You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: crowdsec-docs/docs/appsec/quickstart/haproxy_spoa.mdx
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -13,7 +13,7 @@ Make sure the following are already done on the machine running HAProxy (each is
13
13
14
14
1.**CrowdSec Security Engine** installed and running — see the [Linux quickstart](/u/getting_started/installation/linux).
15
15
2.**HAProxy** already running and proxying your application(s).
16
-
3.**HAProxy SPOA bouncer** (`crowdsec-haproxy-spoa-bouncer`) installed and registered against the CrowdSec LAPI — see the [SPOA bouncer guide](/u/bouncers/haproxy_spoa).
16
+
3.**HAProxy SPOA bouncer** (`crowdsec-haproxy-spoa-bouncer`) installed and registered against the CrowdSec LAPI. See the [SPOA bouncer guide](/u/bouncers/haproxy_spoa).
Copy file name to clipboardExpand all lines: crowdsec-docs/docs/appsec/rules_deploy.md
+5-5Lines changed: 5 additions & 5 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -40,7 +40,7 @@ labels:
40
40
41
41
Once the rule behaves as expected, the remaining steps package it for CrowdSec, wire it into the acquisition pipeline, and test it end to end.
42
42
43
-
## Step 1 — Stage the Rule File
43
+
## Step 1 - Stage the Rule File
44
44
45
45
CrowdSec loads AppSec rules from `/etc/crowdsec/appsec-rules/`. Copy your YAML rule into that directory (create a `custom/` subfolder to keep things tidy if you manage several rules):
46
46
@@ -56,7 +56,7 @@ Make sure the `name` inside the rule file matches the file name convention you p
56
56
If you run CrowdSec in a container, copy the file into the volume that is mounted at `/etc/crowdsec/appsec-rules/` inside the container.
57
57
:::
58
58
59
-
## Step 2 — Create an AppSec Configuration
59
+
## Step 2 - Create an AppSec Configuration
60
60
61
61
An AppSec configuration lists which rules to load and how to handle matches. Create a new file under `/etc/crowdsec/appsec-configs/` that targets your custom rule:
62
62
@@ -73,7 +73,7 @@ Key points:
73
73
- `inband_rules`(and/or `outofband_rules`) accept glob patterns, so you can load multiple rules with a single entry such as `custom/block-*`.
74
74
- During the reload step CrowdSec validates the syntax; if anything is off, the reload fails and the service logs the parsing error.
75
75
76
-
## Step 3 — Reference the Configuration in the Acquisition File
76
+
## Step 3 - Reference the Configuration in the Acquisition File
77
77
78
78
The AppSec acquisition file (`/etc/crowdsec/acquis.d/appsec.yaml`) controls which configurations are active for the WAF component. Add your configuration to the `appsec_configs` list. Order matters: later entries override conflicting defaults such as `default_remediation`.
79
79
@@ -89,7 +89,7 @@ source: appsec
89
89
90
90
If you only want to run your custom configuration, remove other entries and keep the list with a single item.
91
91
92
-
## Step 4 — Reload CrowdSec and Validate the Load
92
+
## Step 4 - Reload CrowdSec and Validate the Load
93
93
94
94
Apply the changes by reloading the CrowdSec service:
The rule should appear as `enabled`, and the configuration should show up in the list. CrowdSec logs confirm the configuration was loaded without errors.
108
108
109
-
## Step 5 — Functional Test with `curl`
109
+
## Step 5 - Functional Test with `curl`
110
110
111
111
Trigger the behaviour your rule is meant to catch to ensure it blocks as expected. For the example rule, send a request with a non-numeric `user_id` value:
Copy file name to clipboardExpand all lines: crowdsec-docs/docs/getting_started/sdk_intro.mdx
+3-3Lines changed: 3 additions & 3 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -9,9 +9,9 @@ CrowdSec offers lightweight SDKs for Python and PHP to help developers seamlessl
9
9
By using these SDKs, you can report signals such as suspicious IP activity or confirmed attacks directly to the Central API (CAPI). In return, your users gain access to the CrowdSec Community Blocklist, a curated and constantly updated list of IPs involved in malicious behavior observed across the global CrowdSec network.
10
10
11
11
Why Integrate the SDK:
12
-
-**Simple Integration** — Add signal sharing with just a few lines of code
13
-
-**Community-Powered Protection** — Contributions help power our global threat intelligence network
14
-
-**Mutual Benefit** — Your platform shares valuable intelligence and gains stronger real-time protection in return
12
+
-**Simple Integration**: Add signal sharing with just a few lines of code
13
+
-**Community-Powered Protection**: Contributions help power our global threat intelligence network
14
+
-**Mutual Benefit**: Your platform shares valuable intelligence and gains stronger real-time protection in return
Copy file name to clipboardExpand all lines: crowdsec-docs/docs/intro.mdx
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -54,7 +54,7 @@ Under the hood, the Security Engine has various components:
54
54
- The [Local API](local_api/intro.md) acts as a middleman:
55
55
- Between the [Log Processors](/log_processor/intro.mdx) and the [Remediation Components](/u/bouncers/intro) which are in charge of enforcing decisions.
56
56
- And with the [Central API](/central_api/intro.md) to share alerts and receive blocklists.
57
-
- The [Remediation Components](/u/bouncers/intro) (also called bouncers) block malicious IPs at your chosen level—IpTables, firewalls, web servers, or reverse proxies. [See the full list on the CrowdSec Hub.](https://app.crowdsec.net/hub/remediation-components)
57
+
- The [Remediation Components](/u/bouncers/intro) (also called bouncers) block malicious IPs at your chosen level: IpTables, firewalls, web servers, or reverse proxies. [See the full list on the CrowdSec Hub.](https://app.crowdsec.net/hub/remediation-components)
desc: "Runs on your server, detects attack patterns in real time — immediately protected, and continuously updated with CrowdSec Community Blocklist.",
392
+
desc: "Runs on your server, detects attack patterns in real time. Immediately protected, and continuously updated with CrowdSec Community Blocklist.",
Copy file name to clipboardExpand all lines: crowdsec-docs/unversioned/bouncers/cloudflare-workers.mdx
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -293,7 +293,7 @@ The Remediation Component does the following:
293
293
294
294
:::info
295
295
Autonomous mode is ideal for users who prefer not to run a continuous process on their host/VM.
296
-
Combined with [Blocklist as a Service (BLaaS)](/u/integrations/remediationcomponent), this provides the minimal footprint deployment—only running setup/cleanup commands when needed.
296
+
Combined with [Blocklist as a Service (BLaaS)](/u/integrations/remediationcomponent), this provides the minimal footprint deployment, only running setup/cleanup commands when needed.
297
297
:::
298
298
299
299
In autonomous mode (enabled with the `-S` flag), the Remediation Component functions without requiring a continuously running Go daemon process. Instead:
0 commit comments