Skip to content

Commit 74bd7a8

Browse files
author
jdv
committed
updates on cti and console cti intro pages
1 parent efb1eba commit 74bd7a8

2 files changed

Lines changed: 100 additions & 116 deletions

File tree

‎crowdsec-docs/unversioned/console/ip_reputation/intro.mdx‎

Lines changed: 76 additions & 90 deletions
Original file line numberDiff line numberDiff line change
@@ -5,113 +5,99 @@ description: Explore and query CrowdSec's IP Reputation data and manage CTI API
55
---
66

77
import Link from "@docusaurus/Link";
8+
import { ExternalLink } from "lucide-react";
89

9-
CrowdSec's **IP Reputation / CTI** section gives you access to the world's largest crowdsourced threat intelligence network — investigate IPs in the web UI, hunt threats with advanced search, or query at scale via REST API.
10+
export const BLUE = "#60a5fa";
11+
export const GREEN = "#22d3a0";
12+
export const PURPLE = "#a78bfa";
1013

11-
---
14+
<p style={{ fontSize: "14px", color: "var(--ifm-color-emphasis-600)", lineHeight: 1.65, marginBottom: "1.5rem" }}>
15+
Query behavioral intelligence on any IP — reputation scores, attack patterns, linked CVEs, and activity history — sourced from hundreds of thousands of real CrowdSec deployments worldwide.
16+
</p>
1217

13-
## Web UI Features
18+
{/* ── Row 1: Search + IP Report ───────────────────────────────────────── */}
1419

15-
<div style={{ display: "grid", gridTemplateColumns: "repeat(auto-fill, minmax(260px, 1fr))", gap: "12px", margin: "1.25rem 0" }}>
20+
<div style={{ display: "grid", gridTemplateColumns: "repeat(2, 1fr)", gap: "10px", marginBottom: "10px" }}>
1621

17-
<div style={{ display: "flex", flexDirection: "column", padding: "18px 20px", background: "rgb(var(--card)/var(--tw-bg-opacity,1))", border: "1px solid var(--ifm-color-emphasis-200)", borderRadius: "10px" }}>
18-
<div style={{ fontSize: "20px", marginBottom: "8px" }}>🔍</div>
19-
<div style={{ fontWeight: 700, fontSize: "14px", marginBottom: "6px" }}>IP Search</div>
20-
<div style={{ fontSize: "12.5px", color: "var(--ifm-color-emphasis-600)", lineHeight: 1.6, flexGrow: 1 }}>
21-
Search any IP or run Lucene queries against the threat database. Predefined searches and a <strong>Top 10 Most Aggressive IPs</strong> leaderboard (last 24h) are available right on the homepage.
22+
<div className="doc-card" style={{ display: "flex", flexDirection: "column" }}>
23+
<div style={{ fontSize: "22px", marginBottom: "8px" }}>🔍</div>
24+
<div style={{ fontWeight: 700, fontSize: "14px", marginBottom: "6px" }}>Explore IP Reputation</div>
25+
<div style={{ fontSize: "12.5px", color: "var(--ifm-color-emphasis-600)", lineHeight: 1.6, flexGrow: 1, marginBottom: "14px" }}>
26+
Search any IP or run Lucene queries with live faceted filters — reputation, country, AS, behaviors, classifications. The homepage also surfaces a <strong>Top 10 Most Aggressive IPs</strong> leaderboard updated every 24h.
27+
</div>
28+
<div style={{ display: "flex", gap: "10px", flexWrap: "wrap" }}>
29+
<Link to="/u/console/ip_reputation/search_ui" style={{ fontSize: "12.5px", fontWeight: 600 }}><span>IP Search →</span></Link>
30+
<Link to="/u/console/ip_reputation/search_ui_advanced" style={{ fontSize: "12.5px", fontWeight: 600 }}><span>Advanced Search →</span></Link>
31+
<Link to="/u/cti_api/search_queries" style={{ fontSize: "12.5px", fontWeight: 600 }}><span>Query Reference →</span></Link>
32+
</div>
2233
</div>
23-
<Link to="/u/console/ip_reputation/search_ui" style={{ marginTop: "12px", fontSize: "12.5px", fontWeight: 600 }}>IP Search →</Link>
24-
</div>
2534

