Skip to content

Commit 1925e61

Browse files
buixorbuixor
authored
Merge branch 'main' into apache_bouncer
2 parents b9a7f09 + ac28cf4 commit 1925e61

38 files changed

Lines changed: 805 additions & 31 deletions

‎crowdsec-docs/docs/data_sources/http.md‎

Lines changed: 192 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,192 @@
1+
---
2+
id: http
3+
title: HTTP
4+
---
5+
6+
This module allows the `Security Engine` to acquire logs from an HTTP endpoint.
7+
8+
## Configuration examples
9+
10+
To receive logs from an HTTP endpoint with basic auth:
11+
```yaml
12+
source: http
13+
listen_addr: 127.0.0.1:8081
14+
path: /test
15+
auth_type: basic_auth
16+
basic_auth:
17+
username: test
18+
password: test
19+
labels:
20+
type: mytype
21+
```
22+
23+
To receive logs from an HTTP endpoint with headers:
24+
```yaml
25+
source: http
26+
listen_addr: 127.0.0.1:8081
27+
path: /test
28+
auth_type: headers
29+
headers:
30+
MyHeader: MyValue
31+
labels:
32+
type: mytype
33+
```
34+
35+
To receive logs from an HTTP endpoint with TLS and headers:
36+
37+
```yaml
38+
source: http
39+
listen_addr: 127.0.0.1:8081
40+
path: /test
41+
auth_type: headers
42+
headers:
43+
MyHeader: MyValue
44+
tls:
45+
server_cert: server.crt
46+
server_key: server.key
47+
labels:
48+
type: mytype
49+
```
50+
51+
To receive logs from an HTTP endpoint with mTLS:
52+
53+
```yaml
54+
source: http
55+
listen_addr: 127.0.0.1:8081
56+
path: /test
57+
auth_type: mtls
58+
tls:
59+
server_cert: server.crt
60+
server_key: server.key
61+
ca_cert: ca.crt
62+
labels:
63+
type: mytype
64+
```
65+
66+
:::info
67+
If most of cases when the logs are sent in JSON format, you can use the [`transform`](https://docs.crowdsec.net/docs/next/data_sources/intro/#transform) expression to parse the logs.
68+
:::
69+
70+
For example, if the logs are sent in the following format:
71+
```json
72+
{
73+
"Records": [
74+
{
75+
"message": "test",
76+
"timestamp": "2021-01-01T00:00:00Z"
77+
}
78+
]
79+
}
80+
```
81+
82+
the `transform` expression can be:
83+
```yaml
84+
transform: map(JsonExtractSlice(evt.Line.Raw, "Records"), ToJsonString(#))
85+
```
86+
87+
88+
Look at the `configuration parameters` to view all supported options.
89+
90+
## Parameters
91+
92+
93+
### `listen_addr`
94+
95+
The address to listen on (e.g., `127.0.0.1:8088`).
96+
97+
Required.
98+
99+
### `path`
100+
101+
The endpoint path to listen on.
102+
103+
:::info
104+
The request method is always `POST`.
105+
:::
106+
107+
Optional, default is `/`.
108+
109+
### `auth_type`
110+
111+
The authentication type to use.
112+
113+
Can be `basic_auth`, `headers`, or `mtls`.
114+
115+
Required.
116+
117+
### `basic_auth`
118+
119+
The basic auth credentials.
120+
121+
### `basic_auth.username`
122+
123+
The basic auth username.
124+
125+
Optional, to use when `auth_type` is `basic_auth`.
126+
127+
### `basic_auth.password`
128+
129+
The basic auth password.
130+
131+
Optional, to use when `auth_type` is `basic_auth`.
132+
133+
### `headers`
134+
135+
The headers to send.
136+
137+
Optional, to use when `auth_type` is `headers`.
138+
139+
### `tls`
140+
141+
TLS configuration.
142+
143+
### `tls.server_cert`
144+
145+
The server certificate path.
146+
147+
Optional, to use when `auth_type` is `mtls`.
148+
149+
### `tls.server_key`
150+
151+
The server key path.
152+
153+
Optional, to use when `auth_type` is `mtls`.
154+
155+
### `tls.ca_cert`
156+
157+
The CA certificate path.
158+
159+
Optional, to use when `auth_type` is `mtls`.
160+
161+
### `custom_status_code`
162+
163+
The custom status code to return.
164+
165+
Optional.
166+
167+
### `custom_headers`
168+
169+
The custom headers to return.
170+
171+
Optional.
172+
173+
### `max_body_size`
174+
175+
The maximum body size to accept.
176+
177+
Optional.
178+
179+
### `timeout`
180+
181+
The timeout to read the body.
182+
183+
:::info
184+
The timeout is in duration format, e.g., `5s`.
185+
:::
186+
187+
Optional.
188+
189+
## DSN and command-line
190+
191+
This datasource does not support acquisition from the command line.
192+

‎crowdsec-docs/docs/data_sources/introduction.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,7 @@ Name | Type | Stream | One-shot
1818
[AWS S3](/data_sources/s3.md)| read logs from a S3 bucket | yes | yes
1919
[docker](/data_sources/docker.md) | read logs from docker containers | yes | yes
2020
[file](/data_sources/file.md) | single files, glob expressions and .gz files | yes | yes
21+
[HTTP](/data_sources/http.md) | read logs from an HTTP endpoint | yes | no
2122
[journald](/data_sources/journald.md) | journald via filter | yes | yes
2223
[Kafka](/data_sources/kafka.md)| read logs from kafka topic | yes | no
2324
[Kubernetes Audit](/data_sources/kubernetes_audit.md) | expose a webhook to receive audit logs from a Kubernetes cluster | yes | no

