# CrowdSec Documentation > Real-time & crowdsourced protection against aggressive IPs - Complete documentation for CrowdSec Security Engine, WAF, Bouncers, CTI API, and Console ## search - [Search the documentation](https://docs.crowdsec.net/search.md) ## docs ### next - [WAF Deployment Strategies](https://docs.crowdsec.net/docs/next/appsec/advanced_deployments.md): Progressively harden your CrowdSec Web Application Firewall (WAF) deployment, from basic virtual patching to multi-layer protection with the OWASP CRS. - [WAF Alerts & Scenarios](https://docs.crowdsec.net/docs/next/appsec/alerts_and_scenarios.md): How CrowdSec WAF rule matches become events, alerts and decisions: the appsec-logs parser, the event layout, and the scenarios that turn them into bans. - [OpenAPI Schema Validation](https://docs.crowdsec.net/docs/next/appsec/api_validation.md): Validate incoming HTTP requests against an OpenAPI 3 schema with the CrowdSec WAF, rejecting anything that does not match your API before it reaches the app. - [Basic Benchmark](https://docs.crowdsec.net/docs/next/appsec/benchmark.md): Performance benchmarks for the CrowdSec Web Application Firewall (WAF): throughput and latency measured with virtual patching rules and with the full OWASP CRS. - [Bot Detection Challenge Protocol](https://docs.crowdsec.net/docs/next/appsec/bot_detection/challenge_protocol.md): Reference for the challenge action that extends the CrowdSec WAF bouncer protocol, for maintainers adding bot detection support to a remediation component. - [Bot Detection Configuration](https://docs.crowdsec.net/docs/next/appsec/bot_detection/configuration.md): Configure CrowdSec bot detection: signing keys and rotation, challenge cookie lifetime, and JavaScript bundle obfuscation, set from an appsec-config overlay. - [Bot Detection Customization & Recipes](https://docs.crowdsec.net/docs/next/appsec/bot_detection/customization.md): Ready-to-use appsec-config overlays for CrowdSec bot detection: challenge specific routes, tune scoring, and allow verified crawlers without editing hub files. - [Enable Bot Detection](https://docs.crowdsec.net/docs/next/appsec/bot_detection/enable.md): Turn on CrowdSec bot detection: install the appsec-bot-challenge collection, make your AppSec acquisition load it, and verify that the challenge is served. - [Bot Detection Hooks Reference](https://docs.crowdsec.net/docs/next/appsec/bot_detection/hooks.md): Reference for the on_challenge and on_challenge_submit hooks and the fingerprint object, used to score and filter automated clients in the CrowdSec WAF. - [How Bot Detection Works](https://docs.crowdsec.net/docs/next/appsec/bot_detection/how_it_works.md): How CrowdSec bot detection works: a browser-side proof-of-work and device fingerprint that filters headless browsers and scripts before they reach your app. - [Bot Detection](https://docs.crowdsec.net/docs/next/appsec/bot_detection/intro.md): Block scrapers, headless browsers and automation at the edge with CrowdSec bot detection, part of the open-source Web Application Firewall (WAF). - [Bot Detection Default Configuration](https://docs.crowdsec.net/docs/next/appsec/bot_detection/whats_included.md): What the crowdsecurity/appsec-bot-challenge collection installs: the two scoring and threshold appsec-configs, plus the behavioral scenarios it ships with. - [AppSec Configuration Creation & Testing](https://docs.crowdsec.net/docs/next/appsec/configuration_creation_testing.md): Write and test CrowdSec WAF configurations: the AppSec acquisition file, loading multiple appsec-configs, and combining in-band and out-of-band rule sets. - [Allowlisting and Rule Overrides](https://docs.crowdsec.net/docs/next/appsec/configuration_rule_management.md): Disable or override CrowdSec WAF rules at runtime by name, ID or tag, and allowlist requests by source IP or URI without tainting your hub configuration. - [AppSec Configuration Syntax](https://docs.crowdsec.net/docs/next/appsec/configuration.md): Full key reference for CrowdSec WAF appsec-config files: loading in-band and out-of-band rules, default remediation, and how multiple configs are merged. - [Writing & Testing WAF Rules](https://docs.crowdsec.net/docs/next/appsec/create_rules.md): Write a CrowdSec WAF rule and its functional tests from scratch, using a worked shell injection example you can follow through to a Hub submission. - [OWASP CRS Customization](https://docs.crowdsec.net/docs/next/appsec/crs/crs_config.md): Tune the OWASP Core Rule Set running on the CrowdSec WAF through the plugin system, so you can fix false positives without editing any shipped CRS file. - [OWASP CRS Installation](https://docs.crowdsec.net/docs/next/appsec/crs/installation.md): Install the OWASP Core Rule Set on the CrowdSec Web Application Firewall (WAF), in non-blocking out-of-band mode first or directly in blocking in-band mode. - [OWASP CRS Support](https://docs.crowdsec.net/docs/next/appsec/crs/intro.md): The CrowdSec Web Application Firewall (WAF) runs the OWASP Core Rule Set. How CRS generic detection compares with virtual patching, and when to use each. - [OWASP CRS Plugin Support](https://docs.crowdsec.net/docs/next/appsec/crs/plugin_support.md): Use OWASP CRS plugins with the CrowdSec WAF to extend or fine-tune the rule set per application, and where to place config, before and after plugin files. - [FAQ](https://docs.crowdsec.net/docs/next/appsec/faq.md) - [AppSec Hooks](https://docs.crowdsec.net/docs/next/appsec/hooks.md): Hook into the CrowdSec WAF at runtime with the on_load, pre_eval, post_eval and on_match phases to change rule behavior, enrich events and control remediation. - [AppSec Component - CrowdSec WAF](https://docs.crowdsec.net/docs/next/appsec/intro.md): CrowdSec's AppSec Component is an open-source Web Application Firewall (WAF) that inspects HTTP requests in real time, with virtual patching and OWASP CRS. - [WAF / Bouncer Communication Protocol](https://docs.crowdsec.net/docs/next/appsec/protocol.md): HTTP protocol reference for talking to the CrowdSec WAF: required headers, request forwarding and response codes, for building your own remediation component. - [CrowdSec WAF QuickStart for Envoy