26-
<div style={{ display: "flex", flexDirection: "column", padding: "18px 20px", background: "rgb(var(--card)/var(--tw-bg-opacity,1))", border: "1px solid var(--ifm-color-emphasis-200)", borderRadius: "10px" }}>
27-
<div style={{ fontSize: "20px", marginBottom: "8px" }}>🎯</div>
28-
<div style={{ fontWeight: 700, fontSize: "14px", marginBottom: "6px" }}>Advanced Search</div>
29-
<div style={{ fontSize: "12.5px", color: "var(--ifm-color-emphasis-600)", lineHeight: 1.6, flexGrow: 1 }}>
30-
Lucene queries with a live faceted filter panel — reputation, country, AS, behaviors, classifications. Built for threat hunting, bulk investigation, and targeted blocklist building.
31-
</div>
32-
<div style={{ display: "flex", gap: "10px", marginTop: "12px", flexWrap: "wrap" }}>
33-
<Link to="/u/console/ip_reputation/search_ui_advanced" style={{ fontSize: "12.5px", fontWeight: 600 }}>Advanced Search →</Link>
34-
<Link to="/u/cti_api/search_queries" style={{ fontSize: "12.5px", fontWeight: 600 }}>Query Reference →</Link>
35+
<div className="doc-card" style={{ display: "flex", flexDirection: "column" }}>
36+
<div style={{ fontSize: "22px", marginBottom: "8px" }}>📋</div>
37+
<div style={{ fontWeight: 700, fontSize: "14px", marginBottom: "6px" }}>Understand an IP Report</div>
38+
<div style={{ fontSize: "12.5px", color: "var(--ifm-color-emphasis-600)", lineHeight: 1.6, flexGrow: 1, marginBottom: "14px" }}>
39+
Click any IP to open its full report: <strong>threat reputation score</strong>, observed attack behaviors mapped to MITRE ATT&amp;CK, <strong>linked CVEs</strong>, classifications, and time-windowed activity details showing whether the threat is rising, stable, or decaying.
40+
</div>
41+
<Link to="/u/console/ip_reputation/ip_report" style={{ fontSize: "12.5px", fontWeight: 600 }}><span>IP Report →</span></Link>
3542
</div>
36-
</div>
3743

38-
<div style={{ display: "flex", flexDirection: "column", padding: "18px 20px", background: "rgb(var(--card)/var(--tw-bg-opacity,1))", border: "1px solid var(--ifm-color-emphasis-200)", borderRadius: "10px" }}>
39-
<div style={{ fontSize: "20px", marginBottom: "8px" }}>📋</div>
40-
<div style={{ fontWeight: 700, fontSize: "14px", marginBottom: "6px" }}>IP Report</div>
41-
<div style={{ fontSize: "12.5px", color: "var(--ifm-color-emphasis-600)", lineHeight: 1.6, flexGrow: 1 }}>
42-
Click any IP to open its full report: reputation score, key metadata, behaviors, classifications, MITRE techniques, CVEs, and time-windowed activity scores.
43-
</div>
44-
<Link to="/u/console/ip_reputation/ip_report" style={{ marginTop: "12px", fontSize: "12.5px", fontWeight: 600 }}>IP Report →</Link>
4544
</div>
4645

47-
</div>
46+
{/* ── Row 2: API Key ──────────────────────────────────────────────────── */}
4847

