Skip to content

Commit 82df0e7

Browse files
author
jdv
committed
moving things around
1 parent 21a46f0 commit 82df0e7

9 files changed

Lines changed: 520 additions & 32 deletions

File tree

‎crowdsec-docs/sidebarsUnversioned.ts‎

Lines changed: 63 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -10,35 +10,9 @@ const sidebarsUnversionedConfig: SidebarConfig = {
1010
id: "cti_api/intro",
1111
},
1212
{
13-
type: "category",
13+
type: "link",
1414
label: "Web UI",
15-
items: [
16-
{
17-
type: "doc",
18-
label: "Getting Started",
19-
id: "cti_api/getting_started",
20-
},
21-
{
22-
type: "doc",
23-
label: "IP Report",
24-
id: "cti_api/ip_report",
25-
},
26-
{
27-
type: "doc",
28-
label: "Advanced Search",
29-
id: "cti_api/advanced_search",
30-
},
31-
{
32-
type: "doc",
33-
label: "Search Queries",
34-
id: "cti_api/search_queries",
35-
},
36-
{
37-
type: "doc",
38-
label: "CVE Explorer",
39-
id: "cti_api/cve_explorer",
40-
},
41-
],
15+
href: "/u/console/ip_reputation/intro",
4216
},
4317
{
4418
type: "category",
@@ -329,9 +303,67 @@ const sidebarsUnversionedConfig: SidebarConfig = {
329303
},
330304
},
331305
{
332-
type: "link",
333-
label: "CTI",
334-
href: "/u/cti_api/intro",
306+
type: "category",
307+
label: "IP Reputation / CTI",
308+
link: {
309+
type: "doc",
310+
id: "console/ip_reputation/intro",
311+
},
312+
items: [
313+
{
314+
type: "category",
315+
label: "Search UI",
316+
link: {
317+
type: "doc",
318+
id: "console/ip_reputation/search_ui",
319+
},
320+
items: [
321+
{
322+
type: "doc",
323+
label: "Advanced Search",
324+
id: "console/ip_reputation/search_ui_advanced",
325+
},
326+
{
327+
type: "link",
328+
label: "Search Queries Syntax",
329+
href: "/u/cti_api/search_queries",
330+
},
331+
],
332+
},
333+
{
334+
type: "doc",
335+
label: "IP Reputation Report",
336+
id: "console/ip_reputation/ip_report",
337+
},
338+
{
339+
type: "category",
340+
label: "API",
341+
link: {
342+
type: "doc",
343+
id: "console/ip_reputation/api_keys",
344+
},
345+
items: [
346+
{
347+
type: "doc",
348+
label: "Premium API Keys",
349+
id: "console/ip_reputation/api_keys_premium",
350+
customProps: {
351+
tag: "premium",
352+
},
353+
},
354+
{
355+
type: "link",
356+
label: "CTI API Integrations 🔀",
357+
href: "/u/cti_api/api_integration/integration_intro",
358+
},
359+
{
360+
type: "link",
361+
label: "Technical Documentation 🔀",
362+
href: "/u/cti_api/taxonomy/intro",
363+
},
364+
],
365+
},
366+
],
335367
},
336368
{
337369
type: "category",

crowdsec-docs/unversioned/cti_api/api_getting_started.mdx renamed to crowdsec-docs/unversioned/console/ip_reputation/api_keys.mdx

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
---
2-
id: api_getting_started
2+
id: api_keys
33
title: CTI API Getting Started
44
sidebar_position: 2
55
---

‎crowdsec-docs/unversioned/console/ip_reputation/api_keys_premium.mdx‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
---
2+
id: api_keys_premium
3+
title: Premium CTI API Keys
4+
sidebar_position: 2
5+
---
6+
7+
// Premium plan come with increased quotas on its free CTI KEY
8+
// also allow oyu to buy bigger quotas CTI API Keys if needed
9+
10+
...