Gateway](https://docs.crowdsec.net/docs/next/appsec/quickstart/envoy-gateway.md): Deploy the CrowdSec Web Application Firewall (WAF) in Kubernetes and protect workloads exposed through Envoy Gateway using an external authorization service. - [CrowdSec WAF General Setup](https://docs.crowdsec.net/docs/next/appsec/quickstart/general_setup.md): Core setup for the CrowdSec Web Application Firewall (WAF): install the rule collections, configure the AppSec acquisition, and point your bouncer at it. - [CrowdSec WAF QuickStart for HAProxy (SPOA)](https://docs.crowdsec.net/docs/next/appsec/quickstart/haproxy_spoa.md): Protect applications behind HAProxy with CrowdSec's open-source Web Application Firewall (WAF), using the SPOA remediation component to forward requests. - [CrowdSec WAF QuickStart for NGINX Ingress (Helm)](https://docs.crowdsec.net/docs/next/appsec/quickstart/nginx-ingress.md): Install the CrowdSec Web Application Firewall (WAF) on Kubernetes with Helm and protect the services exposed through your NGINX Ingress Controller. - [CrowdSec WAF QuickStart for Nginx / OpenResty](https://docs.crowdsec.net/docs/next/appsec/quickstart/nginxopenresty.md): Protect an Nginx or OpenResty server with CrowdSec's open-source Web Application Firewall (WAF) in a few copy-paste commands, from install to verification. - [CrowdSec WAF QuickStart for NPMplus](https://docs.crowdsec.net/docs/next/appsec/quickstart/npmplus.md): Run CrowdSec's open-source Web Application Firewall (WAF) behind NPMplus, an Nginx Proxy Manager fork, using Docker Compose and the NPMplus admin UI. - [CrowdSec WAF QuickStart for Traefik](https://docs.crowdsec.net/docs/next/appsec/quickstart/traefik.md): Protect web applications behind Traefik with CrowdSec's open-source Web Application Firewall (WAF), from installing the rules to wiring the AppSec middleware. - [CrowdSec WAF QuickStart for WordPress](https://docs.crowdsec.net/docs/next/appsec/quickstart/wordpress.md): Protect a WordPress site with CrowdSec's open-source Web Application Firewall (WAF), using the WordPress bouncer plugin and the AppSec Component. - [CrowdSec AppSec Request Lifecycle & Detection Pipeline](https://docs.crowdsec.net/docs/next/appsec/request_lifecycle.md): Follow an HTTP request through the CrowdSec WAF: in-band and out-of-band inspection, hooks, and the scenarios that turn matches into decisions. - [WAF Rules Deployment](https://docs.crowdsec.net/docs/next/appsec/rules_deploy.md): Deploy a custom CrowdSec WAF rule on your host, from a local YAML file to a loaded and verified rule, with a worked example you can copy command by command. - [WAF Rules Examples](https://docs.crowdsec.net/docs/next/appsec/rules_examples.md): Real CrowdSec WAF rule examples from the Hub, each with the rule definition, a matching HTTP request, and an explanation of the capability it demonstrates. - [WAF Rules Syntax](https://docs.crowdsec.net/docs/next/appsec/rules_syntax.md): Full syntax reference for CrowdSec WAF rules: in-band and out-of-band evaluation, zones, transforms, match operators, and the remediation a match triggers. - [WAF Troubleshooting](https://docs.crowdsec.net/docs/next/appsec/troubleshooting.md): Troubleshoot the CrowdSec Web Application Firewall (WAF): read cscli appsec metrics, inspect rule triggers, and debug requests not matched as expected. - [Introduction](https://docs.crowdsec.net/docs/next/central_api/community_blocklist.md): The "Community Blocklist" is a curated list of IP addresses identified as malicious by CrowdSec. CrowdSec proactively block the IP addresses of this blocklist, preventing malevolent IPs from reaching your systems. - [Introduction](https://docs.crowdsec.net/docs/next/central_api/intro.md): The Central API is the service where the Local API pushes signal meta-data and from where it receives the community blocklists. - [Concepts](https://docs.crowdsec.net/docs/next/concepts.md): Global overview - [Crowdsec configuration](https://docs.crowdsec.net/docs/next/configuration/crowdsec_configuration.md): CrowdSec has a main yaml configuration file, usually located in /etc/crowdsec/config.yaml. - [Feature Flags](https://docs.crowdsec.net/docs/next/configuration/feature_flags.md): In order to make it easier for users to test and experiment with new features, CrowdSec uses the concept of "feature flags". - [Ports inventory](https://docs.crowdsec.net/docs/next/configuration/network_management.md): - tcp/8080 exposes a REST API for bouncers, cscli and communication between crowdsec agent and local api - [How to write a values parameter file](https://docs.crowdsec.net/docs/next/configuration/values_parameters.md): The following configuration keeps the Helm chart close to its defaults while - [Contact the team](https://docs.crowdsec.net/docs/next/contact_team.md): If you want to contact us using non-public media, you can contact us on support AT crowdsec DOT net with the following gpg-key : - [Remediation Components](https://docs.crowdsec.net/docs/next/contributing/contributing_bouncers.md): Publishing remediation component - [Contributing to CrowdSec](https://docs.crowdsec.net/docs/next/contributing/contributing_crowdsec.md): - If you want to report a bug, you can use the github bugtracker - [Contributing basics](https://docs.crowdsec.net/docs/next/contributing/contributing_doc.md): - Write Crowdsec documentation in Markdown and build the Crowdsec documentation using docusaurus - [Contributing to the Hub](https://docs.crowdsec.net/docs/next/contributing/contributing_hub.md): Parsers, Scenarios, Collections, and WAF rules allow the CrowdSec Security Engine to detect and block malevolent behavior. Supporting new services or improving detection capabilities is a great way to contribute to the CrowdSec ecosystem. - [Creating a test environment](https://docs.crowdsec.net/docs/next/contributing/contributing_test_env.md): The following documentation is written for use on Linux systems. If you are using a different operating system, please adjust the commands accordingly if we have prebuilt binaries for your system. - [Getting Started](https://docs.crowdsec.net/docs/next/contributing/getting_started.md): Getting Started - [Specifications for Remediation Component and AppSec