You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: crowdsec-docs/unversioned/user_guides/interactive_se_install/02_parsers_scenarios copy.mdx
+59Lines changed: 59 additions & 0 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -15,3 +15,62 @@ blabla
15
15
16
16
## Choosing what you need to protect your services
17
17
18
+
To detect malicious behaviors targeting your services the (CrowdSec) Security Engine will need t be able to parse your services' logs and apply detection rules on them AKA **Scenarios**.
19
+
Our parsers and Scenarios are available on the [CrowdSec Hub](https://hub.crowdsec.net/), and are regrouped into **Collections** to make it more convenient to install as a whole.
20
+
Let's see what parsers and Scenarios you need to install to protect your services, and how to install them.
21
+
22
+
### Instructions
23
+
24
+
A typical use case would be to want to protect a web server, having an open ssh access.
25
+
You'd want parsers for your webserver logs (e.g. Nginx, Apache) and for your SSH logs, as well as the corresponding Scenarios to detect malicious behaviors.
26
+
In the case of NGINX being your reverse proxy you would want the NGINX parser AND all the scenarios related to protecting HTTP:
27
+
The [nginx collection](https://app.crowdsec.net/hub/author/crowdsecurity/collections/nginx) would be one you want to install.
28
+
- It embeds the NGINX parser, as well as the Base HTTP scenarios collection and an additionnal NGINX specific scenario triggerring on nginx request limit exceeded.
29
+
- You can install it with the following command:
30
+
```bash
31
+
crowdsec collections install crowdsecurity/nginx
32
+
```
33
+
34
+
To protect your SSH accessed Linux server you would want the [linux collection](https://app.crowdsec.net/hub/author/crowdsecurity/collections/linux) which includes the Linux parser and a set of scenarios to detect malicious SSH behaviors.
35
+
- You can install it with the following command:
36
+
```bash
37
+
crowdsec collections install crowdsecurity/linux
38
+
```
39
+
40
+
One way you cna proceed for your own usecase is:
41
+
1. look for a logparser specific for your service in the [parser's section of the hub](https://app.crowdsec.net/hub/log-parsers)
42
+
2. Once you have found the parser you need, check if there is a collection with the same name. If so, chose the colleciton it will be pre-packed with reommanded scenarios.
43
+
3. You can browse other collections too or individual scenarios you might want to install.
44
+
- Note that you're also able to [create your own scenarios if needed](https://doc.crowdsec.net/docs/next/log_processor/parsers/intro).
45
+
4. Run the install you can find in the corresponding hub page
46
+
5. Keep the hub page in mind there are usefull instrucitons to the next part of this guide.
47
+
48
+
### Verification
49
+
50
+
Let's check the installation of the parsers and scenarios was successfull.
51
+
After installing them you should restart the CrowdSec service to ensure the new parsers and scenarios are loaded:
52
+
```bash
53
+
sudo systemctl restart crowdsec
54
+
```
55
+
56
+
#### List of installed parsers and scenarios
57
+
58
+
> [] Check Collections, parsers and scenarios are installed
59
+
```bash
60
+
cscli collections list
61
+
cscli parsers list
62
+
cscli scenarios list
63
+
```
64
+
- You'll be able to verify that the parsers and scenarios you installed are listed in the output of these commands.
65
+
66
+
> [] Check scenarios are showing up in the console
67
+
When clicking on the "Scenarios" part of your [Security engine tile in the CrowdSec console](https://app.crowdsec.net/security-engines), you should see the scenarios you installed listed there.
68
+
The tile itself should show you the count of scenarios that are installed on your Security Engine.
69
+
70
+
### Troubleshooting
71
+
72
+
<details>
73
+
<summary>Missing Scenarios</summary>
74
+
75
+
@seb@laurence any reason why a scenario or colleciton would not install ? folder issue ? config ?
0 commit comments