‎crowdsec-docs/unversioned/console/ip_reputation/cve_explorer.md‎

Lines changed: 184 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,184 @@
1+
# CVE Explorer
2+
3+
The CVE Explorer is essentially a threat‑intelligence dashboard for CVEs. By combining CVE metadata with CrowdSec’s detection data, it lets users see which vulnerabilities attackers are actively exploiting, track emerging trends, examine exploitation timelines, and obtain actionable indicators (malicious IPs and Blocklists). Searching or filtering quickly narrows the list, while the detailed pages give insight into attack behavior and mitigation steps.
4+
5+
6+
> **Try it now** → [https://app.crowdsec.net/cti/cve-explorer](https://app.crowdsec.net/cti/cve-explorer)
7+
8+
<div align="center">
9+
<img src="/img/console/cti/cve-explorer/cve-home.png" alt="Screenshot — CVE Explorer home" width="70%" />
10+
</div>
11+
12+
---
13+
14+
## CVEs Exploration
15+
16+
### Search Bar
17+
<div align="center">
18+
<img src="/img/console/cti/cve-explorer/cve-search.png" alt="Screenshot — CVE Explorer search" width="50%" />
19+
</div>
20+
21+
22+
At the top of the CVE Explorer sits a unified search field where you can instantly filter the entire CVE catalog by:
23+
24+
* **CVE ID** (e.g. `CVE-2021-44228`)
25+
* **Product or Vendor** (e.g. Apache, Cisco)
26+
* **Attack Type** (e.g. RCE, XSS)
27+
28+
Type your query, hit **Search**, and the list below updates in real-time.
29+
30+
---
31+
32+
### Quick-Filter Cards
33+
34+
<div align="center">
35+
<img src="/img/console/cti/cve-explorer/cve-shortcuts.png" alt="Screenshot — CVE Explorer shortcuts" width="70%" />
36+
</div>
37+
38+
Directly under the search bar are three actionable buttons that sort all CVEs in the database:
39+
40+
1. **Trending CVEs**
41+
42+
* Vulnerabilities with the fastest week-over-week growth in exploit detections.
43+
2. **Recently Tracked CVEs**
44+
45+
* Newly observed by CrowdSec for catching zero-day or freshly published ones.
46+
3. **Most Exploited CVEs**
47+
48+
* Ranked by total unique attacking IPs, showing the biggest exploits first.
49+
50+
---
51+
52+
### CVE Result List
53+
54+
<div align="center">
55+
<img src="/img/console/cti/cve-explorer/cve-list-item.png" alt="Screenshot — CVE Explorer list" width="70%" />
56+
</div>
57+
58+
59+
Beneath the filters, CVEs are presented as concise “cards” with these key data points:
60+
61+
* **Title & ID** (click anywhere on the card to drill down)
62+
* **CrowdSec Score** (0–10 risk rating)
63+
* **Sparkline** of exploit volume over the last 7 days
64+
* **First Detection** date in CrowdSec’s network
65+
* **# of Exploiting IPs** badge on the right
66+
* **Product/Vendor** tags
67+
68+
69+
## CVE Details Page
70+
71+
72+
<div align="center">
73+
<img src="/img/console/cti/cve-explorer/cve-details-head.png" alt="Screenshot — CVE Details" width="70%" />
74+
</div>
75+
76+
The header zone tells you, at a glance, how dangerous the vulnerability is for your stack:
77+
78+
79+
* **CrowdSec Score** – CrowdSec proprietary risk rating (0-10)
80+
* **CVSS Base Score** – industry-standard severity
81+
* **Published / First Seen** – NVD publication date and the first time CrowdSec witnessed exploitation in the wild
82+
* **Exploiting IPs** – unique IPs detected attacking with this CVE
83+
* **Products / Vendors** – affected software stack
84+
85+
> **Pro tip:** The *CrowdSec score* represents the calculation of how dangerous a given vulnerability is based on the attacks seen by our network. It is designed to help defenders weigh how serious an alert from their security system should be treated and whether they should prioritize the vulnerability in patch management.
86+
> The score is based on two key factors:
87+
> - Attacker Focus
88+
> - Vulnerability Trendiness
89+
>
90+
> *Attacker Focus* scores the behaivor of the attackers that target this vulnerability. If the attackers consist mainly of automated bots that opportunistically scan the whole internet, the vulnerability gets a lower score as the attacks will be mostly noise. If a vulnerability sees mainly sophisticated targeted exploits it gets a high score, encouraging defenders to check the details of their alert to make sure its not part of a campaign against their perimeter. \
91+
> *Vulnerability Trendiness* scores how the signals received by the CrowdSec network have evolved over time. Vulnerabilities that see high week-on-week growth in exploit volume are scored higher than ones where the exploit volume is on a decline. This score helps put vulnerabilities back into focus of defenders if some external factor (such as a related vulnerability) causes attacks to pick up.