Capabilities](https://docs.crowdsec.net/docs/next/contributing/specs/bouncer_appsec_specs.md): Context - [Remediation Component Metrics](https://docs.crowdsec.net/docs/next/contributing/specs/bouncer_metrics_specs.md): Overview - [cscli](https://docs.crowdsec.net/docs/next/cscli.md): cscli - [cscli alerts delete](https://docs.crowdsec.net/docs/next/cscli/cscli_alerts_delete.md): cscli alerts delete - [cscli alerts flush](https://docs.crowdsec.net/docs/next/cscli/cscli_alerts_flush.md): cscli alerts flush - [cscli alerts inspect](https://docs.crowdsec.net/docs/next/cscli/cscli_alerts_inspect.md): cscli alerts inspect - [cscli alerts list](https://docs.crowdsec.net/docs/next/cscli/cscli_alerts_list.md): cscli alerts list - [cscli alerts](https://docs.crowdsec.net/docs/next/cscli/cscli_alerts.md): cscli alerts - [cscli allowlists add](https://docs.crowdsec.net/docs/next/cscli/cscli_allowlists_add.md): cscli allowlists add - [cscli allowlists check](https://docs.crowdsec.net/docs/next/cscli/cscli_allowlists_check.md): cscli allowlists check - [cscli allowlists create](https://docs.crowdsec.net/docs/next/cscli/cscli_allowlists_create.md): cscli allowlists create - [cscli allowlists delete](https://docs.crowdsec.net/docs/next/cscli/cscli_allowlists_delete.md): cscli allowlists delete - [cscli allowlists import](https://docs.crowdsec.net/docs/next/cscli/cscli_allowlists_import.md): cscli allowlists import - [cscli allowlists inspect](https://docs.crowdsec.net/docs/next/cscli/cscli_allowlists_inspect.md): cscli allowlists inspect - [cscli allowlists list](https://docs.crowdsec.net/docs/next/cscli/cscli_allowlists_list.md): cscli allowlists list - [cscli allowlists remove](https://docs.crowdsec.net/docs/next/cscli/cscli_allowlists_remove.md): cscli allowlists remove - [cscli allowlists](https://docs.crowdsec.net/docs/next/cscli/cscli_allowlists.md): cscli allowlists - [cscli appsec-configs inspect](https://docs.crowdsec.net/docs/next/cscli/cscli_appsec-configs_inspect.md): cscli appsec-configs inspect - [cscli appsec-configs install](https://docs.crowdsec.net/docs/next/cscli/cscli_appsec-configs_install.md): cscli appsec-configs install - [cscli appsec-configs list](https://docs.crowdsec.net/docs/next/cscli/cscli_appsec-configs_list.md): cscli appsec-configs list - [cscli appsec-configs remove](https://docs.crowdsec.net/docs/next/cscli/cscli_appsec-configs_remove.md): cscli appsec-configs remove - [cscli appsec-configs upgrade](https://docs.crowdsec.net/docs/next/cscli/cscli_appsec-configs_upgrade.md): cscli appsec-configs upgrade - [cscli appsec-configs](https://docs.crowdsec.net/docs/next/cscli/cscli_appsec-configs.md): cscli appsec-configs - [cscli appsec-rules inspect](https://docs.crowdsec.net/docs/next/cscli/cscli_appsec-rules_inspect.md): cscli appsec-rules inspect - [cscli appsec-rules install](https://docs.crowdsec.net/docs/next/cscli/cscli_appsec-rules_install.md): cscli appsec-rules install - [cscli appsec-rules list](https://docs.crowdsec.net/docs/next/cscli/cscli_appsec-rules_list.md): cscli appsec-rules list - [cscli appsec-rules remove](https://docs.crowdsec.net/docs/next/cscli/cscli_appsec-rules_remove.md): cscli appsec-rules remove - [cscli appsec-rules upgrade](https://docs.crowdsec.net/docs/next/cscli/cscli_appsec-rules_upgrade.md): cscli appsec-rules upgrade - [cscli appsec-rules](https://docs.crowdsec.net/docs/next/cscli/cscli_appsec-rules.md): cscli appsec-rules - [cscli bouncers add](https://docs.crowdsec.net/docs/next/cscli/cscli_bouncers_add.md): cscli bouncers add - [cscli bouncers delete](https://docs.crowdsec.net/docs/next/cscli/cscli_bouncers_delete.md): cscli bouncers delete - [cscli bouncers inspect](https://docs.crowdsec.net/docs/next/cscli/cscli_bouncers_inspect.md): cscli bouncers inspect - [cscli bouncers list](https://docs.crowdsec.net/docs/next/cscli/cscli_bouncers_list.md): cscli bouncers list - [cscli bouncers prune](https://docs.crowdsec.net/docs/next/cscli/cscli_bouncers_prune.md): cscli bouncers prune - [cscli bouncers](https://docs.crowdsec.net/docs/next/cscli/cscli_bouncers.md): cscli bouncers - [cscli capi register](https://docs.crowdsec.net/docs/next/cscli/cscli_capi_register.md): cscli capi register - [cscli capi status](https://docs.crowdsec.net/docs/next/cscli/cscli_capi_status.md): cscli capi status - [cscli capi](https://docs.crowdsec.net/docs/next/cscli/cscli_capi.md): cscli capi - [cscli collections inspect](https://docs.crowdsec.net/docs/next/cscli/cscli_collections_inspect.md): cscli collections inspect - [cscli collections install](https://docs.crowdsec.net/docs/next/cscli/cscli_collections_install.md): cscli collections install - [cscli collections list](https://docs.crowdsec.net/docs/next/cscli/cscli_collections_list.md): cscli collections list - [cscli collections remove](https://docs.crowdsec.net/docs/next/cscli/cscli_collections_remove.md): cscli collections remove - [cscli collections upgrade](https://docs.crowdsec.net/docs/next/cscli/cscli_collections_upgrade.md): cscli collections upgrade - [cscli collections](https://docs.crowdsec.net/docs/next/cscli/cscli_collections.md): cscli collections - [cscli completion](https://docs.crowdsec.net/docs/next/cscli/cscli_completion.md): cscli completion - [cscli config feature-flags](https://docs.crowdsec.net/docs/next/cscli/cscli_config_feature-flags.md): cscli config feature-flags - [cscli config show-yaml](https://docs.crowdsec.net/docs/next/cscli/cscli_config_show-yaml.md): cscli config show-yaml - [cscli config show](https://docs.crowdsec.net/docs/next/cscli/cscli_config_show.md): cscli config show - [cscli config](https://docs.crowdsec.net/docs/next/cscli/cscli_config.md): cscli config - [cscli console disable](https://docs.crowdsec.net/docs/next/cscli/cscli_console_disable.md): cscli console disable - [cscli console enable](https://docs.crowdsec.net/docs/next/cscli/cscli_console_enable.md): cscli console enable - [cscli console enroll](https://docs.crowdsec.net/docs/next/cscli/cscli_console_enroll.md): cscli console enroll - [cscli console status](https://docs.crowdsec.net/docs/next/cscli/cscli_console_status.md): cscli console status - [cscli console](https://docs.crowdsec.net/docs/next/cscli/cscli_console.md): cscli console - [cscli contexts