49-
### Live Exploit Tracker
50-
51-
<div style={{ display: "flex", gap: "16px", padding: "20px 22px", background: "rgb(var(--card)/var(--tw-bg-opacity,1))", border: "1px solid var(--ifm-color-emphasis-200)", borderRadius: "10px", margin: "1rem 0", alignItems: "flex-start" }}>
52-
<div style={{ fontSize: "28px", flexShrink: 0 }}>🚨</div>
53-
<div>
54-
<div style={{ fontWeight: 700, fontSize: "14px", marginBottom: "6px" }}>
55-
<a href="https://tracker.crowdsec.net/" target="_blank" rel="noopener noreferrer">tracker.crowdsec.net ↗</a>
56-
</div>
57-
<div style={{ fontSize: "12.5px", color: "var(--ifm-color-emphasis-600)", lineHeight: 1.65, marginBottom: "12px" }}>
58-
A dedicated platform for tracking vulnerabilities actively exploited in the wild, powered by live CrowdSec network data. Accessible with the same CTI API key.
59-
</div>
60-
<div style={{ display: "grid", gridTemplateColumns: "repeat(auto-fill, minmax(200px, 1fr))", gap: "6px" }}>
61-
{[
62-
["⚡", "CrowdSec Score", "SOC-oriented priority signal based on observed attack patterns"],
63-
["🎯", "Opportunity Score", "How targeted vs. opportunistic the exploitation is (0 = mass scan, 5 = precise campaign)"],
64-
["📈", "Momentum Score", "Whether exploitation volume is growing, stable, or declining"],
65-
["🏷️", "Exploitation Status", "From early exploitation to background noise"],
66-
["🕐", "Timeline", "First/last seen, CVE publication, CISA KEV addition, key events"],
67-
["🌐", "Malicious IPs", "IPs actively exploiting a CVE — with full CTI context for hunting or blocklisting"],
68-
].map(([icon, title, desc]) => (
69-
<div key={title} style={{ padding: "10px 12px", background: "var(--ifm-background-color)", border: "1px solid var(--ifm-color-emphasis-200)", borderRadius: "8px" }}>
70-
<div style={{ fontSize: "13px", fontWeight: 600, marginBottom: "3px" }}>{icon} {title}</div>
71-
<div style={{ fontSize: "11.5px", color: "var(--ifm-color-emphasis-600)", lineHeight: 1.5 }}>{desc}</div>
72-
</div>
73-
))}
48+
<div className="doc-card" style={{ marginBottom: "2rem" }}>
49+
<div style={{ display: "flex", alignItems: "flex-start", gap: "12px", marginBottom: "14px" }}>
50+
<div style={{ fontSize: "22px", lineHeight: 1 }}>🔑</div>
51+
<div>
52+
<div style={{ fontWeight: 700, fontSize: "14px", marginBottom: "4px" }}>Create an API Key</div>
53+
<div style={{ fontSize: "12.5px", color: "var(--ifm-color-emphasis-600)", lineHeight: 1.6 }}>
54+
Unlock programmatic access to 30+ enrichment fields per IP — reputation, behaviors, CVEs, attack context, MITRE mappings, and more. Use it to enrich SIEM alerts, automate lookups, or feed threat intel platforms. <strong>Free tier included, no credit card needed.</strong>
55+
</div>
7456
</div>
7557
</div>
76-
</div>
77-
78-
---
79-
80-
## API Access
8158

