You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
- Combining classic WAF benefits with advanced CrowdSec features for otherwise difficult **advanced behavior detection**.
18
-
-**Full integration** with the Crowdsec software stack, including the console and remediation components.
15
+
-Low-effort **virtual patching** capabilities.
16
+
-Support for your legacy **ModSecurity** rules.
17
+
-Combining classic WAF benefits with advanced CrowdSec features for otherwise difficult **advanced behavior detection**.
18
+
-**Full integration** with the Crowdsec software stack, including the console and remediation components.
19
19
20
20
<!-- xx : links -->
21
21
22
22
This component capitalizes on existing remediation functions in web servers (such as Nginx, Traefik, Haproxy, etc.) to provide web application firewall capabilities.
23
23
24
-
24
+
25
25
26
-
## Request inspection
26
+
1. The Web Server receives the HTTP request
27
+
2. The HTTP Request is intercepted and passed to the Crowdsec Security Engine via [the HTTP API](/appsec/protocol.md)
28
+
3. The Security Engine answers to the Web Server once the Appsec inband rules have been processed.
29
+
4. Based on the [Security Engine answer](/appsec/protocol#response-code), the Web Server either blocks the HTTP Request or processes it as usual
27
30
28
-
Examining Three Key Layers of the AppSec Component's Request Inspection
31
+
## Inband Rules and Out-Of-Band Rules
29
32
30
-
### 1 Remediation component: request relaying
33
+
The AppSec component relies on rules to inspect HTTP Requests:
31
34
32
-
If the AppSec capability is activated on the remediation component, the incoming requests will be channeled to the CrowdSec Security engine.
35
+
- Inband rules are meant to interrupt request processing
36
+
- Out-Of-Band rules are non-blocking and are evaluated asynchronously
33
37
34
-
### 2 Security Engine: inband rule processing
38
+
### Inband rule processing
35
39
36
40
The security engine first evaluates the inband rules, designed to identify and block specific requests.
37
41
Once these rules are evaluated, a response is relayed to the remediation component.
38
42
39
43
This leads to two possible outcomes:
40
44
41
-
1.If no inband rule is triggered, the processing of the request will continue on the web-server side as usual
42
-
2. If an inband rule is triggered, the remediation component will answer with a 403 or a captcha request to the user of the incriminated request, stopping the request processing.
45
+
1. If an inband rule is triggered, the remediation component will answer with a 403 or a captcha request to the user of the incriminated request, stopping the request processing.
46
+
2.Otherwise, the request will be normally processed
In the background, the security engine will then evaluate the out-of-band rules. These rules do not impact performance or response time, as they are evaluated after the AppSec Component instructs the webserver to continue or stop processing the request.
47
51
52
+
They are usually meant to detect unwanted behaviors that exhibit a repetitive aspect (ie. Applicative Spam, Resource enumeration, Scalping etc.). When those rules trigger, they emit an event is processed by the Security Engine in the same way a log line is.
53
+
48
54
## Post processing
49
55
50
56
When a request triggers one or more rules, either in the inband section (blocking) or out-of-band (non-blocking), several things happen:
51
57
52
-
- Inband (blocking) rules will appear in your `cscli alerts list` (and thus in your [console dashboard](https://app.crowdsec.net)).
53
-
- Inband and Out-Of-Band rules will trigger an internal crowdsec event that can be treated as any log lines.
58
+
-Inband (blocking) rules will appear in your `cscli alerts list` (and thus in your [console dashboard](https://app.crowdsec.net)).
59
+
-Inband and Out-Of-Band rules will trigger an internal crowdsec event that can be treated as any log lines.
54
60
55
61
This is meant to allow for scenarios to exploit the WAF rules events, such as blocking for a longer time an IP that clearly engages in malevolent activities, triggering several virtual patching rules.
56
62
57
63
## Next steps
58
64
59
65
Let's now start using this AppSec capabilities:
60
66
61
-
-**Installation**: [How to configure the Application Security Component with an existing remediation component](/appsec/installation.md)
62
-
-**Rules**: [How to read, write and debug rules](/appsec/rules_syntax.md)
63
-
-**Scenarios**: [How to create scenarios that leverage the AppSec Component events](#TODO)
64
-
-**Hooks**: [For advanced use let's talk about possible Hooks](/appsec/hooks.md)
65
-
-**Troubleshoot**: [How to troubleshoot the behavior of the AppSec Component](/appsec/troubleshooting.md)
66
-
-**AppSec Protocol**: [if you're maintaining or creating a remedation component and want to add the AppSec capabilities](/appsec/protocol.md)
67
+
-**Installation**: [How to configure the Application Security Component with an existing remediation component](/appsec/installation.md)
68
+
-**Rules**: [How to read, write and debug rules](/appsec/rules_syntax.md)
69
+
-**Scenarios**: [How to create scenarios that leverage the AppSec Component events](#TODO)
70
+
-**Hooks**: [For advanced use let's talk about possible Hooks](/appsec/hooks.md)
71
+
-**Troubleshoot**: [How to troubleshoot the behavior of the AppSec Component](/appsec/troubleshooting.md)
72
+
-**AppSec Protocol**: [if you're maintaining or creating a remedation component and want to add the AppSec capabilities](/appsec/protocol.md)
The [CrowdSec Security Engine](https://github.com/crowdsecurity/crowdsec) is an open-source, lightweight software that detects and blocks malicious actors from accessing your systems at various levels, using log and HTTP Requests analysis with threat patterns called scenarios.