inspect](https://docs.crowdsec.net/docs/next/cscli/cscli_contexts_inspect.md): cscli contexts inspect - [cscli contexts install](https://docs.crowdsec.net/docs/next/cscli/cscli_contexts_install.md): cscli contexts install - [cscli contexts list](https://docs.crowdsec.net/docs/next/cscli/cscli_contexts_list.md): cscli contexts list - [cscli contexts remove](https://docs.crowdsec.net/docs/next/cscli/cscli_contexts_remove.md): cscli contexts remove - [cscli contexts upgrade](https://docs.crowdsec.net/docs/next/cscli/cscli_contexts_upgrade.md): cscli contexts upgrade - [cscli contexts](https://docs.crowdsec.net/docs/next/cscli/cscli_contexts.md): cscli contexts - [cscli dashboard](https://docs.crowdsec.net/docs/next/cscli/cscli_dashboard.md): cscli dashboard - [cscli decisions add](https://docs.crowdsec.net/docs/next/cscli/cscli_decisions_add.md): cscli decisions add - [cscli decisions delete](https://docs.crowdsec.net/docs/next/cscli/cscli_decisions_delete.md): cscli decisions delete - [cscli decisions import](https://docs.crowdsec.net/docs/next/cscli/cscli_decisions_import.md): cscli decisions import - [cscli decisions list](https://docs.crowdsec.net/docs/next/cscli/cscli_decisions_list.md): cscli decisions list - [cscli decisions](https://docs.crowdsec.net/docs/next/cscli/cscli_decisions.md): cscli decisions - [cscli explain](https://docs.crowdsec.net/docs/next/cscli/cscli_explain.md): cscli explain - [cscli hub branch](https://docs.crowdsec.net/docs/next/cscli/cscli_hub_branch.md): cscli hub branch - [cscli hub list](https://docs.crowdsec.net/docs/next/cscli/cscli_hub_list.md): cscli hub list - [cscli hub search](https://docs.crowdsec.net/docs/next/cscli/cscli_hub_search.md): cscli hub search - [cscli hub types](https://docs.crowdsec.net/docs/next/cscli/cscli_hub_types.md): cscli hub types - [cscli hub update](https://docs.crowdsec.net/docs/next/cscli/cscli_hub_update.md): cscli hub update - [cscli hub upgrade](https://docs.crowdsec.net/docs/next/cscli/cscli_hub_upgrade.md): cscli hub upgrade - [cscli hub](https://docs.crowdsec.net/docs/next/cscli/cscli_hub.md): cscli hub - [cscli hubtest clean](https://docs.crowdsec.net/docs/next/cscli/cscli_hubtest_clean.md): cscli hubtest clean - [cscli hubtest coverage](https://docs.crowdsec.net/docs/next/cscli/cscli_hubtest_coverage.md): cscli hubtest coverage - [cscli hubtest create](https://docs.crowdsec.net/docs/next/cscli/cscli_hubtest_create.md): cscli hubtest create - [cscli hubtest eval](https://docs.crowdsec.net/docs/next/cscli/cscli_hubtest_eval.md): cscli hubtest eval - [cscli hubtest explain](https://docs.crowdsec.net/docs/next/cscli/cscli_hubtest_explain.md): cscli hubtest explain - [cscli hubtest info](https://docs.crowdsec.net/docs/next/cscli/cscli_hubtest_info.md): cscli hubtest info - [cscli hubtest list](https://docs.crowdsec.net/docs/next/cscli/cscli_hubtest_list.md): cscli hubtest list - [cscli hubtest run](https://docs.crowdsec.net/docs/next/cscli/cscli_hubtest_run.md): cscli hubtest run - [cscli hubtest](https://docs.crowdsec.net/docs/next/cscli/cscli_hubtest.md): cscli hubtest - [cscli lapi context add](https://docs.crowdsec.net/docs/next/cscli/cscli_lapi_context_add.md): cscli lapi context add - [cscli lapi context delete](https://docs.crowdsec.net/docs/next/cscli/cscli_lapi_context_delete.md): cscli lapi context delete - [cscli lapi context detect](https://docs.crowdsec.net/docs/next/cscli/cscli_lapi_context_detect.md): cscli lapi context detect - [cscli lapi context status](https://docs.crowdsec.net/docs/next/cscli/cscli_lapi_context_status.md): cscli lapi context status - [cscli lapi context](https://docs.crowdsec.net/docs/next/cscli/cscli_lapi_context.md): cscli lapi context - [cscli lapi register](https://docs.crowdsec.net/docs/next/cscli/cscli_lapi_register.md): cscli lapi register - [cscli lapi status](https://docs.crowdsec.net/docs/next/cscli/cscli_lapi_status.md): cscli lapi status - [cscli lapi](https://docs.crowdsec.net/docs/next/cscli/cscli_lapi.md): cscli lapi - [cscli machines add](https://docs.crowdsec.net/docs/next/cscli/cscli_machines_add.md): cscli machines add - [cscli machines delete](https://docs.crowdsec.net/docs/next/cscli/cscli_machines_delete.md): cscli machines delete - [cscli machines inspect](https://docs.crowdsec.net/docs/next/cscli/cscli_machines_inspect.md): cscli machines inspect - [cscli machines list](https://docs.crowdsec.net/docs/next/cscli/cscli_machines_list.md): cscli machines list - [cscli machines prune](https://docs.crowdsec.net/docs/next/cscli/cscli_machines_prune.md): cscli machines prune - [cscli machines validate](https://docs.crowdsec.net/docs/next/cscli/cscli_machines_validate.md): cscli machines validate - [cscli machines](https://docs.crowdsec.net/docs/next/cscli/cscli_machines.md): cscli machines - [cscli metrics list](https://docs.crowdsec.net/docs/next/cscli/cscli_metrics_list.md): cscli metrics list - [cscli metrics show](https://docs.crowdsec.net/docs/next/cscli/cscli_metrics_show.md): cscli metrics show - [cscli metrics](https://docs.crowdsec.net/docs/next/cscli/cscli_metrics.md): cscli metrics - [cscli notifications inspect](https://docs.crowdsec.net/docs/next/cscli/cscli_notifications_inspect.md): cscli notifications inspect - [cscli notifications list](https://docs.crowdsec.net/docs/next/cscli/cscli_notifications_list.md): cscli notifications list - [cscli notifications reinject](https://docs.crowdsec.net/docs/next/cscli/cscli_notifications_reinject.md): cscli notifications reinject - [cscli notifications test](https://docs.crowdsec.net/docs/next/cscli/cscli_notifications_test.md): cscli notifications test - [cscli notifications](https://docs.crowdsec.net/docs/next/cscli/cscli_notifications.md): cscli notifications - [cscli papi status](https://docs.crowdsec.net/docs/next/cscli/cscli_papi_status.md): cscli papi status - [cscli papi sync](https://docs.crowdsec.net/docs/next/cscli/cscli_papi_sync.md): cscli papi sync - [cscli papi](https://docs.crowdsec.net/docs/next/cscli/cscli_papi.md): cscli papi - [cscli parsers inspect](https://docs.crowdsec.net/docs/next/cscli/cscli_parsers_inspect.md): cscli parsers inspect - [cscli parsers install](https://docs.crowdsec.net/docs/next/cscli/cscli_parsers_install.md): cscli