‎crowdsec-docs/docs/getting_started/install.mdx‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,7 @@ Before installing the package, you might want to check [the ports that will be u
3535
{label: 'Debian/Ubuntu', value: 'debian'},
3636
{label: 'EL/Centos7/Amzn Linux 2', value: 'centos7'},
3737
{label: 'EL/Centos Stream 8', value: 'centos8'},
38-
{label: 'OpenSUSE', value: 'opensuse'},
38+
{label: 'SUSE Linux', value: 'suselinux'},
3939
{label: 'OpenWRT', value: 'openwrt'},
4040
{label: 'CloudLinux', value: 'cloudlinux'},
4141
]}>
@@ -51,7 +51,7 @@ Before installing the package, you might want to check [the ports that will be u
5151
<CodeBlock className="language-bash">dnf install crowdsec</CodeBlock>
5252
</TabItem>
5353

54-
<TabItem value="opensuse">
54+
<TabItem value="suselinux">
5555
<CodeBlock className="language-bash">zypper install crowdsec</CodeBlock>
5656
</TabItem>
5757

‎crowdsec-docs/sidebars.js‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -131,6 +131,7 @@
131131
"data_sources/s3",
132132
"data_sources/docker",
133133
"data_sources/file",
134+
"data_sources/http",
134135
"data_sources/journald",
135136
"data_sources/kafka",
136137
"data_sources/kubernetes_audit",

‎crowdsec-docs/sidebarsUnversioned.js‎

Lines changed: 39 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -132,7 +132,7 @@ module.exports = {
132132
{
133133
label: "Blocklists",
134134
type: "doc",
135-
id: "blocklists/intro"
135+
id: "blocklists/intro",
136136
},
137137
{
138138
type: "category",
@@ -174,6 +174,32 @@ module.exports = {
174174
},
175175
],
176176
},
177+
{
178+
type: "category",
179+
label: "CTI",
180+
items: [
181+
{
182+
type: "doc",
183+
label: "Getting started",
184+
id: "console/cti/getting_started",
185+
},
186+
{
187+
type: "doc",
188+
label: "IP report",
189+
id: "console/cti/ip_report",
190+
},
191+
{
192+
type: "doc",
193+
label: "Advanced search",
194+
id: "console/cti/advanced_search",
195+
},
196+
{
197+
type: "doc",
198+
label: "FAQ",
199+
id: "console/cti/faq",
200+
},
201+
],
202+
},
177203
{
178204
type: "category",
179205
label: "Decision",
@@ -186,11 +212,11 @@ module.exports = {
186212
{
187213
type: "category",
188214
label: "Enterprise support",
189-
link:{
215+
link: {
190216
type: "doc",
191217
id: "console/enterprise_support",
192218
},
193-
items: []
219+
items: [],
194220
},
195221
{
196222
type: "link",
@@ -351,8 +377,8 @@ module.exports = {
351377
"integrations/sophos",
352378
"integrations/genericfirewall",
353379
"integrations/remediationcomponent",
354-
]
355-
}
380+
],
381+
},
356382
],
357383
troubleshootingSideBar: [
358384
{
@@ -380,7 +406,7 @@ module.exports = {
380406
{
381407
type: "doc",
382408
id: "service_api/getting_started",
383-
label: "Getting Started"
409+
label: "Getting Started",
384410
},
385411
{
386412
type: "category",
@@ -389,8 +415,7 @@ module.exports = {
389415
"service_api/quickstart/authentication",
390416
"service_api/quickstart/blocklists",
391417
"service_api/quickstart/integrations",
392-
]
393-
418+
],
394419
},
395420
{
396421
type: "category",
@@ -399,24 +424,24 @@ module.exports = {
399424
{
400425
type: "doc",
401426
label: "Python",
402-
id: "service_api/sdks/python"
403-
}
404-
]
427+
id: "service_api/sdks/python",
428+
},
429+
],
405430
},
406431
{
407432
type: "link",
408433
label: "Swagger",
409-
href: "https://admin.api.crowdsec.net/v1/docs#/"
434+
href: "https://admin.api.crowdsec.net/v1/docs#/",
410435
},
411436
{
412437
type: "link",
413438
label: "Redoc",
414-
href: "https://admin.api.crowdsec.net/v1/redoc"
439+
href: "https://admin.api.crowdsec.net/v1/redoc",
415440
},
416441
{
417442
type: "doc",
418443
id: "service_api/faq",
419-
label: "FAQ"
444+
label: "FAQ",
420445
},
421446
],
422447
guidesSideBar: [

‎crowdsec-docs/static/img/console/cti/advanced_search/page.png‎

463 KB
Loading

‎crowdsec-docs/static/img/console/cti/featured_searches.png‎

40.2 KB
Loading

‎crowdsec-docs/static/img/console/cti/home.png‎

545 KB
Loading

‎crowdsec-docs/static/img/console/cti/report/activity.png‎

31 KB
Loading

‎crowdsec-docs/static/img/console/cti/report/attack_details.png‎

48.7 KB
Loading

0 commit comments

Comments
 (0)