec.net/docs/next/appsec/protocol.md): This section is only relevant if you want to add support for the CrowdSec application security component in your own remediation component or directly at the application level.
- [CrowdSec WAF QuickStart for Envoy Gateway](https://docs.crowdsec.net/docs/next/appsec/quickstart/envoy-gateway.md): Objectives
- [CrowdSec WAF General Setup](https://docs.crowdsec.net/docs/next/appsec/quickstart/general_setup.md): This guide covers the core AppSec Component setup that applies to all web servers and reverse proxies. After completing these steps, configure your remediation component (bouncer) to forward requests to the AppSec Component.
- [CrowdSec WAF QuickStart for HAProxy (SPOA)](https://docs.crowdsec.net/docs/next/appsec/quickstart/haproxy_spoa.md): Protect web applications running behind HAProxy with CrowdSec's AppSec (WAF) Component, using the HAProxy SPOA remediation component to forward HTTP requests.
- [CrowdSec WAF QuickStart for NGINX Ingress (Helm)](https://docs.crowdsec.net/docs/next/appsec/quickstart/nginx-ingress.md): This CrowdSec integration for ingress-nginx is being deprecated. ingress-nginx
- [CrowdSec WAF QuickStart for Nginx / OpenResty](https://docs.crowdsec.net/docs/next/appsec/quickstart/nginxopenresty.md): Protect an Nginx or OpenResty server with CrowdSec's AppSec (WAF) Component. After the prerequisites below, every step is a single copy-paste command. Most steps are the same for both engines — only step 3 differs, and the tabs there let you pick the right variant.
- [CrowdSec WAF QuickStart for NPMplus](https://docs.crowdsec.net/docs/next/appsec/quickstart/npmplus.md): Protect web applications running behind NPMplus (an enhanced Nginx Proxy Manager fork with built-in CrowdSec support) with CrowdSec's AppSec (WAF) Component.
- [CrowdSec WAF QuickStart for Traefik](https://docs.crowdsec.net/docs/next/appsec/quickstart/traefik.md): Objectives
- [CrowdSec WAF QuickStart for WordPress](https://docs.crowdsec.net/docs/next/appsec/quickstart/wordpress.md): Protect a WordPress site with CrowdSec's AppSec (WAF) Component. The WordPress bouncer is a WordPress plugin, so step 3 is a short click-through in wp-admin; everything else is copy-paste on the host running CrowdSec.
- [CrowdSec AppSec Request Lifecycle & Detection Pipeline](https://docs.crowdsec.net/docs/next/appsec/request_lifecycle.md): The CrowdSec AppSec architecture relies on several steps, involving stateless inspection (immediate pattern matching) and stateful analysis (long-term behavioral tracking).
- [WAF Rules Deployment](https://docs.crowdsec.net/docs/next/appsec/rules_deploy.md): This walkthrough assumes you already wrote and validated a custom AppSec (WAF) rule. We will deploy a concrete example so you can mirror the exact commands on your host.
- [WAF Rules Examples](https://docs.crowdsec.net/docs/next/appsec/rules_examples.md): This page showcases various WAF rule capabilities with real-world examples from the CrowdSec Hub. Each example includes the rule definition, a matching HTTP request from the test suite, and explanations of the key features demonstrated.
- [Syntax](https://docs.crowdsec.net/docs/next/appsec/rules_syntax.md): CrowdSec AppSec rules
- [Troubleshooting](https://docs.crowdsec.net/docs/next/appsec/troubleshooting.md): Monitoring with cscli
- [Introduction](https://docs.crowdsec.net/docs/next/central_api/community_blocklist.md): The "Community Blocklist" is a curated list of IP addresses identified as malicious by CrowdSec. CrowdSec proactively block the IP addresses of this blocklist, preventing malevolent IPs from reaching your systems.
- [Introduction](https://docs.crowdsec.net/docs/next/central_api/intro.md): The Central API is the service where the Local API pushes signal meta-data and from where it receives the community blocklists.
- [Concepts](https://docs.crowdsec.net/docs/next/concepts.md): Global overview
- [Crowdsec configuration](https://docs.crowdsec.net/docs/next/configuration/crowdsec_configuration.md): CrowdSec has a main yaml configuration file, usually located in /etc/crowdsec/config.yaml.
- [Feature Flags](https://docs.crowdsec.net/docs/next/configuration/feature_flags.md): In order to make it easier for users to test and experiment with new features, CrowdSec uses the concept of "feature flags".
- [Ports inventory](https://docs.crowdsec.net/docs/next/configuration/network_management.md): - tcp/8080 exposes a REST API for bouncers, cscli and communication between crowdsec agent and local api
- [How to write a values parameter file](https://docs.crowdsec.net/docs/next/configuration/values_parameters.md): The following configuration keeps the Helm chart close to its defaults while
- [Contact the team](https://docs.crowdsec.net/docs/next/contact_team.md): If you want to contact us using non-public media, you can contact us on support AT crowdsec DOT net with the following gpg-key :
- [Remediation Components](https://docs.crowdsec.net/docs/next/contributing/contributing_bouncers.md): Publishing remediation component
- [Contributing to CrowdSec](https://docs.crowdsec.net/docs/next/contributing/contributing_crowdsec.md): - If you want to report a bug, you can use the github bugtracker
- [Contributing basics](https://docs.crowdsec.net/docs/next/contributing/contributing_doc.md): - Write Crowdsec documentation in Markdown and build the Crowdsec documentation using docusaurus
- [Contributing to the Hub](https://docs.crowdsec.net/docs/next/contributing/contributing_hub.md): Parsers, Scenarios, Collections, and WAF rules allow the CrowdSec Security Engine to detect and block malevolent behavior. Supporting new services or improving detection capabilities is a great way to contribute to the CrowdSec ecosystem.
- [Creating a test environment](https://docs.crowdsec.net/docs/next/contributing/contributing_test_env.md): The following documentation is written for use on Linux systems. If you are using a different operating system, please adjust the commands accordingly if we have prebuilt binaries for your system.
- [Getting Started](https://docs.crowdsec.net/docs/next/contributing/getting_started.md): Getting Started
- [Specifications for Remediation Component and AppSec Capabilities](https://docs.crowdsec.net/docs/next/contributing/specs/bouncer_appsec_specs.md): Context
- [Remediation Component Metrics](https://docs.crowdsec.net/docs/next/contributing/specs/bouncer_metrics_specs.md): Overview
- [cscli](https://docs.crowdsec.net/docs/next/cscli.md): cscli
- [cscli alerts](https://docs.crowdsec.net/docs/next/cscli/cscli_alerts.md): cscli alerts
- [cscli alerts delete](https://docs.crowdsec.net/docs/next/cscli/cscli_alerts_delete.md): cscli alerts delete
- [cscli alerts flush](https://docs.crowdsec.net/docs/next/cscli/cscli_alerts_flush.md): cscli alerts flush
- [cscli alerts inspect](https://docs.crowdsec.net/docs/next/cscli/cscli_alerts_inspect.md): cscli alerts inspect
- [cscli alerts list](https://docs.crowdsec.net/docs/next/cscli/cscli_alerts_list.md): cscli alerts list
- [cscli allowlists](https://docs.crowdsec.net/docs/next/cscli/cscli_allowlists.md): cscli allowlists
- [cscli allowlists add](https://docs.crowdsec.net/docs/next/cscli/cscli_allowlists_add.md): cscli allowlists add
- [cscli allowlists check](https://docs.crowdsec.net/docs/next/cscli/cscli_allowlists_check.md): cscli allowlists check
- [cscli allowlists create](https://docs.crowdsec.net/docs/next/cscli/cscli_allowlists_create.md): cscli allowlists create
- [cscli allowlists delete](https://docs.crowdsec.net/docs/next/cscli/cscli_allowlists_delete.md): cscli allowlists delete
- [cscli allowlists import](https://docs.crowdsec.net/docs/next/cscli/cscli_allowlists_import.md): cscli allowlists import
- [cscli allowlists inspect](https://docs.crowdsec.net/docs/next/cscli/cscli_allowlists_inspect.md): cscli allowlists inspect
- [cscli allowlists list](https://docs.crowdsec.net/docs/next/cscli/cscli_allowlists_list.md): cscli allowlists list
- [cscli allowlists remove](https://docs.crowdsec.net/docs/next/cscli/cscli_allowlists_remove.md): cscli allowlists remove
- [cscli appsec-configs](https://docs.crowdsec.net/docs/next/cscli/cscli_appsec-configs.md): cscli appsec-configs
- [cscli appsec-configs inspect](https://docs.crowdsec.net/docs/next/cscli/cscli_appsec-configs_inspect.md): cscli appsec-configs inspect
- [cscli appsec-configs install](https://docs.crowdsec.net/docs/next/cscli/cscli_appsec-configs_install.md): cscli appsec-configs install
- [cscli appsec-configs list](https://docs.crowdsec.net/docs/next/cscli/cscli_appsec-configs_list.md): cscli appsec-configs list
- [cscli appsec-configs remove](https://docs.crowdsec.net/docs/next/cscli/cscli_appsec-configs_remove.md): cscli appsec-configs remove
- [cscli appsec-configs upgrade](https://docs.crowdsec.net/docs/next/cscli/cscli_appsec-configs_upgrade.md): cscli appsec-configs upgrade
- [cscli appsec-rules](https://docs.crowdsec.net/docs/next/cscli/cscli_appsec-rules.md): cscli appsec-rules
- [cscli appsec-rules inspect](https://docs.crowdsec.net/docs/next/cscli/cscli_appsec-rules_inspect.md): cscli appsec-rules inspect
- [cscli appsec-rules install](https://docs.crowdsec.net/docs/next/cscli/cscli_appsec-rules_install.md): cscli appsec-rules install
- [cscli appsec-rules list](https://docs.crowdsec.net/docs/next/cscli/cscli_appsec-rules_list.md): cscli appsec-rules list
- [cscli appsec-rules remove](https://docs.crowdsec.net/docs/next/cscli/cscli_appsec-rules_remove.md): cscli appsec-rules remove
- [cscli appsec-rules upgrade](https://docs.crowdsec.net/docs/next/cscli/cscli_appsec-rules_upgrade.md): cscli appsec-rules upgrade
- [cscli bouncers](https://docs.crowdsec.net/docs/next/cscli/cscli_bouncers.md): cscli bouncers
- [cscli bouncers add](https://docs.crowdsec.net/docs/next/cscli/cscli_bouncers_add.md): cscli bouncers add
- [cscli bouncers delete](https://docs.crowdsec.net/docs/next/cscli/cscli_bouncers_delete.md): cscli bouncers delete
- [cscli bouncers inspect](https://docs.crowdsec.net/docs/next/cscli/cscli_bouncers_inspect.md): cscli bouncers inspect