parsers install - [cscli parsers list](https://docs.crowdsec.net/docs/next/cscli/cscli_parsers_list.md): cscli parsers list - [cscli parsers remove](https://docs.crowdsec.net/docs/next/cscli/cscli_parsers_remove.md): cscli parsers remove - [cscli parsers upgrade](https://docs.crowdsec.net/docs/next/cscli/cscli_parsers_upgrade.md): cscli parsers upgrade - [cscli parsers](https://docs.crowdsec.net/docs/next/cscli/cscli_parsers.md): cscli parsers - [cscli postoverflows inspect](https://docs.crowdsec.net/docs/next/cscli/cscli_postoverflows_inspect.md): cscli postoverflows inspect - [cscli postoverflows install](https://docs.crowdsec.net/docs/next/cscli/cscli_postoverflows_install.md): cscli postoverflows install - [cscli postoverflows list](https://docs.crowdsec.net/docs/next/cscli/cscli_postoverflows_list.md): cscli postoverflows list - [cscli postoverflows remove](https://docs.crowdsec.net/docs/next/cscli/cscli_postoverflows_remove.md): cscli postoverflows remove - [cscli postoverflows upgrade](https://docs.crowdsec.net/docs/next/cscli/cscli_postoverflows_upgrade.md): cscli postoverflows upgrade - [cscli postoverflows](https://docs.crowdsec.net/docs/next/cscli/cscli_postoverflows.md): cscli postoverflows - [cscli scenarios inspect](https://docs.crowdsec.net/docs/next/cscli/cscli_scenarios_inspect.md): cscli scenarios inspect - [cscli scenarios install](https://docs.crowdsec.net/docs/next/cscli/cscli_scenarios_install.md): cscli scenarios install - [cscli scenarios list](https://docs.crowdsec.net/docs/next/cscli/cscli_scenarios_list.md): cscli scenarios list - [cscli scenarios remove](https://docs.crowdsec.net/docs/next/cscli/cscli_scenarios_remove.md): cscli scenarios remove - [cscli scenarios upgrade](https://docs.crowdsec.net/docs/next/cscli/cscli_scenarios_upgrade.md): cscli scenarios upgrade - [cscli scenarios](https://docs.crowdsec.net/docs/next/cscli/cscli_scenarios.md): cscli scenarios - [cscli setup detect](https://docs.crowdsec.net/docs/next/cscli/cscli_setup_detect.md): cscli setup detect - [cscli setup install-acquisition](https://docs.crowdsec.net/docs/next/cscli/cscli_setup_install-acquisition.md): cscli setup install-acquisition - [cscli setup install-hub](https://docs.crowdsec.net/docs/next/cscli/cscli_setup_install-hub.md): cscli setup install-hub - [cscli setup interactive](https://docs.crowdsec.net/docs/next/cscli/cscli_setup_interactive.md): cscli setup interactive - [cscli setup unattended](https://docs.crowdsec.net/docs/next/cscli/cscli_setup_unattended.md): cscli setup unattended - [cscli setup validate](https://docs.crowdsec.net/docs/next/cscli/cscli_setup_validate.md): cscli setup validate - [cscli setup](https://docs.crowdsec.net/docs/next/cscli/cscli_setup.md): cscli setup - [cscli simulation disable](https://docs.crowdsec.net/docs/next/cscli/cscli_simulation_disable.md): cscli simulation disable - [cscli simulation enable](https://docs.crowdsec.net/docs/next/cscli/cscli_simulation_enable.md): cscli simulation enable - [cscli simulation status](https://docs.crowdsec.net/docs/next/cscli/cscli_simulation_status.md): cscli simulation status - [cscli simulation](https://docs.crowdsec.net/docs/next/cscli/cscli_simulation.md): cscli simulation - [cscli support dump](https://docs.crowdsec.net/docs/next/cscli/cscli_support_dump.md): cscli support dump - [cscli support](https://docs.crowdsec.net/docs/next/cscli/cscli_support.md): cscli support - [cscli version](https://docs.crowdsec.net/docs/next/cscli/cscli_version.md): cscli version - [Alert](https://docs.crowdsec.net/docs/next/expr/alert.md): An Alert is the runtime representation of a bucket overflow. - [CTI helpers](https://docs.crowdsec.net/docs/next/expr/cti_helpers.md): CTI Helpers - [Decision](https://docs.crowdsec.net/docs/next/expr/decision.md): A Decision is the runtime representation of a bucket overflow consequence : an action being taken against an IP, a Range, a User etc. - [Introduction](https://docs.crowdsec.net/docs/next/expr/event.md): An Event is the runtime representation of an item being processed by crowdsec. It can represent: - [File helpers](https://docs.crowdsec.net/docs/next/expr/file_helpers.md): File helpers do not load the file into memory, but rather use a cache on initial startup to avoid loading the same file multiple times. Please see the data property on how to configure the Security Engine to load the file. - [Introduction](https://docs.crowdsec.net/docs/next/expr/intro.md): antonmedv/expr - Expression evaluation engine for Go: fast, non-Turing complete, dynamic typing, static typing - [IP helpers](https://docs.crowdsec.net/docs/next/expr/ip_helpers.md): IP Helpers - [JSON/XML/KV Helpers](https://docs.crowdsec.net/docs/next/expr/json_helpers.md): JSON Helpers - [LibInjection helpers](https://docs.crowdsec.net/docs/next/expr/libinjection_helpers.md): LibInjectionIsSQLI(str) bool - [Other helpers](https://docs.crowdsec.net/docs/next/expr/other_helpers.md): Time Helpers - [Strings helpers](https://docs.crowdsec.net/docs/next/expr/strings_helpers.md): Strings - [Crowdsec Tour](https://docs.crowdsec.net/docs/next/getting_started/crowdsec_tour.md): List installed configurations - [OPNsense plugin](https://docs.crowdsec.net/docs/next/getting_started/install_crowdsec_opnsense.md): The CrowdSec plugin for OPNsense is installed from the official repositories. - [pfSense](https://docs.crowdsec.net/docs/next/getting_started/install_crowdsec_pfsense.md): The CrowdSec package for pfSense requires some manual installation steps, as it is not yet available in the official repositories. - [Drupal Plugin](https://docs.crowdsec.net/docs/next/getting_started/install_drupal_plugin.md): The CrowdSec Drupal plugin provides real-time protection against malicious actors by integrating your Drupal site with the CrowdSec security network. - [Using our PHP SDK](https://docs.crowdsec.net/docs/next/getting_started/install_php_softagent.md): With the help of our SDK, If you are developing security software that detects misbehaviors and does remediation on IPs, you can send signals about your detections and benefit from the community blocklist. - [Using our Python SDK](https://docs.crowdsec.net/docs/next/getting_started/install_pyagent.md): This