Skip to content

Commit 741677e

Browse files
author
jdv
committed
section 2 firs draft
1 parent fbc76ec commit 741677e

3 files changed

Lines changed: 100 additions & 0 deletions

File tree

crowdsec-docs/unversioned/user_guides/interactive_se_install/02_parsers_scenarios copy.mdx

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,3 +15,62 @@ blabla
1515

1616
## Choosing what you need to protect your services
1717

18+
To detect malicious behaviors targeting your services the (CrowdSec) Security Engine will need t be able to parse your services' logs and apply detection rules on them AKA **Scenarios**.
19+
Our parsers and Scenarios are available on the [CrowdSec Hub](https://hub.crowdsec.net/), and are regrouped into **Collections** to make it more convenient to install as a whole.
20+
Let's see what parsers and Scenarios you need to install to protect your services, and how to install them.
21+
22+
### Instructions
23+
24+
A typical use case would be to want to protect a web server, having an open ssh access.
25+
You'd want parsers for your webserver logs (e.g. Nginx, Apache) and for your SSH logs, as well as the corresponding Scenarios to detect malicious behaviors.
26+
In the case of NGINX being your reverse proxy you would want the NGINX parser AND all the scenarios related to protecting HTTP:
27+
The [nginx collection](https://app.crowdsec.net/hub/author/crowdsecurity/collections/nginx) would be one you want to install.
28+
- It embeds the NGINX parser, as well as the Base HTTP scenarios collection and an additionnal NGINX specific scenario triggerring on nginx request limit exceeded.
29+
- You can install it with the following command:
30+
```bash
31+
crowdsec collections install crowdsecurity/nginx
32+
```
33+
34+
To protect your SSH accessed Linux server you would want the [linux collection](https://app.crowdsec.net/hub/author/crowdsecurity/collections/linux) which includes the Linux parser and a set of scenarios to detect malicious SSH behaviors.
35+
- You can install it with the following command:
36+
```bash
37+
crowdsec collections install crowdsecurity/linux
38+
```
39+
40+
One way you cna proceed for your own usecase is:
41+
1. look for a logparser specific for your service in the [parser's section of the hub](https://app.crowdsec.net/hub/log-parsers)
42+
2. Once you have found the parser you need, check if there is a collection with the same name. If so, chose the colleciton it will be pre-packed with reommanded scenarios.
43+
3. You can browse other collections too or individual scenarios you might want to install.
44+
- Note that you're also able to [create your own scenarios if needed](https://doc.crowdsec.net/docs/next/log_processor/parsers/intro).
45+
4. Run the install you can find in the corresponding hub page
46+
5. Keep the hub page in mind there are usefull instrucitons to the next part of this guide.
47+
48+
### Verification
49+
50+
Let's check the installation of the parsers and scenarios was successfull.
51+
After installing them you should restart the CrowdSec service to ensure the new parsers and scenarios are loaded:
52+
```bash
53+
sudo systemctl restart crowdsec
54+
```
55+
56+
#### List of installed parsers and scenarios
57+
58+
> [ ] Check Collections, parsers and scenarios are installed
59+
```bash
60+
cscli collections list
61+
cscli parsers list
62+
cscli scenarios list
63+
```
64+
- You'll be able to verify that the parsers and scenarios you installed are listed in the output of these commands.
65+
66+
> [ ] Check scenarios are showing up in the console
67+
When clicking on the "Scenarios" part of your [Security engine tile in the CrowdSec console](https://app.crowdsec.net/security-engines), you should see the scenarios you installed listed there.
68+
The tile itself should show you the count of scenarios that are installed on your Security Engine.
69+
70+
### Troubleshooting
71+
72+
<details>
73+
<summary>Missing Scenarios</summary>
74+
75+
@seb @laurence any reason why a scenario or colleciton would not install ? folder issue ? config ?
76+
</details>

crowdsec-docs/unversioned/user_guides/interactive_se_install/03_acquisition copy.mdx

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,3 +15,24 @@ blabla
1515

1616
## Setting up acquisition datasources for detection
1717

18+
19+
### Instructions
20+
...
21+
22+
### Verification
23+
24+
Let's check ...
25+
26+
#### CrowdSec installation health
27+
28+
> [ ] Check ...
29+
30+
```bash
31+
...
32+
```
33+
- You should see ...
34+
- ...
35+
36+
37+
38+
### Troubleshooting

crowdsec-docs/unversioned/user_guides/interactive_se_install/04_remediation.mdx

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,3 +14,23 @@ blabla
1414

1515
## Choosing and testing a remediation component
1616

17+
### Instructions
18+
...
19+
20+
### Verification
21+
22+
Let's check ...
23+
24+
#### CrowdSec installation health
25+
26+
> [ ] Check ...
27+
28+
```bash
29+
...
30+
```
31+
- You should see ...
32+
- ...
33+
34+
35+
36+
### Troubleshooting

0 commit comments

Comments
 (0)