92+
> In addition to the two factors above, an additional flat bonus is given to recently published vulnerabilities to account for uncertainties and missing data.
93+
94+
95+
---
96+
97+
### Key Information
98+
99+
100+
101+
102+
<div align="center">
103+
<img src="/img/console/cti/cve-explorer/cve-description.png" alt="Screenshot — CVE Description" width="70%" />
104+
</div>
105+
106+
* **NIST Description** –
107+
Standard CVE description originating from the NIST database.
108+
109+
110+
111+
* **CrowdSec Analysis** –
112+
The CrowdSec analysis is a threat-report written by security experts at CrowdSec.
113+
It generally starts by identifying the CVE technical impact, then goes on to characterize attacker behavior (broad, automated scans), summarizes telemetry trends (steady, sustained exploitation), and can pinpointing specific attack vectors in use.
114+
115+
116+
---
117+
118+
### Exploitation Timeline
119+
120+
Understand momentum at a glance.
121+
122+
123+
<div align="center">
124+
<img src="/img/console/cti/cve-explorer/cve-timeline.png" alt="Screenshot — CVE Timeline" width="70%" />
125+
</div>
126+
127+
*Interactive chart* displays exploit attempts per hour/day.
128+
129+
> **Pro tip:** Switch the drop-down (Last 24 h / 7 days / 30 days) to zoom in on surges.
130+
131+
132+
Some CVEs can also display an **Event Log** records milestones:
133+
134+
135+
<div align="center">
136+
<img src="/img/console/cti/cve-explorer/cve-events.png" alt="Screenshot — CVE events" width="70%" />
137+
</div>
138+
139+
---
140+
141+
### Detected IPs
142+
143+
CrowdSec correlates every exploit hit with the attacking source.
144+
145+
146+
147+
<div align="center">
148+
<img src="/img/console/cti/cve-explorer/cve-ips.png" alt="Screenshot — CVE Detected IPs" width="70%" />
149+
</div>
150+
151+
* **Classification** – Malicious / Suspicious / Benign
152+
* **Country & ASN** – geolocation and network owner
153+
* **Behaviours** – brute-force, aggressive crawling, etc.
154+
* **Pivot** – click any IP to open its full CrowdSec **IP Report** (see the IP-level doc).
155+
156+
Need more? Click **“See more IPs”** to expand to the full list.
157+
158+
---
159+
160+
### Blocklist
161+
162+
163+
164+
<div align="center">
165+
<img src="/img/console/cti/cve-explorer/cve-blocklist-modal.png" alt="Screenshot — CVE Blocklist wishlist" width="50%" />
166+
</div>
167+
168+
At the moment, per-CVE blocklists aren’t yet available. However, you can add any CVE to your Blocklist Wishlist.
169+
Once CrowdSec generates and publishes the dedicated Blocklist for that vulnerability, you’ll automatically receive a notification and be able to install it. This way, you can queue up your highest-priority CVEs now and be ready to deploy protection the moment the feeds go live.
170+
171+
172+
173+
## Why This CVE Monitoring Matters
174+
175+
* **Instant prioritization**: See at a glance, the vulnerabilities most threatening to your perimeter.
176+
* **Unified search**: No need to switch between NVD, vendor advisories or SIEM, logs—everything’s right here.
177+
* **Trend visibility**: Sparkline + “Trending” filter lets you jump on surging exploits before they go mainstream.
178+
* **Actionable**: Each detail page links directly IP details—so you can pivot from insight to action in few clicks.
179+
180+
With this dashboard as your starting point, you’ll always know *which* CVEs deserve your attention first, and have the tools to rapidly investigate and block the threats exploiting them.
181+
182+
> Ready to out-pace the exploiters? **Start exploring now** → [https://app.crowdsec.net/cti/cve-explorer](https://app.crowdsec.net/cti/cve-explorer)
183+
184+
*(Documentation last updated : 31 July 2025)*

‎crowdsec-docs/unversioned/console/ip_reputation/intro.mdx‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
---
2+
id: intro
3+
title: IP Reputation
4+
description: Explore CrowdSec IP Reputation
5+
---
6+
7+
// Via the console you can query and explore CrowdSec IP Reputation data. You can also manage CTI API keys that will be used in the integration we created by CrowdSec for various SIEM/SOAR/TIP platforms or your own playbooks and scripts.
8+
// links to the various sub pages
9+
// if you want more technical details, check the technical CTI API documentation (linking to the main IP Reputation/CTI section's taxonomy page)
10+

0 commit comments

Comments
 (0)