python SDK is designed for signal sharing partners to send signals and benefit from the community blocklist. - [Compile from source](https://docs.crowdsec.net/docs/next/getting_started/install_source.md): This is only for advanced users that wish to compile their own software. If you are not comfortable with this, please use the official packages - [Windows](https://docs.crowdsec.net/docs/next/getting_started/install_windows.md): Security Engine Installation - [introduction to the SDKs](https://docs.crowdsec.net/docs/next/getting_started/sdk_intro.md): CrowdSec offers lightweight SDKs for Python and PHP to help developers seamlessly integrate signal sharing capabilities into their security tools, platforms, or services. - [Security Engine Overview](https://docs.crowdsec.net/docs/next/intro.md): The CrowdSec Security Engine is an open-source, lightweight security engine that detects and blocks malicious actors. It analyzes logs and HTTP requests using behavior-based patterns called scenarios. - [Authentication](https://docs.crowdsec.net/docs/next/local_api/authentication.md): Authentication - [For Remediation Components](https://docs.crowdsec.net/docs/next/local_api/bouncers.md): This page explains how to interact with the local API exposed by the Security Engine. - [AllowLists](https://docs.crowdsec.net/docs/next/local_api/centralized_allowlists.md): The AllowLists feature in CrowdSec lets you manage IP-based allowlists at the LAPI level. It affects local decisions, blocklist pulls, and AppSec (WAF) processing, giving you more flexibility to trust specific IPs while keeping CrowdSec security controls in place. - [Configuration](https://docs.crowdsec.net/docs/next/local_api/configuration.md): Configuration - [Databases](https://docs.crowdsec.net/docs/next/local_api/database.md): By default, the CrowdSec Local API use SQLite as backend storage. In case you expect a lot of traffic on your Local API, you should use MySQL, MariaDB or PostgreSQL. - [Local API](https://docs.crowdsec.net/docs/next/local_api/intro.md): The Local API (LAPI) is one of the core components of the Security Engine to : - [Elasticsearch](https://docs.crowdsec.net/docs/next/local_api/notification_plugins/elastic.md): CrowdSec can forward Alerts to Elasticsearch using the HTTP plugin. This guide will show you how to configure the plugin to send alerts to your Elasticsearch instance. - [Email Plugin](https://docs.crowdsec.net/docs/next/local_api/notification_plugins/email.md): The Email plugin is shipped by default with CrowdSec. The following guide shows how to configure, test and enable it. - [File Plugin](https://docs.crowdsec.net/docs/next/local_api/notification_plugins/file.md): The File plugin is by default shipped with your CrowdSec installation and allows you to write Alerts to an external file that can be monitored by external applications. The following guide shows how to configure, test and enable it. - [Gotify](https://docs.crowdsec.net/docs/next/local_api/notification_plugins/gotify.md): CrowdSec can forward Alerts to Gotify via the HTTP plugin. This guide will show you how to configure the HTTP plugin to send alerts to your Gotify instance. - [HTTP Plugin](https://docs.crowdsec.net/docs/next/local_api/notification_plugins/http.md): The HTTP plugin is by default shipped with your CrowdSec installation. The following guide shows how to configure, test and enable it. - [Introduction](https://docs.crowdsec.net/docs/next/local_api/notification_plugins/intro.md): Goal - [Sentinel Plugin](https://docs.crowdsec.net/docs/next/local_api/notification_plugins/sentinel.md): The sentinel plugin is by default shipped with your CrowdSec installation. The following guide shows how to configure, test and enable it. - [Slack Plugin](https://docs.crowdsec.net/docs/next/local_api/notification_plugins/slack.md): The slack plugin is by default shipped with your CrowdSec installation. The following guide shows how to enable it. - [Splunk Plugin](https://docs.crowdsec.net/docs/next/local_api/notification_plugins/splunk.md): The splunk plugin is by default shipped with your CrowdSec installation. The following guide shows how to enable it. - [Microsoft Teams](https://docs.crowdsec.net/docs/next/local_api/notification_plugins/teams.md): The following guide shows how to configure, test and enable HTTP plugin to forward Alerts to Microsoft Teams. - [Telegram](https://docs.crowdsec.net/docs/next/local_api/notification_plugins/telegram.md): CrowdSec can forward Alerts to telegram via the HTTP plugin. This guide will show you how to configure the HTTP plugin to send alerts to your Telegram chat. - [Templating helpers](https://docs.crowdsec.net/docs/next/local_api/notification_plugins/template_helpers.md): In order to simplify some operation in the templates, we provide some custom helpers. - [Testing notification plugins](https://docs.crowdsec.net/docs/next/local_api/notification_plugins/testing.md): This guide walks through practical ways to validate a notification plugin, from config checks to end-to-end delivery. - [Writing Plugin in Go](https://docs.crowdsec.net/docs/next/local_api/notification_plugins/writing_your_own_plugin.md): In this guide we will implement a plugin in Go, which dispatches an email with specificied body on receiving alerts. - [Captcha](https://docs.crowdsec.net/docs/next/local_api/profiles/captcha_profile.md): Here is an example of a profile that provides users with a captcha challenge when they trigger a HTTP scenario. - [CrowdSec CTI](https://docs.crowdsec.net/docs/next/local_api/profiles/cti_profile.md): Here is an example of a profile that uses the CTI module. - [Format](https://docs.crowdsec.net/docs/next/local_api/profiles/format.md): Profile configuration example - [Introduction](https://docs.crowdsec.net/docs/next/local_api/profiles/intro.md): The profiles configuration allows users to configure which kind of remediation should be applied when a scenario is triggered. The profile can be used to: - [PID](https://docs.crowdsec.net/docs/next/local_api/profiles/pid_profile.md): We use PID to refer to a process ID based events. - [TLS Authentication](https://docs.crowdsec.net/docs/next/local_api/tls_auth.md): Overview - [Alert