Skip to content

Commit b7a8042

Browse files
author
jdv
committed
ok, need to read from the start now
1 parent bd5b8d9 commit b7a8042

1 file changed

Lines changed: 21 additions & 10 deletions

File tree

crowdsec-docs/unversioned/getting_started/post_installation/health_check.mdx

Lines changed: 21 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -9,13 +9,20 @@ import CodeBlock from '@theme/CodeBlock';
99
import { CheckboxProvider, InteractiveCheckbox } from '@site/src/components/InteractiveCheckbox.js';
1010
import HierarchicalList from '@site/src/components/HierarchicalList.js';
1111

12-
Welcome to the interactive health check of your CrowdSec setup. We'll have a Top-Down approach:
13-
First, check the proper functioning of the Security Engine's finality:
12+
<small className="health-check-version">Health Check Version: 0.1.0</small>
13+
14+
Welcome to the interactive health check of your CrowdSec setup.
15+
We'll guide you through a series of tests to ensure that your Security Stack is fully functional and ready to protect your services: **Detecting**, **Threat Sharing** and **Remediating**.
16+
This guide covers cases of protecting common services such as web servers (HTTP) and SSH.
17+
18+
Via a **top-down approach** we'll test the end goal of components, and then dive into detailed troubleshooting if needed.
19+
20+
This health check is divided into three main sections:
1421
- [**📡 Detecting**](#-detection-checks) behaviors on your services.
15-
- **🔗 Connectivity** with CrowdSec network to retrieve threats lists.
16-
- **🛡️ Protecting** your services by remediating alerts automatically with bouncers.
22+
- [**🔗 Connectivity**](#-crowdsec-connectivity-checks) with CrowdSec network to retrieve the community blocklist.
23+
- [**🛡️ Protecting**](#-remediation-checks) your services by remediating alerts automatically with bouncers.
1724

18-
If the initial checks are not conclusive, we'll dive into a comprehensive troubleshooting for each section.
25+
* * *
1926

2027
## 📡 Detection checks
2128

@@ -50,7 +57,7 @@ Notes:
5057
Let's trigger the `crowdsecurity/ssh-generic-test` dummy scenario by logging in to your server via SSH with a specific user.
5158

5259
1️⃣ Try to authenticate to your server via SSH using the following user: `crowdsec-test-NtktlJHV4TfBSK3wvlhiOBnl`.
53-
<CodeBlock className="language-bash">ssh crowdsec-test-NtktlJHV4TfBSK3wvlhiOBnl@\<your-ip\></CodeBlock>
60+
<CodeBlock className="language-bash">ssh crowdsec-test-NtktlJHV4TfBSK3wvlhiOBnl@\<your-server-ip\></CodeBlock>
5461

5562
2️⃣ You should see an alert for the scenario `crowdsecurity/ssh-generic-test`
5663

@@ -98,7 +105,7 @@ If not, check the troubleshooting section below
98105
**This troubleshooting section will help you identify the issue and guide you through the necessary steps to fix it.**
99106

100107
<details>
101-
<summary>Acquisition metrics check: are your logs read and parsed?</summary>
108+
<summary>Are your logs being properly read and parsed?</summary>
102109

103110
The acquisition and parsing aspect of CrowdSec is crucial, as it tells The Security Engine which logs to read and how to parse them. You can setup multiple datasources (files, syslog, etc.), for more details you can refer to the [datasources documentation](https://doc.crowdsec.net/docs/next/log_processor/data_sources/intro).
104111

@@ -126,7 +133,7 @@ If not, check the troubleshooting section below
126133
<summary>Acquisition Troubleshooting: are your logs properly declared as datasources</summary>
127134

128135
Your acquisition configuration is located in the `crowdsec` directory under `acquis.yaml` or `acquis.d/anyName.yaml`.
129-
The crowdsec directory changes depending on your OS and installation method, for example, on Debian like OS it is usually located in `/etc/crowdsec/`.
136+
The CrowdSec directory changes depending on your OS and installation method, for example, on Debian like OS it is usually located in `/etc/crowdsec/`.
130137

131138
You may want to check your current acquisition configuration or [add a new acquisition file](https://doc.crowdsec.net/u/getting_started/post_installation/acquisition_new).
132139
- Check that the datasource is properly setup: file path or correct port for syslog server...
@@ -249,7 +256,7 @@ or
249256
2️⃣ Create a ban decision for your public IP address with a TTL of 1 minute:
250257
<CodeBlock className="language-bash">sudo cscli decisions add ban --ip \<your-public-ip\> --duration 1m --reason "CrowdSec remediation test"</CodeBlock>
251258

252-
3️⃣ Try to access your service from the same public IP address. You should be blocked by the bouncer.
259+
3️⃣ Try to access your service (website, api ...) from the same public IP address. \> You should be blocked by the bouncer.
253260

254261
4️⃣ Wait for 1 minute, then check the decisions list to see if the decision has been removed
255262

@@ -287,4 +294,8 @@ You might want to continue to the next recommended steps:
287294
* Understanding the impact of profiles on detection and remediation.)
288295

289296
</details>
290-
</details>
297+
</details>
298+
299+
## Your feedback is important!
300+
301+
If you have any suggestions or improvements for this health check, please let us know by opening an issue on our [GitHub repository](https://github.com/crowdsecurity/crowdsec-docs/issues/new) or on our [discord](https://discord.gg/wGN7ShmEE8)

0 commit comments

Comments
 (0)