You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Welcome to the interactive health check of your CrowdSec setup.
15
+
We'll guide you through a series of tests to ensure that your Security Stack is fully functional and ready to protect your services: **Detecting**, **Threat Sharing** and **Remediating**.
16
+
This guide covers cases of protecting common services such as web servers (HTTP) and SSH.
17
+
18
+
Via a **top-down approach** we'll test the end goal of components, and then dive into detailed troubleshooting if needed.
19
+
20
+
This health check is divided into three main sections:
14
21
-[**📡 Detecting**](#-detection-checks) behaviors on your services.
15
-
-**🔗 Connectivity** with CrowdSec network to retrieve threats lists.
16
-
-**🛡️ Protecting** your services by remediating alerts automatically with bouncers.
22
+
-[**🔗 Connectivity**](#-crowdsec-connectivity-checks) with CrowdSec network to retrieve the community blocklist.
23
+
-[**🛡️ Protecting**](#-remediation-checks) your services by remediating alerts automatically with bouncers.
17
24
18
-
If the initial checks are not conclusive, we'll dive into a comprehensive troubleshooting for each section.
25
+
* * *
19
26
20
27
## 📡 Detection checks
21
28
@@ -50,7 +57,7 @@ Notes:
50
57
Let's trigger the `crowdsecurity/ssh-generic-test` dummy scenario by logging in to your server via SSH with a specific user.
51
58
52
59
1️⃣ Try to authenticate to your server via SSH using the following user: `crowdsec-test-NtktlJHV4TfBSK3wvlhiOBnl`.
2️⃣ You should see an alert for the scenario `crowdsecurity/ssh-generic-test`
56
63
@@ -98,7 +105,7 @@ If not, check the troubleshooting section below
98
105
**This troubleshooting section will help you identify the issue and guide you through the necessary steps to fix it.**
99
106
100
107
<details>
101
-
<summary>Acquisition metrics check: are your logs read and parsed?</summary>
108
+
<summary>Are your logs being properly read and parsed?</summary>
102
109
103
110
The acquisition and parsing aspect of CrowdSec is crucial, as it tells The Security Engine which logs to read and how to parse them. You can setup multiple datasources (files, syslog, etc.), for more details you can refer to the [datasources documentation](https://doc.crowdsec.net/docs/next/log_processor/data_sources/intro).
104
111
@@ -126,7 +133,7 @@ If not, check the troubleshooting section below
126
133
<summary>Acquisition Troubleshooting: are your logs properly declared as datasources</summary>
127
134
128
135
Your acquisition configuration is located in the `crowdsec` directory under `acquis.yaml` or `acquis.d/anyName.yaml`.
129
-
The crowdsec directory changes depending on your OS and installation method, for example, on Debian like OS it is usually located in `/etc/crowdsec/`.
136
+
The CrowdSec directory changes depending on your OS and installation method, for example, on Debian like OS it is usually located in `/etc/crowdsec/`.
130
137
131
138
You may want to check your current acquisition configuration or [add a new acquisition file](https://doc.crowdsec.net/u/getting_started/post_installation/acquisition_new).
132
139
- Check that the datasource is properly setup: file path or correct port for syslog server...
@@ -249,7 +256,7 @@ or
249
256
2️⃣ Create a ban decision for your public IP address with a TTL of 1 minute:
3️⃣ Try to access your service from the same public IP address. You should be blocked by the bouncer.
259
+
3️⃣ Try to access your service (website, api ...) from the same public IP address.\> You should be blocked by the bouncer.
253
260
254
261
4️⃣ Wait for 1 minute, then check the decisions list to see if the decision has been removed
255
262
@@ -287,4 +294,8 @@ You might want to continue to the next recommended steps:
287
294
* Understanding the impact of profiles on detection and remediation.)
288
295
289
296
</details>
290
-
</details>
297
+
</details>
298
+
299
+
## Your feedback is important!
300
+
301
+
If you have any suggestions or improvements for this health check, please let us know by opening an issue on our [GitHub repository](https://github.com/crowdsecurity/crowdsec-docs/issues/new) or on our [discord](https://discord.gg/wGN7ShmEE8)
0 commit comments