Context](https://docs.crowdsec.net/docs/next/log_processor/alert_context/intro.md): Introduction - [Format](https://docs.crowdsec.net/docs/next/log_processor/collections/format.md): Collection configuration example - [Introduction](https://docs.crowdsec.net/docs/next/log_processor/collections/intro.md): Collections are bundles of detection content that you install together to support a given service or use case (for example: NGINX, SSH, WordPress, or generic HTTP attacks). - [Application Security Component](https://docs.crowdsec.net/docs/next/log_processor/data_sources/appsec.md): This module allows you to enable the Application Security Component as a data source. - [AWS Cloudwatch](https://docs.crowdsec.net/docs/next/log_processor/data_sources/cloudwatch.md): This module allows the Security Engine to acquire logs from AWS's cloudwatch service, in one-shot and streaming mode. - [Docker](https://docs.crowdsec.net/docs/next/log_processor/data_sources/docker.md): This module allows the Security Engine to acquire logs from running containers, in one-shot and streaming mode. - [File(s)](https://docs.crowdsec.net/docs/next/log_processor/data_sources/file.md): This module allows the Security Engine to acquire logs from text files (in one-shot and streaming mode), and GZ files in one-shot mode. - [HTTP](https://docs.crowdsec.net/docs/next/log_processor/data_sources/http.md): This module allows the Security Engine to acquire logs from an HTTP endpoint. - [Acquisition Datasources](https://docs.crowdsec.net/docs/next/log_processor/data_sources/intro.md): To monitor applications, the Security Engine needs to read logs. - [Journald](https://docs.crowdsec.net/docs/next/log_processor/data_sources/journald.md): This module allows the Security Engine to acquire logs from journalctl files in one-shot and streaming mode. - [Kafka](https://docs.crowdsec.net/docs/next/log_processor/data_sources/kafka.md): This module allows the Security Engine to acquire logs from a kafka topic. - [AWS Kinesis Stream](https://docs.crowdsec.net/docs/next/log_processor/data_sources/kinesis.md): This module allows the Security Engine to acquire logs from a Kinesis stream. - [Kubernetes Audit](https://docs.crowdsec.net/docs/next/log_processor/data_sources/kubernetes_audit.md): This module allows the Security Engine to expose an HTTP server that can be used by a Kubernetes cluster to send its audit logs. - [Kubernetes](https://docs.crowdsec.net/docs/next/log_processor/data_sources/kubernetes.md): This module allows the Security Engine to stream container logs from pods running in a Kubernetes cluster via the Kubernetes API. It only operates in streaming (tail) mode: when a pod matching the selector starts or restarts, the datasource follows every container's stdout/stderr until the pod disappears. CrowdSec always attempts to authenticate using the in-cluster service-account first (leveraging rest.InClusterConfig) and only if that fails will it fall back to kubeconfig/explicit overrides. - [Loki](https://docs.crowdsec.net/docs/next/log_processor/data_sources/loki.md): This module allows the Security Engine to acquire logs from loki query. - [AWS S3](https://docs.crowdsec.net/docs/next/log_processor/data_sources/s3.md): This module allows the Security Engine to acquire logs from a S3 bucket. - [Syslog Server](https://docs.crowdsec.net/docs/next/log_processor/data_sources/syslog.md): This module allows the Security Engine to expose a syslog server, and ingest logs directly from another syslog server (or any software that knows how to forward logs with syslog). - [Monitoring](https://docs.crowdsec.net/docs/next/log_processor/data_sources/troubleshoot.md): The prometheus instrumentation exposes metrics about acquisition and data sources. - [VictoriaLogs](https://docs.crowdsec.net/docs/next/log_processor/data_sources/victorialogs.md): This module allows the Security Engine to acquire logs from VictoriaLogs query. - [Windows Event Log](https://docs.crowdsec.net/docs/next/log_processor/data_sources/windows_evt_log.md): This module allows the Security Engine to acquire logs from the Windows Event Log. - [Introduction](https://docs.crowdsec.net/docs/next/log_processor/intro.md): The Log Processor is a core component of the Security Engine. It: - [Creating parsers](https://docs.crowdsec.net/docs/next/log_processor/parsers/create.md): Foreword - [Enrichers](https://docs.crowdsec.net/docs/next/log_processor/parsers/enricher.md): Enrichers are parsers that can rely on external methods to provide extra contextual information to the event. The enrichers are usually in the s02-enrich stage (after most of the parsing happened). - [Format](https://docs.crowdsec.net/docs/next/log_processor/parsers/format.md): Parser configuration example - [Introduction](https://docs.crowdsec.net/docs/next/log_processor/parsers/intro.md): Parser - [Patterns documentation](https://docs.crowdsec.net/docs/next/log_processor/parsers/patterns.md): You will find here a generated documentation of all the patterns loaded by crowdsec. - [Creating scenarios](https://docs.crowdsec.net/docs/next/log_processor/scenarios/create.md): All the examples assume that you have read the Creating parsers documentation. - [Debugging](https://docs.crowdsec.net/docs/next/log_processor/scenarios/debug.md) - [Deploy](https://docs.crowdsec.net/docs/next/log_processor/scenarios/deploy.md): This documentation mostly focus on installation of custom scenarios. Scenarios from the hub should be installed as a part of the collection, by using cscli collections install . Installing scenarios directly with cscli scenario install might lead to unexpected results because of missing dependencies (ie. parsers, enrichers, post-overflows etc.) - [Format](https://docs.crowdsec.net/docs/next/log_processor/scenarios/format.md): Scenario configuration example - [Introduction](https://docs.crowdsec.net/docs/next/log_processor/scenarios/intro.md): Scenarios are YAML files that allow to detect a specific behavior, usually an attack. - [Simulation](https://docs.crowdsec.net/docs/next/log_processor/scenarios/simulation.md): cscli simulation allows to manage a list of scenarios that have their remediation "simulated" : they won't be effective (but will