17
12
18
-
The [CrowdSec Security Engine](https://github.com/crowdsecurity/crowdsec) is an open-source, lightweight software that detects and blocks malicious actors from accessing your systems at various levels, using log analysis and threat patterns called scenarios.
13
+
CrowdSec is a modular security tool offering [behavior-based detection](https://app.crowdsec.net/hub/collections), including [AppSec rules](https://app.crowdsec.net/hub/appsec-rules), and optional components to block threats called [Remediation Components](https://app.crowdsec.net/hub/bouncers)
19
14
20
-
CrowdSec is a modular framework, offering a variety of [popular scenarios](https://app.crowdsec.net/hub/collections). Users can choose their protection scenarios and deploy [Remediation Components](https://app.crowdsec.net/hub/bouncers) to block malicious access.
The crowd-sourced aspect allows sharing attack information among users, enhancing real-time attack detection and preemptive blocking of known bad actors from your system.
26
+
The crowd-sourced aspect allows the sharing of attacks they detected and blocked. Participants of this crowd-sourced threat intel receive, automatically via the security engine, a curated list of validated attackers (community blocklist) enhancing their real-time protection capabilities by taking preemptive actions against known threats.
23
27
24
28
## Main Features
25
29
26
30
In addition to the core "detect and react" mechanism, CrowdSec is committed to several other key aspects:
27
31
28
-
-**Easy Installation**: Effortless out-of-the-box installation on all [supported platforms](/getting_started/versions_matrix.md).
29
-
-**Simplified Daily Operations**: Use [cscli](/cscli/cscli.md) and the [hub](http://hub.crowdsec.net) for effortless maintenance and keeping your detection mechanisms up-to-date.
30
-
-**Reproducibility**: The Security Engine can analyze not only live logs but also [cold logs](/u/user_guides/replay_mode), making it easier to detect potential false triggers, conduct forensic analysis, or generate reports.
31
-
-**Observability**: Providing valuable insights into the system's activity:
32
-
- Users can view/manage alerts from the ([Console](https://app.crowdsec.net/signup)).
33
-
-Operations personnel have access to detailed Prometheus metrics ([Prometheus](/observability/prometheus.md)).
34
-
-Administrators can utilize a user-friendly command-line interface tool ([cscli](/observability/cscli.md)).
35
-
-**API-Centric**: All components communicate via an [HTTP API](/local_api/intro.md), facilitating multi-machine setups.
36
-
32
+
-**Easy Installation**: Effortless out-of-the-box installation on all [supported platforms](/getting_started/versions_matrix.md).
33
+
-**Simplified Daily Operations**: You have access to our Web UI administration via [CrowdSec's console](http://app.crowdsec.net) or the powerful [Command line tool cscli](/cscli/cscli.md) for effortless maintenance and keeping your detection mechanisms up-to-date.
34
+
-**Reproducibility**: The Security Engine can analyze not only live logs but also [cold logs](/u/user_guides/replay_mode), making it easier to detect potential false triggers, conduct forensic analysis, or generate reports.
35
+
-**Versatile**: The Security Engine can analyze [system logs](/docs/data_sources/intro) and [HTTP Requests](/docs/next/appsec/intro) to exhaustively protect your perimeter.
36
+
-**Observability**: Providing valuable insights into the system's activity:
37
+
- Users can view/manage alerts from the ([Console](https://app.crowdsec.net/signup)).
38
+
- Operations personnel have access to detailed Prometheus metrics ([Prometheus](/observability/prometheus.md)).
39
+
- Administrators can utilize a user-friendly command-line interface tool ([cscli](/observability/cscli.md)).
40
+
-**API-Centric**: All components communicate via an [HTTP API](/local_api/intro.md), facilitating multi-machine setups.
Under the hood, the Security Engine has various components:
51
+
52
+
- The Log Processor is in charge of detection: it analyzes logs from [various data sources](/docs/data_sources/intro) or [HTTP requests](/appsec/intro.md) from web servers.
53
+
- The [Appsec](/appsec/intro.md) feature is part of the Log Processor and filters HTTP Requests from the compatible web servers.
54
+
- The [Local API](/local_api/intro.md) acts as a middle man:
55
+
- Between the [Log Processors](/docs/data_sources/intro) and the [Remediation Components](/u/bouncers/intro) which are in charge of enforcing decisions.
56
+
- And with the [Central API](/central_api/intro.md) to share alerts and receive blocklists.
57
+
- The [Remediation Components](/u/bouncers/intro) - also known as bouncers - block malicious IPs at your chosen level—whether via IpTables, firewalls, web servers, or reverse proxies. [See the full list on our CrowdSec Hub.](https://app.crowdsec.net/hub/remediation-components)
58
+
59
+
## Deployment options
60
+
61
+
This architecture allows for both simple/standalone setups, or more distributed ones including as illustrated below:
62
+
63
+
- One or more machines? Run crowdsec on each (alongside with a remediation component)
64
+
- Already have a log pit (such as rsyslog or loki)? Run crowdsec next to it, not on the production workloads
65
+
- Running Kubernetes? Have a look at [our helm chart](/u/getting_started/installation/kubernetes)
66
+
- Running containers? The [docker data source](/docs/data_sources/docker) might be what you need
67
+
- Just looking for a WAF? Look at [our quickstart](/appsec/intro.md)
0 commit comments