82-
Query the same data programmatically with a CTI API key and the [CTI REST API](/u/cti_api/intro).
83-
84-
<div style={{ display: "grid", gridTemplateColumns: "repeat(auto-fill, minmax(220px, 1fr))", gap: "10px", margin: "1rem 0" }}>
85-
86-
<div style={{ padding: "16px 18px", background: "rgb(var(--card)/var(--tw-bg-opacity,1))", border: "1px solid var(--ifm-color-emphasis-200)", borderRadius: "10px" }}>
87-
<div style={{ fontWeight: 700, fontSize: "13px", marginBottom: "4px" }}>Free</div>
88-
<div style={{ fontSize: "20px", fontWeight: 800, marginBottom: "4px" }}>40 <span style={{ fontSize: "12px", fontWeight: 400, color: "var(--ifm-color-emphasis-500)" }}>queries / month</span></div>
89-
<div style={{ fontSize: "12px", color: "var(--ifm-color-emphasis-600)" }}>POC, low-traffic scripts</div>
90-
</div>
91-
92-
<div style={{ padding: "16px 18px", background: "rgb(var(--card)/var(--tw-bg-opacity,1))", border: "1px solid var(--ifm-color-emphasis-200)", borderRadius: "10px" }}>
93-
<div style={{ fontWeight: 700, fontSize: "13px", marginBottom: "4px" }}>Premium</div>
94-
<div style={{ fontSize: "20px", fontWeight: 800, marginBottom: "4px" }}>120 <span style={{ fontSize: "12px", fontWeight: 400, color: "var(--ifm-color-emphasis-500)" }}>queries / month</span></div>
95-
<div style={{ fontSize: "12px", color: "var(--ifm-color-emphasis-600)" }}>Regular enrichment, small integrations</div>
96-
</div>
59+
{/* Quota sub-tiles */}
60+
<div style={{ display: "grid", gridTemplateColumns: "repeat(3, 1fr)", gap: "8px", marginBottom: "14px" }}>
61+
{[
62+
{ label: "Community", quota: "40", unit: "/ month", desc: "Ad-hoc lookups, proof of concept", color: GREEN },
63+
{ label: "Premium", quota: "120", unit: "/ month", desc: "Regular enrichment, small integrations", color: BLUE },
64+
{ label: "Premium Options", quota: "5K–100K", unit: "/ month", desc: "Production SIEMs, SOARs, high-volume pipelines", color: PURPLE },
65+
].map(({ label, quota, unit, desc, color }) => (
66+
<div key={label} style={{ padding: "10px 12px", background: "var(--ifm-background-color)", border: "1px solid var(--ifm-color-emphasis-200)", borderRadius: "8px" }}>
67+
<div style={{ fontWeight: 700, fontSize: "12px", color, marginBottom: "2px" }}>{label}</div>
68+
<div style={{ fontFamily: "var(--ifm-font-family-monospace)", fontSize: "13px", fontWeight: 700, marginBottom: "2px" }}>
69+
{quota} <span style={{ fontSize: "10px", fontWeight: 400, color: "var(--ifm-color-emphasis-500)" }}>{unit}</span>
70+
</div>
71+
<div style={{ fontSize: "11px", color: "var(--ifm-color-emphasis-500)", lineHeight: 1.4 }}>{desc}</div>
72+
</div>
73+
))}
74+
</div>
9775

98-
<div style={{ padding: "16px 18px", background: "rgb(var(--card)/var(--tw-bg-opacity,1))", border: "1px solid var(--ifm-color-emphasis-200)", borderRadius: "10px" }}>
99-
<div style={{ fontWeight: 700, fontSize: "13px", marginBottom: "4px" }}>Premium Options</div>
100-
<div style={{ fontSize: "20px", fontWeight: 800, marginBottom: "4px" }}>5K–100K <span style={{ fontSize: "12px", fontWeight: 400, color: "var(--ifm-color-emphasis-500)" }}>queries / month</span></div>
101-
<div style={{ fontSize: "12px", color: "var(--ifm-color-emphasis-600)" }}>Production integrations, SIEMs, SOARs</div>
102-
</div>
76+
<div style={{ fontSize: "11.5px", color: "var(--ifm-color-emphasis-500)", lineHeight: 1.55, marginBottom: "12px", padding: "8px 12px", background: "var(--ifm-background-color)", borderRadius: "7px", border: "1px solid var(--ifm-color-emphasis-200)" }}>
77+
<strong style={{ color: "var(--ifm-color-emphasis-700)" }}>API quotas are separate from Web UI quotas.</strong> Web UI searches consume their own quota: <strong>100 searches/week</strong> when not logged in (1 quota per results page or report viewed); <strong>40/month</strong> for logged-in Community accounts, <strong>100/month</strong> for Premium. API key usage does not count against Web UI quotas, and vice versa.
78+
</div>
10379