- [cscli bouncers list](https://docs.crowdsec.net/docs/next/cscli/cscli_bouncers_list.md): cscli bouncers list
- [cscli bouncers prune](https://docs.crowdsec.net/docs/next/cscli/cscli_bouncers_prune.md): cscli bouncers prune
- [cscli capi](https://docs.crowdsec.net/docs/next/cscli/cscli_capi.md): cscli capi
- [cscli capi register](https://docs.crowdsec.net/docs/next/cscli/cscli_capi_register.md): cscli capi register
- [cscli capi status](https://docs.crowdsec.net/docs/next/cscli/cscli_capi_status.md): cscli capi status
- [cscli collections](https://docs.crowdsec.net/docs/next/cscli/cscli_collections.md): cscli collections
- [cscli collections inspect](https://docs.crowdsec.net/docs/next/cscli/cscli_collections_inspect.md): cscli collections inspect
- [cscli collections install](https://docs.crowdsec.net/docs/next/cscli/cscli_collections_install.md): cscli collections install
- [cscli collections list](https://docs.crowdsec.net/docs/next/cscli/cscli_collections_list.md): cscli collections list
- [cscli collections remove](https://docs.crowdsec.net/docs/next/cscli/cscli_collections_remove.md): cscli collections remove
- [cscli collections upgrade](https://docs.crowdsec.net/docs/next/cscli/cscli_collections_upgrade.md): cscli collections upgrade
- [cscli completion](https://docs.crowdsec.net/docs/next/cscli/cscli_completion.md): cscli completion
- [cscli config](https://docs.crowdsec.net/docs/next/cscli/cscli_config.md): cscli config
- [cscli config feature-flags](https://docs.crowdsec.net/docs/next/cscli/cscli_config_feature-flags.md): cscli config feature-flags
- [cscli config show](https://docs.crowdsec.net/docs/next/cscli/cscli_config_show.md): cscli config show
- [cscli config show-yaml](https://docs.crowdsec.net/docs/next/cscli/cscli_config_show-yaml.md): cscli config show-yaml
- [cscli console](https://docs.crowdsec.net/docs/next/cscli/cscli_console.md): cscli console
- [cscli console disable](https://docs.crowdsec.net/docs/next/cscli/cscli_console_disable.md): cscli console disable
- [cscli console enable](https://docs.crowdsec.net/docs/next/cscli/cscli_console_enable.md): cscli console enable
- [cscli console enroll](https://docs.crowdsec.net/docs/next/cscli/cscli_console_enroll.md): cscli console enroll
- [cscli console status](https://docs.crowdsec.net/docs/next/cscli/cscli_console_status.md): cscli console status
- [cscli contexts](https://docs.crowdsec.net/docs/next/cscli/cscli_contexts.md): cscli contexts
- [cscli contexts inspect](https://docs.crowdsec.net/docs/next/cscli/cscli_contexts_inspect.md): cscli contexts inspect
- [cscli contexts install](https://docs.crowdsec.net/docs/next/cscli/cscli_contexts_install.md): cscli contexts install
- [cscli contexts list](https://docs.crowdsec.net/docs/next/cscli/cscli_contexts_list.md): cscli contexts list
- [cscli contexts remove](https://docs.crowdsec.net/docs/next/cscli/cscli_contexts_remove.md): cscli contexts remove
- [cscli contexts upgrade](https://docs.crowdsec.net/docs/next/cscli/cscli_contexts_upgrade.md): cscli contexts upgrade
- [cscli dashboard](https://docs.crowdsec.net/docs/next/cscli/cscli_dashboard.md): cscli dashboard
- [cscli decisions](https://docs.crowdsec.net/docs/next/cscli/cscli_decisions.md): cscli decisions
- [cscli decisions add](https://docs.crowdsec.net/docs/next/cscli/cscli_decisions_add.md): cscli decisions add
- [cscli decisions delete](https://docs.crowdsec.net/docs/next/cscli/cscli_decisions_delete.md): cscli decisions delete
- [cscli decisions import](https://docs.crowdsec.net/docs/next/cscli/cscli_decisions_import.md): cscli decisions import
- [cscli decisions list](https://docs.crowdsec.net/docs/next/cscli/cscli_decisions_list.md): cscli decisions list
- [cscli explain](https://docs.crowdsec.net/docs/next/cscli/cscli_explain.md): cscli explain
- [cscli hub](https://docs.crowdsec.net/docs/next/cscli/cscli_hub.md): cscli hub
- [cscli hub branch](https://docs.crowdsec.net/docs/next/cscli/cscli_hub_branch.md): cscli hub branch
- [cscli hub list](https://docs.crowdsec.net/docs/next/cscli/cscli_hub_list.md): cscli hub list
- [cscli hub types](https://docs.crowdsec.net/docs/next/cscli/cscli_hub_types.md): cscli hub types
- [cscli hub update](https://docs.crowdsec.net/docs/next/cscli/cscli_hub_update.md): cscli hub update
- [cscli hub upgrade](https://docs.crowdsec.net/docs/next/cscli/cscli_hub_upgrade.md): cscli hub upgrade
- [cscli hubtest](https://docs.crowdsec.net/docs/next/cscli/cscli_hubtest.md): cscli hubtest
- [cscli hubtest clean](https://docs.crowdsec.net/docs/next/cscli/cscli_hubtest_clean.md): cscli hubtest clean
- [cscli hubtest coverage](https://docs.crowdsec.net/docs/next/cscli/cscli_hubtest_coverage.md): cscli hubtest coverage
- [cscli hubtest create](https://docs.crowdsec.net/docs/next/cscli/cscli_hubtest_create.md): cscli hubtest create
- [cscli hubtest eval](https://docs.crowdsec.net/docs/next/cscli/cscli_hubtest_eval.md): cscli hubtest eval
- [cscli hubtest explain](https://docs.crowdsec.net/docs/next/cscli/cscli_hubtest_explain.md): cscli hubtest explain
- [cscli hubtest info](https://docs.crowdsec.net/docs/next/cscli/cscli_hubtest_info.md): cscli hubtest info
- [cscli hubtest list](https://docs.crowdsec.net/docs/next/cscli/cscli_hubtest_list.md): cscli hubtest list
- [cscli hubtest run](https://docs.crowdsec.net/docs/next/cscli/cscli_hubtest_run.md): cscli hubtest run
- [cscli lapi](https://docs.crowdsec.net/docs/next/cscli/cscli_lapi.md): cscli lapi
- [cscli lapi context](https://docs.crowdsec.net/docs/next/cscli/cscli_lapi_context.md): cscli lapi context
- [cscli lapi context add](https://docs.crowdsec.net/docs/next/cscli/cscli_lapi_context_add.md): cscli lapi context add
- [cscli lapi context delete](https://docs.crowdsec.net/docs/next/cscli/cscli_lapi_context_delete.md): cscli lapi context delete
- [cscli lapi context detect](https://docs.crowdsec.net/docs/next/cscli/cscli_lapi_context_detect.md): cscli lapi context detect
- [cscli lapi context status](https://docs.crowdsec.net/docs/next/cscli/cscli_lapi_context_status.md): cscli lapi context status
- [cscli lapi register](https://docs.crowdsec.net/docs/next/cscli/cscli_lapi_register.md): cscli lapi register
- [cscli lapi status](https://docs.crowdsec.net/docs/next/cscli/cscli_lapi_status.md): cscli lapi status
- [cscli machines](https://docs.crowdsec.net/docs/next/cscli/cscli_machines.md): cscli machines
- [cscli machines add](https://docs.crowdsec.net/docs/next/cscli/cscli_machines_add.md): cscli machines add
- [cscli machines delete](https://docs.crowdsec.net/docs/next/cscli/cscli_machines_delete.md): cscli machines delete
- [cscli machines inspect](https://docs.crowdsec.net/docs/next/cscli/cscli_machines_inspect.md): cscli machines inspect
- [cscli machines list](https://docs.crowdsec.net/docs/next/cscli/cscli_machines_list.md): cscli machines list
- [cscli machines prune](https://docs.crowdsec.net/docs/next/cscli/cscli_machines_prune.md): cscli machines prune
- [cscli machines validate](https://docs.crowdsec.net/docs/next/cscli/cscli_machines_validate.md): cscli machines validate
- [cscli metrics](https://docs.crowdsec.net/docs/next/cscli/cscli_metrics.md): cscli metrics
- [cscli metrics list](https://docs.crowdsec.net/docs/next/cscli/cscli_metrics_list.md): cscli metrics list
- [cscli metrics show](https://docs.crowdsec.net/docs/next/cscli/cscli_metrics_show.md): cscli metrics show
- [cscli notifications](https://docs.crowdsec.net/docs/next/cscli/cscli_notifications.md): cscli notifications
- [cscli notifications inspect](https://docs.crowdsec.net/docs/next/cscli/cscli_notifications_inspect.md): cscli notifications inspect
- [cscli notifications list](https://docs.crowdsec.net/docs/next/cscli/cscli_notifications_list.md): cscli notifications list
- [cscli notifications reinject](https://docs.crowdsec.net/docs/next/cscli/cscli_notifications_reinject.md): cscli notifications reinject
- [cscli notifications test](https://docs.crowdsec.net/docs/next/cscli/cscli_notifications_test.md): cscli notifications test
- [cscli papi](https://docs.crowdsec.net/docs/next/cscli/cscli_papi.md): cscli papi
- [cscli papi status](https://docs.crowdsec.net/docs/next/cscli/cscli_papi_status.md): cscli papi status
- [cscli papi sync](https://docs.crowdsec.net/docs/next/cscli/cscli_papi_sync.md): cscli papi sync
- [cscli parsers](https://docs.crowdsec.net/docs/next/cscli/cscli_parsers.md): cscli parsers
- [cscli parsers inspect](https://docs.crowdsec.net/docs/next/cscli/cscli_parsers_inspect.md): cscli parsers inspect
- [cscli parsers install](https://docs.crowdsec.net/docs/next/cscli/cscli_parsers_install.md): cscli parsers install
- [cscli parsers list](https://docs.crowdsec.net/docs/next/cscli/cscli_parsers_list.md): cscli parsers list
- [cscli parsers remove](https://docs.crowdsec.net/docs/next/cscli/cscli_parsers_remove.md): cscli parsers remove
- [cscli parsers upgrade](https://docs.crowdsec.net/docs/next/cscli/cscli_parsers_upgrade.md): cscli parsers upgrade
- [cscli postoverflows](https://docs.crowdsec.net/docs/next/cscli/cscli_postoverflows.md): cscli postoverflows
- [cscli postoverflows inspect](https://docs.crowdsec.net/docs/next/cscli/cscli_postoverflows_inspect.md): cscli postoverflows inspect
- [cscli postoverflows install](https://docs.crowdsec.net/docs/next/cscli/cscli_postoverflows_install.md): cscli postoverflows install
- [cscli postoverflows list](https://docs.crowdsec.net/docs/next/cscli/cscli_postoverflows_list.md): cscli postoverflows list
- [cscli postoverflows remove](https://docs.crowdsec.net/docs/next/cscli/cscli_postoverflows_remove.md): cscli postoverflows remove
- [cscli postoverflows upgrade](https://docs.crowdsec.net/docs/next/cscli/cscli_postoverflows_upgrade.md): cscli postoverflows upgrade
- [cscli scenarios](https://docs.crowdsec.net/docs/next/cscli/cscli_scenarios.md): cscli scenarios
- [cscli scenarios inspect](https://docs.crowdsec.net/docs/next/cscli/cscli_scenarios_inspect.md): cscli scenarios inspect
- [cscli scenarios install](https://docs.crowdsec.net/docs/next/cscli/cscli_scenarios_install.md): cscli scenarios install