still be showed by cscli decisions list). This configuration file is present in /etc/crowdsec/simulation.yaml and is handled by the agent. - [Syntax](https://docs.crowdsec.net/docs/next/log_processor/service-discovery-setup/detect-yaml.md): A minimal detection file is a YAML map with a top‐level detect: key. - [Service Discovery](https://docs.crowdsec.net/docs/next/log_processor/service-discovery-setup/intro.md): The goals of service discovery are to automatically: - [Expression Helpers Reference](https://docs.crowdsec.net/docs/next/log_processor/service-discovery-setup/setup-expr-helpers.md): Various helpers are available for use in the detect.yaml file to determine how crowdsec should be configured. - [CAPI](https://docs.crowdsec.net/docs/next/log_processor/whitelist/create_capi.md): This option is deprecated. - [Expression](https://docs.crowdsec.net/docs/next/log_processor/whitelist/create_expr.md): Expression-based whitelists let you discard events during parsing using expr expressions. This is the most flexible option for whitelisting patterns such as HTTP paths, user agents, status codes, or any mix of parsed fields. - [FQDN](https://docs.crowdsec.net/docs/next/log_processor/whitelist/create_fqdn.md): FQDN lookups can cause latency. We recommend using them only in the Postoverflow whitelist stage. See introduction for your OS-specific path. - [IP / CIDR](https://docs.crowdsec.net/docs/next/log_processor/whitelist/create_ip.md): For IP and CIDR-based allowlisting, we recommend using Centralized AllowLists instead. AllowLists are managed at the LAPI level, making them easier to maintain and they also affect blocklist pulls. The parser whitelists documented below are more suited for complex expressions based on log elements. - [LAPI](https://docs.crowdsec.net/docs/next/log_processor/whitelist/create_lapi.md): This approach is deprecated. Please use Centralized AllowLists instead. - [Postoverflow](https://docs.crowdsec.net/docs/next/log_processor/whitelist/create_postoverflow.md): Whitelist in PostOverflows - [Format](https://docs.crowdsec.net/docs/next/log_processor/whitelist/format.md): Whitelist configuration example - [Introduction](https://docs.crowdsec.net/docs/next/log_processor/whitelist/intro.md): For simple IP and CIDR-based allowlisting, we recommend using Centralized AllowLists instead of parser whitelists. AllowLists are easier to manage and also affect blocklist pulls. The parser whitelists documented below are best suited for complex expression-based rules that rely on log elements. - [Crowdsec Metrics](https://docs.crowdsec.net/docs/next/observability/cscli.md): Crowdsec is instrumented using prometheus to provide detailed metrics and tracability about what is going on. - [Introduction](https://docs.crowdsec.net/docs/next/observability/intro.md): Observability in security software is crucial, especially when this software might take important decision such as blocking IP addresses. - [Pprof](https://docs.crowdsec.net/docs/next/observability/pprof.md): CrowdSec exposes a pprof endpoint on http6060/debug/pprof. It provides real-time state of the application. It is useful for finding issues like memory leaks, excessive CPU usage etc. - [Prometheus](https://docs.crowdsec.net/docs/next/observability/prometheus.md): CrowdSec can expose a prometheus endpoint for collection (on http6060/metrics by default). You can edit the listenaddr in config.yaml to allow an external Prometheus to scrape the metrics. - [Usage Metrics](https://docs.crowdsec.net/docs/next/observability/usage_metrics.md): Usage metrics require at least CrowdSec v1.6.3 ## u ### beta_program About the Beta Program - [Beta Program](https://docs.crowdsec.net/u/beta_program.md): About the Beta Program ### blocklists - [Getting Started](https://docs.crowdsec.net/u/blocklists/getting_started.md): New to CrowdSec blocklists? Read the Introduction first to understand how they work and the available tiers. Then choose one of the two paths below β€” most people pick one or the other, not both. - [Introduction](https://docs.crowdsec.net/u/blocklists/intro.md): Objective - [Security Engine](https://docs.crowdsec.net/u/blocklists/security_engine.md): This page is used to reference other pages into a single guide. It is not meant to be used as a standalone page. ### bouncers - [Protect Apache with CrowdSec IP Blocking](https://docs.crowdsec.net/u/bouncers/apache_bouncer.md): = 1.7.0) and install the appropriate log sources and Collections. - [CrowdSec Blocklists](https://docs.crowdsec.net/u/getting_started/post_installation/console_blocklists.md): In the community edition of CrowdSec, you can subscribe to three blocklists for proactive protection against known malicious sources. - [CrowdSec Hub](https://docs.crowdsec.net/u/getting_started/post_installation/console_hub.md): The CrowdSec Hub is a repository of ready-to-use configuration files. - [Enroll your Security Engine in CrowdSec Console](https://docs.crowdsec.net/u/getting_started/post_installation/console.md): The CrowdSec Console is a web interface providing management and extra features for CrowdSec Products. - [CrowdSec Metrics](https://docs.crowdsec.net/u/getting_started/post_installation/metrics.md): CrowdSec is instrumented with Prometheus to provide detailed metrics and traceability. - [Profiles](https://docs.crowdsec.net/u/getting_started/post_installation/profiles.md): Profiles are a list of rules that determine what actions CrowdSec takes after a detection. This can be as simple as banning an IP, or as complex as scaling ban duration based on prior detections. - [Troubleshoot](https://docs.crowdsec.net/u/getting_started/post_installation/troubleshoot.md): This section helps you resolve common installation issues. If you need more depth, see the full troubleshooting documentation. - [Whitelists](https://docs.crowdsec.net/u/getting_started/post_installation/whitelists.md): Whitelists tell CrowdSec to ignore certain events or IP addresses. This is useful if you have a static IP you trust, or a service that could generate false triggers (for example, a site that loads many thumbnails, images, or fonts). ### integrations - [Checkpoint](https://docs.crowdsec.net/u/integrations/checkpoint.md):