80+
<div style={{ display: "flex", gap: "8px", flexWrap: "wrap" }}>
81+
<Link to="/u/console/ip_reputation/api_keys" style={{ display: "inline-flex", alignItems: "center", padding: "7px 14px", borderRadius: "8px", fontSize: "12.5px", fontWeight: 600, background: `${BLUE}22`, color: BLUE, border: `1px solid ${BLUE}44`, textDecoration: "none" }}><span>Create an API key →</span></Link>
82+
<Link to="/u/cti_api/taxonomy/intro" style={{ display: "inline-flex", alignItems: "center", padding: "7px 14px", borderRadius: "8px", fontSize: "12.5px", fontWeight: 500, border: "1px solid var(--ifm-color-emphasis-200)", color: "var(--ifm-color-emphasis-700)", textDecoration: "none" }}><span>Data Taxonomy →</span></Link>
83+
<Link to="https://crowdsecurity.github.io/cti-api/" style={{ display: "inline-flex", alignItems: "center", gap: "5px", padding: "7px 14px", borderRadius: "8px", fontSize: "12.5px", fontWeight: 500, border: "1px solid var(--ifm-color-emphasis-200)", color: "var(--ifm-color-emphasis-700)", textDecoration: "none" }}><span>API Reference</span><ExternalLink size={11} style={{ opacity: 0.5 }} /></Link>
84+
</div>
10485
</div>
10586

106-
Manage your keys under **Settings → CTI API Keys** in the Console, or go directly to [app.crowdsec.net/settings/cti-api-keys](https://app.crowdsec.net/settings/cti-api-keys).
107-
108-
<div style={{ display: "flex", gap: "8px", flexWrap: "wrap", margin: "0.75rem 0" }}>
109-
<Link to="/u/console/ip_reputation/api_keys" style={{ display: "inline-flex", alignItems: "center", padding: "7px 14px", borderRadius: "8px", fontSize: "13px", fontWeight: 600, background: "rgb(var(--primary)/var(--tw-bg-opacity,1))", color: "rgb(var(--primary-foreground)/var(--tw-bg-opacity,1))", textDecoration: "none" }}>Get your first API key →</Link>
110-
<Link to="/u/console/ip_reputation/api_keys_premium" style={{ display: "inline-flex", alignItems: "center", padding: "7px 14px", borderRadius: "8px", fontSize: "13px", fontWeight: 500, border: "1px solid var(--ifm-color-emphasis-200)", color: "var(--ifm-color-emphasis-700)", textDecoration: "none" }}>Premium quotas →</Link>
87+
{/* ── You might also be interested in: LET ───────────────────────────── */}
88+
89+
<div style={{ borderLeft: "3px solid var(--ifm-color-emphasis-200)", paddingLeft: "16px", marginBottom: "1rem" }}>
90+
<div className="doc-eyebrow" style={{ marginBottom: "8px" }}>You might also be interested in</div>
91+
<div style={{ display: "flex", gap: "14px", alignItems: "flex-start" }}>
92+
<div style={{ fontSize: "24px", flexShrink: 0 }}>🚨</div>
93+
<div>
94+
<div style={{ fontWeight: 700, fontSize: "13.5px", marginBottom: "4px" }}>
95+
<a href="https://tracker.crowdsec.net/" target="_blank" rel="noopener noreferrer" style={{ color: "inherit" }}>Live Exploit Tracker ↗</a>
96+
</div>
97+
<div style={{ fontSize: "12.5px", color: "var(--ifm-color-emphasis-600)", lineHeight: 1.6, marginBottom: "8px" }}>
98+
A dedicated platform tracking CVEs actively exploited in the wild — with exploitation momentum, opportunity scores, and the IPs behind each attack. Uses the same CTI API key.
99+
</div>
100+
<Link to="/u/tracker_api/intro" style={{ fontSize: "12px", fontWeight: 600 }}><span>Explore the Live Exploit Tracker →</span></Link>
101+
</div>
102+
</div>
111103
</div>
112-
113-
---
114-
115-
:::tip Full technical reference
116-
For API endpoints, request/response schemas, integrations (SIEM, SOAR, TIP platforms), and data taxonomy, see the [CTI API documentation](/u/cti_api/intro).
117-
:::

0 commit comments

Comments
 (0)