- [cscli scenarios list](https://docs.crowdsec.net/docs/next/cscli/cscli_scenarios_list.md): cscli scenarios list
- [cscli scenarios remove](https://docs.crowdsec.net/docs/next/cscli/cscli_scenarios_remove.md): cscli scenarios remove
- [cscli scenarios upgrade](https://docs.crowdsec.net/docs/next/cscli/cscli_scenarios_upgrade.md): cscli scenarios upgrade
- [cscli setup](https://docs.crowdsec.net/docs/next/cscli/cscli_setup.md): cscli setup
- [cscli setup detect](https://docs.crowdsec.net/docs/next/cscli/cscli_setup_detect.md): cscli setup detect
- [cscli setup install-acquisition](https://docs.crowdsec.net/docs/next/cscli/cscli_setup_install-acquisition.md): cscli setup install-acquisition
- [cscli setup install-hub](https://docs.crowdsec.net/docs/next/cscli/cscli_setup_install-hub.md): cscli setup install-hub
- [cscli setup interactive](https://docs.crowdsec.net/docs/next/cscli/cscli_setup_interactive.md): cscli setup interactive
- [cscli setup unattended](https://docs.crowdsec.net/docs/next/cscli/cscli_setup_unattended.md): cscli setup unattended
- [cscli setup validate](https://docs.crowdsec.net/docs/next/cscli/cscli_setup_validate.md): cscli setup validate
- [cscli simulation](https://docs.crowdsec.net/docs/next/cscli/cscli_simulation.md): cscli simulation
- [cscli simulation disable](https://docs.crowdsec.net/docs/next/cscli/cscli_simulation_disable.md): cscli simulation disable
- [cscli simulation enable](https://docs.crowdsec.net/docs/next/cscli/cscli_simulation_enable.md): cscli simulation enable
- [cscli simulation status](https://docs.crowdsec.net/docs/next/cscli/cscli_simulation_status.md): cscli simulation status
- [cscli support](https://docs.crowdsec.net/docs/next/cscli/cscli_support.md): cscli support
- [cscli support dump](https://docs.crowdsec.net/docs/next/cscli/cscli_support_dump.md): cscli support dump
- [cscli version](https://docs.crowdsec.net/docs/next/cscli/cscli_version.md): cscli version
- [Alert](https://docs.crowdsec.net/docs/next/expr/alert.md): An Alert is the runtime representation of a bucket overflow.
- [CTI helpers](https://docs.crowdsec.net/docs/next/expr/cti_helpers.md): CTI Helpers
- [Decision](https://docs.crowdsec.net/docs/next/expr/decision.md): A Decision is the runtime representation of a bucket overflow consequence : an action being taken against an IP, a Range, a User etc.
- [Introduction](https://docs.crowdsec.net/docs/next/expr/event.md): An Event is the runtime representation of an item being processed by crowdsec. It can represent:
- [File helpers](https://docs.crowdsec.net/docs/next/expr/file_helpers.md): File helpers do not load the file into memory, but rather use a cache on initial startup to avoid loading the same file multiple times. Please see the data property on how to configure the Security Engine to load the file.
- [Introduction](https://docs.crowdsec.net/docs/next/expr/intro.md): antonmedv/expr - Expression evaluation engine for Go: fast, non-Turing complete, dynamic typing, static typing
- [IP helpers](https://docs.crowdsec.net/docs/next/expr/ip_helpers.md): IP Helpers
- [JSON/XML/KV Helpers](https://docs.crowdsec.net/docs/next/expr/json_helpers.md): JSON Helpers
- [LibInjection helpers](https://docs.crowdsec.net/docs/next/expr/libinjection_helpers.md): LibInjectionIsSQLI(str) bool
- [Other helpers](https://docs.crowdsec.net/docs/next/expr/other_helpers.md): Time Helpers
- [Strings helpers](https://docs.crowdsec.net/docs/next/expr/strings_helpers.md): Strings
- [Crowdsec Tour](https://docs.crowdsec.net/docs/next/getting_started/crowdsec_tour.md): List installed configurations
- [OPNsense plugin](https://docs.crowdsec.net/docs/next/getting_started/install_crowdsec_opnsense.md): The CrowdSec plugin for OPNsense is installed from the official repositories.
- [pfSense](https://docs.crowdsec.net/docs/next/getting_started/install_crowdsec_pfsense.md): The CrowdSec package for pfSense requires some manual installation steps, as it is not yet available in the official repositories.
- [Drupal Plugin](https://docs.crowdsec.net/docs/next/getting_started/install_drupal_plugin.md): The CrowdSec Drupal plugin provides real-time protection against malicious actors by integrating your Drupal site with the CrowdSec security network.
- [Using our PHP SDK](https://docs.crowdsec.net/docs/next/getting_started/install_php_softagent.md): With the help of our SDK, If you are developing security software that detects misbehaviors and does remediation on IPs, you can send signals about your detections and benefit from the community blocklist.
- [Using our Python SDK](https://docs.crowdsec.net/docs/next/getting_started/install_pyagent.md): This python SDK is designed for signal sharing partners to send signals and benefit from the community blocklist.
- [Compile from source](https://docs.crowdsec.net/docs/next/getting_started/install_source.md): This is only for advanced users that wish to compile their own software. If you are not comfortable with this, please use the official packages
- [Windows](https://docs.crowdsec.net/docs/next/getting_started/install_windows.md): Security Engine Installation
- [introduction to the SDKs](https://docs.crowdsec.net/docs/next/getting_started/sdk_intro.md): CrowdSec offers lightweight SDKs for Python and PHP to help developers seamlessly integrate signal sharing capabilities into their security tools, platforms, or services.
- [Security Engine Overview](https://docs.crowdsec.net/docs/next/intro.md): The CrowdSec Security Engine is an open-source, lightweight security engine that detects and blocks malicious actors. It analyzes logs and HTTP requests using behavior-based patterns called scenarios.
- [Authentication](https://docs.crowdsec.net/docs/next/local_api/authentication.md): Authentication
- [For Remediation Components](https://docs.crowdsec.net/docs/next/local_api/bouncers.md): This page explains how to interact with the local API exposed by the Security Engine.
- [AllowLists](https://docs.crowdsec.net/docs/next/local_api/centralized_allowlists.md): The AllowLists feature in CrowdSec lets you manage IP-based allowlists at the LAPI level. It affects both local decisions and blocklist pulls, giving you more flexibility to trust specific IPs while keeping CrowdSec security controls in place.
- [Configuration](https://docs.crowdsec.net/docs/next/local_api/configuration.md): Configuration
- [Databases](https://docs.crowdsec.net/docs/next/local_api/database.md): By default, the CrowdSec Local API use SQLite as backend storage. In case you expect a lot of traffic on your Local API, you should use MySQL, MariaDB or PostgreSQL.
- [Local API](https://docs.crowdsec.net/docs/next/local_api/intro.md): The Local API (LAPI) is one of the core components of the Security Engine to :
- [Elasticsearch](https://docs.crowdsec.net/docs/next/local_api/notification_plugins/elastic.md): CrowdSec can forward Alerts to Elasticsearch using the HTTP plugin. This guide will show you how to configure the plugin to send alerts to your Elasticsearch instance.
- [Email Plugin](https://docs.crowdsec.net/docs/next/local_api/notification_plugins/email.md): The Email plugin is shipped by default with CrowdSec. The following guide shows how to configure, test and enable it.
- [File Plugin](https://docs.crowdsec.net/docs/next/local_api/notification_plugins/file.md): The File plugin is by default shipped with your CrowdSec installation and allows you to write Alerts to an external file that can be monitored by external applications. The following guide shows how to configure, test and enable it.
- [Gotify](https://docs.crowdsec.net/docs/next/local_api/notification_plugins/gotify.md): CrowdSec can forward Alerts to Gotify via the HTTP plugin. This guide will show you how to configure the HTTP plugin to send alerts to your Gotify instance.
- [HTTP Plugin](https://docs.crowdsec.net/docs/next/local_api/notification_plugins/http.md): The HTTP plugin is by default shipped with your CrowdSec installation. The following guide shows how to configure, test and enable it.
- [Introduction](https://docs.crowdsec.net/docs/next/local_api/notification_plugins/intro.md): Goal
- [Sentinel Plugin](https://docs.crowdsec.net/docs/next/local_api/notification_plugins/sentinel.md): The sentinel plugin is by default shipped with your CrowdSec installation. The following guide shows how to configure, test and enable it.
- [Slack Plugin](https://docs.crowdsec.net/docs/next/local_api/notification_plugins/slack.md): The slack plugin is by default shipped with your CrowdSec installation. The following guide shows how to enable it.
- [Splunk Plugin](https://docs.crowdsec.net/docs/next/local_api/notification_plugins/splunk.md): The splunk plugin is by default shipped with your CrowdSec installation. The following guide shows how to enable it.
- [Microsoft Teams](https://docs.crowdsec.net/docs/next/local_api/notification_plugins/teams.md): The following guide shows how to configure, test and enable HTTP plugin to forward Alerts to Microsoft Teams.
- [Telegram](https://docs.crowdsec.net/docs/next/local_api/notification_plugins/telegram.md): CrowdSec can forward Alerts to telegram via the HTTP plugin. This guide will show you how to configure the HTTP plugin to send alerts to your Telegram chat.
- [Templating helpers](https://docs.crowdsec.net/docs/next/local_api/notification_plugins/template_helpers.md): In order to simplify some operation in the templates, we provide some custom helpers.
- [Testing notification plugins](https://docs.crowdsec.net/docs/next/local_api/notification_plugins/testing.md): This guide walks through practical ways to validate a notification plugin, from config checks to end-to-end delivery.
- [Writing Plugin in Go](https://docs.crowdsec.net/docs/next/local_api/notification_plugins/writing_your_own_plugin.md): In this guide we will implement a plugin in Go, which dispatches an email with specificied body on receiving alerts.
- [Captcha](https://docs.crowdsec.net/docs/next/local_api/profiles/captcha_profile.md): Here is an example of a profile that provides users with a captcha challenge when they trigger a HTTP scenario.
- [CrowdSec CTI](https://docs.crowdsec.net/docs/next/local_api/profiles/cti_profile.md): Here is an example of a profile that uses the CTI module.
- [Format](https://docs.crowdsec.net/docs/next/local_api/profiles/format.md): Profile configuration example
- [Introduction](https://docs.crowdsec.net/docs/next/local_api/profiles/intro.md): The profiles configuration allows users to configure which kind of remediation should be applied when a scenario is triggered. The profile can be used to:
- [PID](https://docs.crowdsec.net/docs/next/local_api/profiles/pid_profile.md): We use PID to refer to a process ID based events.
- [TLS Authentication](https://docs.crowdsec.net/docs/next/local_api/tls_auth.md): Overview
- [Alert Context](https://docs.crowdsec.net/docs/next/log_processor/alert_context/intro.md): Introduction
- [Format](https://docs.crowdsec.net/docs/next/log_processor/collections/format.md): Collection configuration example
- [Introduction](https://docs.crowdsec.net/docs/next/log_processor/collections/intro.md): Collections are bundles of detection content that you install together to support a given service or use case (for example: NGINX, SSH, WordPress, or generic HTTP attacks).
- [Application Security Component](https://docs.crowdsec.net/docs/next/log_processor/data_sources/appsec.md): This module allows you to enable the Application Security Component as a data source.
- [AWS Cloudwatch](https://docs.crowdsec.net/docs/next/log_processor/data_sources/cloudwatch.md): This module allows the Security Engine to acquire logs from AWS's cloudwatch service, in one-shot and streaming mode.
- [Docker](https://docs.crowdsec.net/docs/next/log_processor/data_sources/docker.md): This module allows the Security Engine to acquire logs from running containers, in one-shot and streaming mode.
- [File(s)](https://docs.crowdsec.net/docs/next/log_processor/data_sources/file.md): This module allows the Security Engine to acquire logs from text files (in one-shot and streaming mode), and GZ files in one-shot mode.
- [HTTP](https://docs.crowdsec.net/docs/next/log_processor/data_sources/http.md): This module allows the Security Engine to acquire logs from an HTTP endpoint.
- [Acquisition Datasources](https://docs.crowdsec.net/docs/next/log_processor/data_sources/intro.md): To monitor applications, the Security Engine needs to read logs.
- [Journald](https://docs.crowdsec.net/docs/next/log_processor/data_sources/journald.md): This module allows the Security Engine to acquire logs from journalctl files in one-shot and streaming mode.
- [Kafka](https://docs.crowdsec.net/docs/next/log_processor/data_sources/kafka.md): This module allows the Security Engine to acquire logs from a kafka topic.
- [AWS Kinesis Stream](https://docs.crowdsec.net/docs/next/log_processor/data_sources/kinesis.md): This module allows the Security Engine to acquire logs from a Kinesis stream.
- [Kubernetes Audit](https://docs.crowdsec.net/docs/next/log_processor/data_sources/kubernetes_audit.md): This module allows the Security Engine to expose an HTTP server that can be used by a Kubernetes cluster to send its audit logs.
- [Loki](https://docs.crowdsec.net/docs/next/log_processor/data_sources/loki.md): This module allows the Security Engine to acquire logs from loki query.
- [AWS S3](https://docs.crowdsec.net/docs/next/log_processor/data_sources/s3.md): This module allows the Security Engine to acquire logs from a S3 bucket.
- [Syslog Server](https://docs.crowdsec.net/docs/next/log_processor/data_sources/syslog.md): This module allows the Security Engine to expose a syslog server, and ingest logs directly from another syslog server (or any software that knows how to forward logs with syslog).
- [Monitoring](https://docs.crowdsec.net/docs/next/log_processor/data_sources/troubleshoot.md): The prometheus instrumentation exposes metrics about acquisition and data sources.
- [VictoriaLogs](https://docs.crowdsec.net/docs/next/log_processor/data_sources/victorialogs.md): This module allows the Security Engine to acquire logs from VictoriaLogs query.
- [Windows Event Log](https://docs.crowdsec.net/docs/next/log_processor/data_sources/windows_evt_log.md): This module allows the Security Engine to acquire logs from the Windows Event Log.
- [Introduction](https://docs.crowdsec.net/docs/next/log_processor/intro.md): The Log Processor is a core component of the Security Engine. It:
- [Creating parsers](https://docs.crowdsec.net/docs/next/log_processor/parsers/create.md): Foreword
- [Enrichers](https://docs.crowdsec.net/docs/next/log_processor/parsers/enricher.md): Enrichers are parsers that can rely on external methods to provide extra contextual information to the event. The enrichers are usually in the s02-enrich  stage (after most of the parsing happened).
- [Format](https://docs.crowdsec.net/docs/next/log_processor/parsers/format.md): Parser configuration example
- [Introduction](https://docs.crowdsec.net/docs/next/log_processor/parsers/intro.md): Parser
- [Patterns documentation](https://docs.crowdsec.net/docs/next/log_processor/parsers/patterns.md): You will find here a generated documentation of all the patterns loaded by crowdsec.
- [Creating scenarios](https://docs.crowdsec.net/docs/next/log_processor/scenarios/create.md): All the examples assume that you have read the Creating parsers documentation.
- [Debugging](https://docs.crowdsec.net/docs/next/log_processor/scenarios/debug.md)
- [Deploy](https://docs.crowdsec.net/docs/next/log_processor/scenarios/deploy.md): This documentation mostly focus on installation of custom scenarios. Scenarios from the hub should be installed as a part of the collection, by using cscli collections install . Installing scenarios directly with cscli scenario install  might lead to unexpected results because of missing dependencies (ie. parsers, enrichers, post-overflows etc.)
- [Format](https://docs.crowdsec.net/docs/next/log_processor/scenarios/format.md): Scenario configuration example
- [Introduction](https://docs.crowdsec.net/docs/next/log_processor/scenarios/intro.md): Scenarios are YAML files that allow to detect a specific behavior, usually an attack.
- [Simulation](https://docs.crowdsec.net/docs/next/log_processor/scenarios/simulation.md): cscli simulation allows to manage a list of scenarios that have their remediation "simulated" : they won't be effective (but will still be showed by cscli decisions list). This configuration file is present in /etc/crowdsec/simulation.yaml and is handled by the agent.
- [Syntax](https://docs.crowdsec.net/docs/next/log_processor/service-discovery-setup/detect-yaml.md): A minimal detection file is a YAML map with a top‐level detect: key.
- [Service Discovery](https://docs.crowdsec.net/docs/next/log_processor/service-discovery-setup/intro.md): The goals of service discovery are to automatically:
- [Expression Helpers Reference](https://docs.crowdsec.net/docs/next/log_processor/service-discovery-setup/setup-expr-helpers.md): Various helpers are available for use in the detect.yaml file to determine how crowdsec should be configured.
- [CAPI](https://docs.crowdsec.net/docs/next/log_processor/whitelist/create_capi.md): This option is deprecated.
- [Expression](https://docs.crowdsec.net/docs/next/log_processor/whitelist/create_expr.md): Expression-based whitelists let you discard events during parsing using expr expressions. This is the most flexible option for whitelisting patterns such as HTTP paths, user agents, status codes, or any mix of parsed fields.
- [FQDN](https://docs.crowdsec.net/docs/next/log_processor/whitelist/create_fqdn.md): FQDN lookups can cause latency. We recommend using them only in the Postoverflow whitelist stage. See introduction for your OS-specific path.
- [IP / CIDR](https://docs.crowdsec.net/docs/next/log_processor/whitelist/create_ip.md): For IP and CIDR-based allowlisting, we recommend using Centralized AllowLists instead. AllowLists are managed at the LAPI level, making them easier to maintain and they also affect blocklist pulls. The parser whitelists documented below are more suited for complex expressions based on log elements.
- [LAPI](https://docs.crowdsec.net/docs/next/log_processor/whitelist/create_lapi.md): This approach is deprecated. Please use Centralized AllowLists instead.
- [Postoverflow](https://docs.crowdsec.net/docs/next/log_processor/whitelist/create_postoverflow.md): Whitelist in PostOverflows
- [Format](https://docs.crowdsec.net/docs/next/log_processor/whitelist/format.md): Whitelist configuration example
- [Introduction](https://docs.crowdsec.net/docs/next/log_processor/whitelist/intro.md): For simple IP and CIDR-based allowlisting, we recommend using Centralized AllowLists instead of parser whitelists. AllowLists are easier to manage and also affect blocklist pulls. The parser whitelists documented below are best suited for complex expression-based rules that rely on log elements.
- [Crowdsec Metrics](https://docs.crowdsec.net/docs/next/observability/cscli.md): Crowdsec is instrumented using prometheus to provide detailed metrics and tracability about what is going on.
- [Introduction](https://docs.crowdsec.net/docs/next/observability/intro.md): Observability in security software is crucial, especially when this software might take important decision such as blocking IP addresses.
- [Pprof](https://docs.crowdsec.net/docs/next/observability/pprof.md): CrowdSec exposes a pprof endpoint on http6060/debug/pprof. It  provides real-time state of the application. It is useful for finding issues like memory leaks, excessive CPU usage etc.
- [Prometheus](https://docs.crowdsec.net/docs/next/observability/prometheus.md): CrowdSec can expose a prometheus endpoint for collection (on http6060/metrics by default). You can edit the listenaddr in config.yaml to allow an external Prometheus to scrape the metrics.
- [Usage Metrics](https://docs.crowdsec.net/docs/next/observability/usage_metrics.md): Usage metrics require at least CrowdSec v1.6.3

## u


### beta_program

About the Beta Program

- [Beta Program](https://docs.crowdsec.net/u/beta_program.md): About the Beta Program

### blocklists

- [Getting Started](https://docs.crowdsec.net/u/blocklists/getting_started.md): New to CrowdSec blocklists? Read the Introduction first to understand how they work and the available tiers. Then choose one of the two paths below — most people pick one or the other, not both.
- [Introduction](https://docs.crowdsec.net/u/blocklists/intro.md): Objective
- [Security Engine](https://docs.crowdsec.net/u/blocklists/security_engine.md): This page is used to reference other pages into a single guide. It is not meant to be used as a standalone page.

### bouncers

- [Apache](https://docs.crowdsec.net/u/bouncers/apache_bouncer.md): <img
- [AWS WAF](https://docs.crowdsec.net/u/bouncers/aws_waf.md): <img
- [Blocklist mirror](https://docs.crowdsec.net/u/bouncers/blocklist-mirror.md): &#x1F4DA; Documentation
- [CrowdSec Cloudflare Worker Bouncer](https://docs.crowdsec.net/u/bouncers/cloudflare.md): &#x1F4DA; Documentation
- [Cloudflare DEPRECATED BOUNCER](https://docs.crowdsec.net/u/bouncers/cloudflare-deprecated.md): &#x1F4DA; Documentation
- [Custom](https://docs.crowdsec.net/u/bouncers/custom.md): &#x1F4DA; Documentation
- [CrowdSec Remediation QuickStart for Envoy Gateway](https://docs.crowdsec.net/u/bouncers/envoy.md): &#x1F4DA; Documentation
- [Fastly bouncer](https://docs.crowdsec.net/u/bouncers/fastly.md): &#x1F4DA; Documentation
- [Firewall](https://docs.crowdsec.net/u/bouncers/firewall.md): &#x1F4DA; Documentation
- [HAProxy](https://docs.crowdsec.net/u/bouncers/haproxy.md): &#x1F4DA; Documentation
- [A remediation component for HAProxy](https://docs.crowdsec.net/u/bouncers/haproxy_spoa.md): <img
- [Ingress Nginx](https://docs.crowdsec.net/u/bouncers/ingress-nginx.md): <img
- [Remediation Components](https://docs.crowdsec.net/u/bouncers/intro.md): You may see Remediation Components referred to as "bouncers" in the documentation and/or within cscli commands.
- [Magento 2](https://docs.crowdsec.net/u/bouncers/magento.md): &#x1F4A0; Hub
- [MISP Feed Generator](https://docs.crowdsec.net/u/bouncers/misp-feed-generator.md): &#x1F4DA; Documentation
- [Nginx](https://docs.crowdsec.net/u/bouncers/nginx.md): <img
- [OpenResty](https://docs.crowdsec.net/u/bouncers/openresty.md): <img
- [PHP Standalone](https://docs.crowdsec.net/u/bouncers/php.md): &#x1F4DA; Documentation
- [PHP Remediation Library](https://docs.crowdsec.net/u/bouncers/php-lib.md): &#x1F4DA; Documentation
- [Stormshield](https://docs.crowdsec.net/u/bouncers/stormshield.md): &#x1F4DA; Documentation
- [Traefik on kubernetes](https://docs.crowdsec.net/u/bouncers/traefik.md): <img
- [Windows Firewall](https://docs.crowdsec.net/u/bouncers/windows_firewall.md): <img
- [WordPress Plugin](https://docs.crowdsec.net/u/bouncers/wordpress.md): <RemediationSupportBadges

### console

- [Alerts Analysis](https://docs.crowdsec.net/u/console/alerts/alerts_analysis.md): Analyzing alerts in the CrowdSec Console
- [Alerts Context](https://docs.crowdsec.net/u/console/alerts/alerts_contexts.md): Understanding the alerts context in the CrowdSec Console
- [Background Noise Filtering 🏅](https://docs.crowdsec.net/u/console/alerts/background_noise.md): Focus on alerts that matter.
- [Introduction](https://docs.crowdsec.net/u/console/alerts/intro.md): Introduction to the Alerts section of the CrowdSec Console
- [Quotas](https://docs.crowdsec.net/u/console/alerts/quotas.md): Understanding alerts quotas in the CrowdSec Console`
- [Visualizer](https://docs.crowdsec.net/u/console/alerts/visualizer.md): Visualizer for the Alerts page of the CrowdSec Console
- [Centralized Allowlists](https://docs.crowdsec.net/u/console/allowlists.md): CrowdSec Premium Feature
- [Introduction](https://docs.crowdsec.net/u/console/api/intro.md): Introduction to the CrowdSec Service API
- [Blocklists catalog](https://docs.crowdsec.net/u/console/blocklists/catalog.md): To provide blocklists tailored to each need, CrowdSec has a wide catalog of blocklists, encompassing a variety of threat types and sources. This diversity allows to select and implement blocklists that best match their specific security requirements.
- [Blocklist Details](https://docs.crowdsec.net/u/console/blocklists/details.md): To assist in deciding which blocklists to implement on your infrastructure, various statistics are available, offering a detailed insight into the benefits of using the Blocklist.
- [Featured Blocklists](https://docs.crowdsec.net/u/console/blocklists/featured.md): Featured Blocklists page advertises the best of what CrowdSec has to provide security wise to your organization.
- [Firewall integrations](https://docs.crowdsec.net/u/console/blocklists/integrations/firewall.md): The Firewall integration feature allows users to consume blocklists without installing any CrowdSec Security Engine. This feature provides flexibility by enabling users to pull blocklists from an endpoint in various formats.
- [Blocklists](https://docs.crowdsec.net/u/console/blocklists/overview.md): General overview
- [Blocklist Subscription](https://docs.crowdsec.net/u/console/blocklists/subscription.md): To begin the subscription process, click the Subscribe button at the top of the blocklist details page. This will open a popup that will allow you to select the subscription method.
- [Introduction](https://docs.crowdsec.net/u/console/decisions/decisions_intro.md): Console Management
- [Decisions Management](https://docs.crowdsec.net/u/console/decisions/decisions_management.md): CrowdSec Premium Feature
- [Getting started](https://docs.crowdsec.net/u/console/getting_started.md): Sign Up
- [Introduction to the CrowdSec Console](https://docs.crowdsec.net/u/console/intro.md): CrowdSec is an open-source and collaborative cybersecurity solution that protects websites, servers, and IT infrastructures from attacks. It leverages the power of the community to create a continuously updated security model that adapts to emerging threats. By analyzing users' logs in real-time, CrowdSec identifies and blocks malicious behavior across the entire network. The participatory approach ensures that the intelligence gathered is shared across the community when one user is attacked, enabling all users to block potential threats without external intervention.
- [CTI API Keys](https://docs.crowdsec.net/u/console/ip_reputation/api_keys.md): CrowdSec CTI information can be navigated in the WEB UI but for those who want to integrate CrowdSec's CTI into their tools and workflows, an API access is available through self-service API keys.
- [IP Reputation / CTI](https://docs.crowdsec.net/u/console/ip_reputation/intro.md): Explore and query CrowdSec's IP Reputation data and manage CTI API keys from the Console.
- [Investigating an IP Address](https://docs.crowdsec.net/u/console/ip_reputation/ip_report.md): Learn how to investigate an IP address in CrowdSec's Cyber Threat Intelligence (CTI) platform.
- [Search UI](https://docs.crowdsec.net/u/console/ip_reputation/search_ui.md): Welcome to CrowdSec’s Cyber Threat Intelligence (CTI)!
- [Advanced Search](https://docs.crowdsec.net/u/console/ip_reputation/search_ui_advanced.md): Learn how to use advanced search features in CrowdSec's Cyber Threat Intelligence (CTI) platform.
- [Discord](https://docs.crowdsec.net/u/console/notification_integrations/discord.md): Connecting an integration will create a configuration specific to your Discord server.
- [Overview](https://docs.crowdsec.net/u/console/notification_integrations/overview.md): CrowdSec Premium Feature
- [Notification rule](https://docs.crowdsec.net/u/console/notification_integrations/rule.md): CrowdSec Premium Feature
- [Slack](https://docs.crowdsec.net/u/console/notification_integrations/slack.md): Connecting an integration will create a configuration specific to your Slack workspace.
- [Webhook](https://docs.crowdsec.net/u/console/notification_integrations/webhook.md): Install the webhook integration
- [Premium Upgrade](https://docs.crowdsec.net/u/console/premium_upgrade.md): Find Premium features tailored to your role - DevOps, SecOps, or MSP
- [Premium Features Overview](https://docs.crowdsec.net/u/console/premium_upgrade/features_overview.md): Comprehensive overview of all Premium features
- [Optimal Premium Upgrade Setup](https://docs.crowdsec.net/u/console/premium_upgrade/optimal_setup.md): Best practices for setting up your Premium upgrade
- [Premium Support](https://docs.crowdsec.net/u/console/premium_upgrade/premium_support.md): CrowdSec Premium Feature
- [Test Premium Value in Your Environment](https://docs.crowdsec.net/u/console/premium_upgrade/testing_premium.md): Practical ways to measure and experience Premium value during your trial
- [Remediation Metrics](https://docs.crowdsec.net/u/console/remediation_metrics.md): For your Security Engine to collect and send metrics, make sure you're using CrowdSec v1.6.3 or higher.
- [Remediation Sync](https://docs.crowdsec.net/u/console/remediation_sync.md): CrowdSec Premium Feature
- [Am I Under Attack](https://docs.crowdsec.net/u/console/security_engines/am_i_under_attack.md): Alerting you when a surge of attack is hitting you
- [Archiving a Security Engine](https://docs.crowdsec.net/u/console/security_engines/archive_engine.md): Archiving a Security Engine
- [Dashboard](https://docs.crowdsec.net/u/console/security_engines/dashboard.md): Security Engines Dashboard page
- [Details page](https://docs.crowdsec.net/u/console/security_engines/details_page.md): Learn how to view the details of a Security Engine in the CrowdSec Console its purpose and how to use it
- [Filter and Sort](https://docs.crowdsec.net/u/console/security_engines/filter_and_sort.md): Security Engines Dashboard page
- [Name and Tags](https://docs.crowdsec.net/u/console/security_engines/name_and_tags.md): Security Engines Name and Tags (edition)
- [Pending Security Engines](https://docs.crowdsec.net/u/console/security_engines/pending_security_engines.md): Accept or decline Security Engines waiting for enrollment
- [Removing a Security Engine](https://docs.crowdsec.net/u/console/security_engines/remove_engine.md): Remove Security Engines from an organization
- [Select multiple organizations 🧪](https://docs.crowdsec.net/u/console/security_engines/select_multiple_organizations.md): Learn how to select multiple organizations to all their Security Engines in the CrowdSec Console
- [Transfer Engine](https://docs.crowdsec.net/u/console/security_engines/transfer_engine.md): Transfer Security Engines to another organization
- [Troubleshooting Hints](https://docs.crowdsec.net/u/console/security_engines/troubleshooting.md): Troubleshooting Security Engines
- [Blocklists](https://docs.crowdsec.net/u/console/service_api/blocklists.md): Introduction
- [FAQ](https://docs.crowdsec.net/u/console/service_api/faq.md): Creating public blocklists
- [Getting Started](https://docs.crowdsec.net/u/console/service_api/getting_started.md): CrowdSec Premium Feature
- [Integrations](https://docs.crowdsec.net/u/console/service_api/integrations.md): Integration supported formats
- [Allowlists](https://docs.crowdsec.net/u/console/service_api/quickstart/allowlists.md): - We're assuming your API key is set in the environment variable $KEY with the necessary permissions.
- [Authentication](https://docs.crowdsec.net/u/console/service_api/quickstart/authentication.md): Once you have created an API key, you can use it to authenticate requests to the CrowdSec Service API by including it in the x-api-key header of your HTTP requests.
- [Blocklists](https://docs.crowdsec.net/u/console/service_api/quickstart/blocklists.md): - We're assuming your API key is set in the environment variable $KEY with the necessary permissions.
- [Integrations](https://docs.crowdsec.net/u/console/service_api/quickstart/integrations.md): - We're assuming your API key is set in the environment variable $KEY with the necessary permissions.
- [Metrics](https://docs.crowdsec.net/u/console/service_api/quickstart/metrics.md): - We're assuming your API key is set in the environment variable $KEY with the necessary permissions.
- [Python](https://docs.crowdsec.net/u/console/service_api/sdks/python.md): Installation
- [Stack Health](https://docs.crowdsec.net/u/console/stackhealth.md): The Stack Health Feature is a monitoring tool within the CrowdSec Console helping you keep your infrastructure operational and properly configured.
- [Threat Forecast](https://docs.crowdsec.net/u/console/threat_forecast.md): CrowdSec Premium Feature

### cti_api

- [Chrome Extension](https://docs.crowdsec.net/u/cti_api/api_integration/integration_chrome.md): A Chrome extension which allows you to quickly select an IP on some web page and query it in CTI API.
- [Gigasheet](https://docs.crowdsec.net/u/cti_api/api_integration/integration_gigasheet.md): CrowdSec's CTI API can be used in Gigasheet's No-Code API-data-enrichment feature.
- [IntelOwl Plugin](https://docs.crowdsec.net/u/cti_api/api_integration/integration_intelowl.md): Since the recent release of IntelOwl 4.2.2, a CrowdSec analyzer has been included.
- [Integrations](https://docs.crowdsec.net/u/cti_api/api_integration/integration_intro.md): CrowdSec has native integrations for the most common security platforms. Enrich your workflows with IP reputation data without writing any code.
- [IPDEX](https://docs.crowdsec.net/u/cti_api/api_integration/integration_ipdex.md): ipdex is a tool developed by CrowdSec to investigate IP reputation using the CrowdSec CTI API. It is available as a web application and a CLI, and is particularly useful as a Proof of Value tool to assess CrowdSec's threat intelligence coverage across both blocklists and threat intel data.
- [Maltego Transforms](https://docs.crowdsec.net/u/cti_api/api_integration/integration_maltego.md): Maltego transforms, which allow users to enrich IP entities in maltego with CrowdSec CTI intelligence.In this documentation we'll answer the following questions:
- [MISP Plugin](https://docs.crowdsec.net/u/cti_api/api_integration/integration_misp.md): MISP plugin lets you enrich the knowledge of IP attributes using CrowdSec's CTI API.
- [Microsoft Sentinel](https://docs.crowdsec.net/u/cti_api/api_integration/integration_ms_sentinel.md): CrowdSec Sentinel Playbook allows you to enrich your Microsoft Sentinel security monitoring with CrowdSec's CTI intelligence. This integration enables you to detect and create alerts when authentication or other security events involve malicious or suspicious IP addresses.
- [MSTICpy](https://docs.crowdsec.net/u/cti_api/api_integration/integration_msticpy.md): MSTICpy includes a CrowdSec Threat Intelligence Provider. It can be used to enrich your IP IOCs with CrowdSec's smoke CTI. You can learn more about MSTICpy here.
- [OpenCTI Enrichment Connector](https://docs.crowdsec.net/u/cti_api/api_integration/integration_opencti.md): OpenCTI Internal enrichment connector that provides advanced Threat context on your IP Observables.
- [PaloAlto Cortex XSOAR Cortex Plugin](https://docs.crowdsec.net/u/cti_api/api_integration/integration_paloalto_xsoar.md): The PaloAlto XSOAR/XSIAM - Cortex Plugin allows you to obtain a detailed report from CrowdSec's CTI smoke database.
- [CrowdSec Qradar - Quick Access App](https://docs.crowdsec.net/u/cti_api/api_integration/integration_qradar.md): This QRadar App leverages CrowdSec's CTI’s smoke endpoint to get information about IP as seen by CrowdSec's network. This is enabled via a right click on IP GUI action. The information is presented with a summary of the IP's known behaviors, a link to CrowdSec's console and the possibility to copy the raw json response for further processing within Qradar. The information includes:
- [Security Copilot Plugin](https://docs.crowdsec.net/u/cti_api/api_integration/integration_securitycopilot.md): CrowdSec Intelligence Plugin for Microsoft Security Copilot allows you to get advanced insights on a malicious IP activity.
- [Sekoia XDR](https://docs.crowdsec.net/u/cti_api/api_integration/integration_sekoia_xdr.md): CrowdSec's CTI API can be used in Sekoia XDR Playbooks to enrich alerts with CrowdSec's knowledge about the IP. You can learn more about Sekoia XDR Playbooks here.
- [Splunk SIEM App](https://docs.crowdsec.net/u/cti_api/api_integration/integration_splunk_siem.md): The Splunk SIEM App enables IP lookup from CrowdSec CTI API via custom command called cssmoke. It provides information about the IP, such as what kind of attacks it has been participant of as seen by CrowdSec's network. It also includes enrichment by CrowdSec like background noise score, aggressivity over time etc.
- [Splunk SOAR](https://docs.crowdsec.net/u/cti_api/api_integration/integration_splunk_soar.md): Splunk SOAR App for CrowdSec. This App allows enrichment of IP addresses in an event investigation and playbooks with CrowdSec's CTI API.
- [TheHive/Cortex Plugin](https://docs.crowdsec.net/u/cti_api/api_integration/integration_thehive.md): The CrowdSec Cortex Analyzer allows you to obtain a detailed report from CrowdSec's CTI smoke database.
- [APIs Overview](https://docs.crowdsec.net/u/cti_api/api_introduction.md): CrowdSec exposes three ways to programmatically access its threat intelligence. They serve different use cases and scale requirements — pick the one that fits your workflow, or combine them.
- [Enrichment API](https://docs.crowdsec.net/u/cti_api/enrichment_api.md): The CrowdSec REST CTI API gives you programmatic access to IP reputation data collected from CrowdSec deployments worldwide. Use it to enrich your own security workflows, whether that's a quick manual lookup, a script that checks IPs at ingestion, or a fully automated enrichment pipeline inside a SIEM, SOAR, or TIP.
- [What Is Cyber Threat Intelligence (CTI)?](https://docs.crowdsec.net/u/cti_api/faq.md): CrowdSec's Cyber Threat Intelligence (CTI) FAQ.
- [CrowdSec IP Reputation / CTI](https://docs.crowdsec.net/u/cti_api/intro.md): {/ ── Hero ─────────────────────────────────────────────────────────────── /}
- [Offline Replicas](https://docs.crowdsec.net/u/cti_api/offline_replicas.md): The CTI REST API is ideal for looking up individual IPs on demand. But some use cases need the data locally: high-volume enrichment with no per-request latency, air-gapped environments, or feeding a SIEM/TIP in bulk.
- [Search Queries](https://docs.crowdsec.net/u/cti_api/search_queries.md): Lucene queries
- [TAXII](https://docs.crowdsec.net/u/cti_api/taxii.md): TAXII (Trusted Automated eXchange of Indicator Information) is the OASIS standard protocol for sharing cyber threat intelligence over HTTPS. The CrowdSec TAXII server implements TAXII 2.1 and serves indicators as STIX 2.1 objects, so any TAXII-compatible client (OpenCTI, MISP, Anomali, your TIP, etc.) can subscribe to the CrowdSec feed natively.
- [Behaviors](https://docs.crowdsec.net/u/cti_api/taxonomy/behaviors.md)
- [Benign Classifications](https://docs.crowdsec.net/u/cti_api/taxonomy/benign.md): IPs in this category may raise alerts, but they are not inherently dangerous. These IPs often belong to organizations that perform legitimate activities, such as internet-wide scanning or security research.
- [Classifications](https://docs.crowdsec.net/u/cti_api/taxonomy/classifications.md): Classification of Threat Intelligence follows the format category:name, where category is a broad type of classification encapsulating different elements.
- [Format](https://docs.crowdsec.net/u/cti_api/taxonomy/cti_object.md): Object example
- [Safe Classifications](https://docs.crowdsec.net/u/cti_api/taxonomy/false_positives.md): IPs in this category are considered completely safe and trusted. Alerts triggered by these IPs are likely due to misconfiguration or overly sensitive alerting rules.
- [Introduction](https://docs.crowdsec.net/u/cti_api/taxonomy/intro.md): CrowdSec CTI Taxonomy
- [Scenarios](https://docs.crowdsec.net/u/cti_api/taxonomy/scenarios.md)
- [Scores](https://docs.crowdsec.net/u/cti_api/taxonomy/scores.md): Understanding CrowdSec CTI Scores

### getting_started

- [CrowdSec Security Engine Setup Health-Check](https://docs.crowdsec.net/u/getting_started/health_check.md): Health Check Version: 0.2.0
- [Install CrowdSec on Cloudways](https://docs.crowdsec.net/u/getting_started/installation/cloudways.md): {/ This page is not linked in the doc on purpose, it's experimental and only for external linking purposes (reddit...) DO NOT ADD TO MENUS /}
- [Install with Docker or Podman](https://docs.crowdsec.net/u/getting_started/installation/docker.md): Prerequisites are written for bare metal installs. In containers, some of these items may not apply.
- [Install on FreeBSD](https://docs.crowdsec.net/u/getting_started/installation/freebsd.md): New to CrowdSec? Start with the introduction to understand the components and prerequisites.
- [Install on Kubernetes](https://docs.crowdsec.net/u/getting_started/installation/kubernetes.md): New to CrowdSec? Start with the
- [Install on Linux](https://docs.crowdsec.net/u/getting_started/installation/linux.md): New to CrowdSec? Start with the introduction to understand the components and prerequisites.
- [Install on macOS](https://docs.crowdsec.net/u/getting_started/installation/macos.md): We do not compile the Security Engine for macOS. Use a container runtime like Docker to run the Linux container on macOS.
- [Install on OPNsense](https://docs.crowdsec.net/u/getting_started/installation/opnsense.md): New to CrowdSec? Start with the introduction to understand the components and prerequisites.
- [Install on pfSense](https://docs.crowdsec.net/u/getting_started/installation/pfsense.md): New to CrowdSec? Start with the introduction to understand the components and prerequisites.
- [WHM plugin](https://docs.crowdsec.net/u/getting_started/installation/whm.md): The WHM plugin lets you control and monitor the CrowdSec Security Engine directly from your WHM dashboard.
- [Install on Windows](https://docs.crowdsec.net/u/getting_started/installation/windows.md): New to CrowdSec? Start with the introduction to learn the core concepts and prerequisites.
- [Introduction](https://docs.crowdsec.net/u/getting_started/intro.md): What is CrowdSec Security Engine?
- [Post Installation Steps](https://docs.crowdsec.net/u/getting_started/next_steps.md): Your CrowdSec installation is running. Use the steps below to finish setup and tailor CrowdSec to your environment.
- [Acquisition](https://docs.crowdsec.net/u/getting_started/post_installation/acquisition.md): By default, CrowdSec tries to detect running services (CrowdSec >= 1.7.0) and install the appropriate log sources and Collections.
- [Add new log sources](https://docs.crowdsec.net/u/getting_started/post_installation/acquisition_new.md): We will add a file-based acquisition. If you need a different source, adjust the instructions to match your setup.
- [Troubleshooting Acquisition](https://docs.crowdsec.net/u/getting_started/post_installation/acquisition_troubleshoot.md): This section walks you through troubleshooting acquisitions that are not working as expected.
- [Enroll your Security Engine in CrowdSec Console](https://docs.crowdsec.net/u/getting_started/post_installation/console.md): The CrowdSec Console is a web interface providing management and extra features for CrowdSec Products.
- [CrowdSec Blocklists](https://docs.crowdsec.net/u/getting_started/post_installation/console_blocklists.md): In the community edition of CrowdSec, you can subscribe to three blocklists for proactive protection against known malicious sources.
- [CrowdSec Hub](https://docs.crowdsec.net/u/getting_started/post_installation/console_hub.md): The CrowdSec Hub is a repository of ready-to-use configuration files.
- [CrowdSec Metrics](https://docs.crowdsec.net/u/getting_started/post_installation/metrics.md): CrowdSec is instrumented with Prometheus to provide detailed metrics and traceability.
- [Profiles](https://docs.crowdsec.net/u/getting_started/post_installation/profiles.md): Profiles are a list of rules that determine what actions CrowdSec takes after a detection. This can be as simple as banning an IP, or as complex as scaling ban duration based on prior detections.
- [Troubleshoot](https://docs.crowdsec.net/u/getting_started/post_installation/troubleshoot.md): This section helps you resolve common installation issues. If you need more depth, see the full troubleshooting documentation.
- [Whitelists](https://docs.crowdsec.net/u/getting_started/post_installation/whitelists.md): Whitelists tell CrowdSec to ignore certain events or IP addresses. This is useful if you have a static IP you trust, or a service that could generate false triggers (for example, a site that loads many thumbnails, images, or fonts).

### integrations

- [Checkpoint](https://docs.crowdsec.net/u/integrations/checkpoint.md): <ThemedImage
- [Cisco](https://docs.crowdsec.net/u/integrations/cisco.md): <ThemedImage
- [F5](https://docs.crowdsec.net/u/integrations/f5.md): <ThemedImage
- [Fortinet](https://docs.crowdsec.net/u/integrations/fortinet.md): <ThemedImage
- [Integrations](https://docs.crowdsec.net/u/integrations/intro.md): CrowdSec Blocklist Integrations (also known as Blocklist as a Service) give you a secure, hosted HTTPS endpoint serving live blocklists that you configure your firewall or security tool to pull from.
- [Juniper](https://docs.crowdsec.net/u/integrations/juniper.md): <ThemedImage
- [Mikrotik](https://docs.crowdsec.net/u/integrations/mikrotik.md): <ThemedImage
- [OPNsense](https://docs.crowdsec.net/u/integrations/opnsense.md): <ThemedImage
- [Palo Alto](https://docs.crowdsec.net/u/integrations/paloalto.md): <ThemedImage
- [pfSense](https://docs.crowdsec.net/u/integrations/pfsense.md): <ThemedImage
- [Raw IP List](https://docs.crowdsec.net/u/integrations/rawiplist.md): <ThemedImage
- [Remediation Component](https://docs.crowdsec.net/u/integrations/remediationcomponent.md): <ThemedImage
- [Sophos](https://docs.crowdsec.net/u/integrations/sophos.md): <ThemedImage

### tracker_api

- [Authentication & Setup](https://docs.crowdsec.net/u/tracker_api/api_authentication.md): Prerequisites
- [CVEs](https://docs.crowdsec.net/u/tracker_api/api_cves.md): This page covers the API endpoints for listing, searching, and retrieving detailed intelligence about CVEs tracked by the Live Exploit Tracker.
- [Reconnaissance / Fingerprint Rules](https://docs.crowdsec.net/u/tracker_api/api_fingerprints.md): This page covers the API endpoints for Reconnaissance rules (called "fingerprint rules" or "fingerprints" in the API) — detection patterns for product-level probing activity. See Reconnaissance Rules vs CVEs for an explanation of the concept.
- [Integrations & Blocklists](https://docs.crowdsec.net/u/tracker_api/api_integrations.md): Integrations are the bridge between CrowdSec's threat intelligence and your security infrastructure. An integration generates a blocklist of attacker IPs that your firewall can consume. You subscribe integrations to specific CVEs, fingerprint rules, or entire vendors, and the blocklist automatically updates as new attacker IPs are observed.
- [Vendors, Products & Tags](https://docs.crowdsec.net/u/tracker_api/api_lookups.md): The Live Exploit Tracker provides lookup endpoints to explore the coverage landscape. These help answer questions like "what WordPress vulnerabilities are being tracked?", "which Citrix products are covered?", or "what enterprise software threats should I monitor?"
- [SDKs & Libraries](https://docs.crowdsec.net/u/tracker_api/api_sdks.md): CrowdSec provides official SDKs to simplify integration with the Live Exploit Tracker API. These libraries handle authentication, request construction, response parsing, and provide typed models for a better developer experience.
- [CrowdSec Analysis](https://docs.crowdsec.net/u/tracker_api/crowdsec_analysis.md): What is the CrowdSec Analysis
- [Exploitation Phases](https://docs.crowdsec.net/u/tracker_api/exploitation_phases.md): Overview
- [Reconnaissance Rules vs CVEs](https://docs.crowdsec.net/u/tracker_api/fingerprints_vs_cves.md): Reconnaissance rules are called "Reconnaissance" or "Recon Rules" in the web interface, and "fingerprint rules" or "fingerprints" in the API. This documentation uses both terms interchangeably — they refer to the same thing.
- [Guide: Proactive Monitoring](https://docs.crowdsec.net/u/tracker_api/guide_proactive.md): Scenario
- [Guide: Triage Workflow](https://docs.crowdsec.net/u/tracker_api/guide_triage.md): Scenario
- [Overview](https://docs.crowdsec.net/u/tracker_api/intro.md): What is the Live Exploit Tracker
- [Scores & Ratings](https://docs.crowdsec.net/u/tracker_api/scores.md): Overview
- [Threat Context](https://docs.crowdsec.net/u/tracker_api/threat_context.md): Overview
- [Web Interface](https://docs.crowdsec.net/u/tracker_api/web_interface.md): Overview

### troubleshooting

- [Billing & Plans FAQ](https://docs.crowdsec.net/u/troubleshooting/billing_faq.md): CrowdSec Premium Feature
- [Central API 403 (Forbidden)](https://docs.crowdsec.net/u/troubleshooting/capi_403.md): Getting a 403 (Forbidden) from CrowdSec Central API (CAPI) means your Security Engine requests are blocked or your IP is rate limited.
- [Console Health Check Issues](https://docs.crowdsec.net/u/troubleshooting/console_issues.md): The CrowdSec Console monitors the health of your CrowdSec stack (Security Engines, Log Processors, remediation components and blocklist integrations) and raises alerts when issues are detected.
- [Troubleshooting CTI](https://docs.crowdsec.net/u/troubleshooting/cti.md): Community support
- [Future Console Health Check Issues](https://docs.crowdsec.net/u/troubleshooting/future_console_issues.md): This page lists potential health checks and recommendations that may be added to CrowdSec Console in future versions. They are grouped by type and priority to guide feature development.
- [Troubleshooting](https://docs.crowdsec.net/u/troubleshooting/intro.md): You may see the IDPS/WAF of CrowdSec referred to as "Security Engine" and Bouncers referred to as "Remediation Components" within new documentation.
- [Firewall Integration Offline](https://docs.crowdsec.net/u/troubleshooting/issue_integration_fw_offline.md): The Firewall Integration Offline issue appears when a firewall configured to pull blocklists directly from CrowdSec Blocklist-as-a-Service (BLaaS) has not pulled in more than 24 hours.
- [Firewall Integration Pulling Zero IPs](https://docs.crowdsec.net/u/troubleshooting/issue_integration_fw_zero_ips.md): The Firewall Integration Pulling Zero IPs issue means that none of its subscribed blocklists have IPs in them.
- [Remediation Component Integration Offline](https://docs.crowdsec.net/u/troubleshooting/issue_integration_rc_offline.md): The Remediation Component Integration Offline issue means a Blocklist integration of type Remediation Component has not pulled from its endpoint for more than 24 hours.
- [Log Processor No Alerts](https://docs.crowdsec.net/u/troubleshooting/issue_lp_no_alerts.md): The Log Processor No Alerts issue appears when a specific Log Processor is running and communicating with the Local API but has not generated alerts in the last 48 hours.
- [Log Processor No Logs Parsed](https://docs.crowdsec.net/u/troubleshooting/issue_lp_no_logs_parsed.md): The Log Processor No Logs Parsed issue indicates that logs are being read by the Log Processor, but none are being parsed correctly in the last 48 hours.
- [Log Processor No Logs Read](https://docs.crowdsec.net/u/troubleshooting/issue_lp_no_logs_read.md): The Log Processor No Logs Read issue means the LP is running but has not acquired any log lines in the last 24 hours.
- [Log Processor Offline](https://docs.crowdsec.net/u/troubleshooting/issue_lp_offline.md): LogProcessors are Security Engine used to read log in a distributed setup.
- [Mismatching Collection(s)](https://docs.crowdsec.net/u/troubleshooting/issue_mismatch_collections.md): The Mismatching Collection(s) issue appears when a collection is installed but its related log files are not read. For example, crowdsecurity/nginx is installed while no nginx logs are being read.
- [Security Engine No Active Remediation Component](https://docs.crowdsec.net/u/troubleshooting/issue_se_no_active_rc.md): The Security Engine No Active Remediation Component issue appears when a Security Engine has Remediation Components (bouncers) registered, but none of them have sent a heartbeat in the past 24 hours.
- [Security Engine No Alerts](https://docs.crowdsec.net/u/troubleshooting/issue_se_no_alerts.md): The Engine No Alerts issue appears when your Security Engine has been running but hasn't forwarded any alerts to the Central API in the last 48 hours.
- [Security Engine No Remediation Component](https://docs.crowdsec.net/u/troubleshooting/issue_se_no_rc.md): The Security Engine No Remediation Component issue appears when a Security Engine has no Remediation Component (bouncer) registered against it.
- [Security Engine Offline](https://docs.crowdsec.net/u/troubleshooting/issue_se_offline.md): The Security Engine Offline issue indicates that an enrolled Security Engine has not reported to CrowdSec Central API for more than 48 hours.
- [Security Engine Too Many Alerts](https://docs.crowdsec.net/u/troubleshooting/issue_se_too_many_alerts.md): The Engine Too Many Alerts issue appears when your Security Engine generates an abnormally high volume of alerts. This usually indicates a misconfigured scenario or an ongoing large-scale attack.
- [Troubleshooting Remediation Components](https://docs.crowdsec.net/u/troubleshooting/remediation_components.md): Community support
- [Troubleshooting Security Engine](https://docs.crowdsec.net/u/troubleshooting/security_engine.md): Community support
- [Use Cases and Quick Solutions](https://docs.crowdsec.net/u/troubleshooting/usecases.md): This page provides quick recommendations for common CrowdSec implementation scenarios. Each use case includes practical implementation paths with links to relevant documentation.

### user_guides

- [Contextualize Alerts](https://docs.crowdsec.net/u/user_guides/alert_context.md): Introduction
- [Application Security Component](https://docs.crowdsec.net/u/user_guides/appsec_tuto.md): TODO
- [Bouncers](https://docs.crowdsec.net/u/user_guides/bouncers_configuration.md): CrowdSec is composed of different components that communicate via a Local API.
- [Manual installation](https://docs.crowdsec.net/u/user_guides/building.md): Manually install the Debian package
- [Consuming Fastly Logs](https://docs.crowdsec.net/u/user_guides/consuming_fastly_logs.md): In this guide we're going to:
- [Understand logs processing](https://docs.crowdsec.net/u/user_guides/cscli_explain.md): cscli explain relies on your local setup, parsers, scenario to display its data. It requires a working local crowdsec setup.
- [Run cscli on MacOS](https://docs.crowdsec.net/u/user_guides/cscli_macos.md): Running cscli on macos
- [Decisions](https://docs.crowdsec.net/u/user_guides/decisions_mgmt.md): Please see your local sudo cscli help decisions for up-to-date documentation.
- [Hub](https://docs.crowdsec.net/u/user_guides/hub_mgmt.md): Hub management, via cscli allows you to install, upgrade, remove and view installed collections, parsers, scenarios etc.
- [Introduction](https://docs.crowdsec.net/u/user_guides/intro.md): Explore the CrowdSec guides for insightful starting points on installation, configuration, and troubleshooting. Please note that these guides serve as initial references, and for more comprehensive assistance or specific queries, further exploration or reaching out for additional support is encouraged.
- [Local API](https://docs.crowdsec.net/u/user_guides/lapi_mgmt.md): The Local API (LAPI) is a core component of CrowdSec and has a few essential missions :
- [Log Centralization](https://docs.crowdsec.net/u/user_guides/log_centralization.md): Introduction
- [Machines](https://docs.crowdsec.net/u/user_guides/machines_mgmt.md): CrowdSec is composed of different components that communicate via a Local API.
- [About multi-server setup](https://docs.crowdsec.net/u/user_guides/multiserver_setup.md): Introduction
- [Replay Mode](https://docs.crowdsec.net/u/user_guides/replay_mode.md): While CrowdSec can be used to monitor "live" logs, it can also be used to replay old log files (replay/forensic mode).
- [CrowdSec WAF Reverse Proxy](https://docs.crowdsec.net/u/user_guides/waf_rp_howto.md): Introduction

## Optional
- [CrowdSec Hub](https://hub.crowdsec.net/): Browse and install parsers, scenarios, collections, and remediation components
- [CrowdSec Console](https://app.crowdsec.net/): Manage your CrowdSec deployments and access the community blocklist
- [GitHub Repository](https://github.com/crowdsecurity/crowdsec): CrowdSec open source repository
- [Community Discourse](https://discourse.crowdsec.net): Community support and discussions