You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
description: Explore and query CrowdSec's IP Reputation data and manage CTI API keys from the Console.
5
5
---
6
6
7
-
// Via the console you can query and explore CrowdSec IP Reputation data. You can also manage CTI API keys that will be used in the integration we created by CrowdSec for various SIEM/SOAR/TIP platforms or your own playbooks and scripts.
8
-
// links to the various sub pages
9
-
// if you want more technical details, check the technical CTI API documentation (linking to the main IP Reputation/CTI section's taxonomy page)
7
+
CrowdSec's **IP Reputation / CTI** section of the Console gives you access to the world's largest crowdsourced threat intelligence network.
10
8
9
+
From the Console you can:
10
+
-**Investigate IPs** directly in the Web UI — no code required
11
+
-**Explore Specific Classifications** with search queries
12
+
-**Query at scale** using the CTI REST API with a managed API key
13
+
14
+
---
15
+
16
+
## Web UI Features
17
+
18
+
### IP Search
19
+
20
+
The [CTI home page](https://app.crowdsec.net/cti) lets you search any IP address or run Lucene queries against the threat database. Predefined searches give quick access to common patterns, and the **Top 10 Most Aggressive IPs** leaderboard shows the most active threat actors in the last 24 hours.
21
+
22
+
[IP Search →](/u/console/ip_reputation/search_ui)
23
+
24
+
### Advanced Search
25
+
26
+
The [Advanced Search page](https://app.crowdsec.net/cti) supports Lucene queries with a live faceted filter panel (reputation, country, AS, behaviors, classifications). Use it for threat hunting, bulk investigation, or building targeted blocklists.
Clicking any IP opens a full report with its reputation, key metadata, behaviors, classifications, MITRE techniques, CVEs, and time-windowed scores.
34
+
35
+
[IP Report →](/u/console/ip_reputation/ip_report)
36
+
37
+
### Live Exploit Tracker
38
+
39
+
The [Live Exploit Tracker ↗️](https://tracker.crowdsec.net/) is the evolution of the CVE Explorer — a dedicated platform for tracking vulnerabilities that are actively being exploited in the wild, powered by live data from the CrowdSec network.
40
+
:::info
41
+
It now resides outside the Console to provide a more focused experience and richer features, but remains fully accessible with the same CTI API key.
42
+
:::
43
+
44
+
Beyond listing CVEs, it adds exploitation context that helps you **prioritize and act**:
45
+
46
+
-**CrowdSec Score** — a SOC-oriented priority signal based on observed attack patterns
47
+
-**Opportunity Score** — how targeted vs. opportunistic the exploitation is (0 = mass automated scan, 5 = precisely targeted campaign)
48
+
-**Momentum Score** — whether exploitation volume is growing, stable, or declining
49
+
-**Exploitation Status** — from *early exploitation* to *background noise*
Manage your keys in the Console under **Settings → CTI API Keys**, or go straight to [app.crowdsec.net/settings/cti-api-keys](https://app.crowdsec.net/settings/cti-api-keys).
68
+
69
+
[Get your first API key →](/u/console/ip_reputation/api_keys)
For API endpoints, request/response schemas, integrations (SIEM, SOAR, TIP platforms), and data taxonomy, see the [CTI API documentation](/u/cti_api/intro).
The CrowdSec Console provides a range of tools designed to bolster your infrastructure's security. We offer a range of features that can be tailored to your specific needs, including the ability to manage your Security Engines, subscribe to CrowdSec CTI, and integrate blocklists.
11
-
12
-
Depending on your use case you may want to start with the following guides:
13
-
14
-
<ConsolePromo
15
-
title="CrowdSec Security Engine"
16
-
description="The CrowdSec Security Engine is a powerful, open-source software for detecting and blocking malicious IPs, safeguarding both infrastructure and application security."
description="CrowdSec Cyber Threat Intelligence is the largest and most diverse CTI network on earth, delivering key contextualized and curated benchmarking insights from real users across the globe."
24
-
image="Hero CTI Engine.png"
25
-
link="/u/cti_api/getting_started/"
26
-
/>
27
-
<br/>
28
-
<ConsolePromo
29
-
title="CrowdSec Blocklists"
30
-
description="Get immediate protection against active malicious IPs with CrowdSec’s actionable and real-time Blocklists."
31
-
image="Hero Blocklists.png"
32
-
link="/u/blocklists/getting_started/"
33
-
/>
34
-
<br/>
35
-
If you're new to CrowdSec, we recommend starting with the [Security Engine](/getting_started/introduction.mdx) guide, however, if you are unsure where to start, feel free to browse our [main website for more information](https://www.crowdsec.net/).
6
+
Welcome to **CrowdSec’s Cyber Threat Intelligence (CTI)**!
7
+
This guide will help you navigate the **CTI Web UI** and make the most of its features, from searching for IP details to exploring real-time threat insights. Let’s get started!
8
+
9
+
> You can access CrowdSec's CTI via our **Web UI** on the [**CTI Home page** ↗️](https://app.crowdsec.net/cti)
10
+
> Or [Create a **CTI API key** and use our **CTI API**](/u/cti_api/api_getting_started)
11
+
12
+
## Features on the CTI Web UI
13
+
14
+
The **CTI home page** is designed to give you instant access to valuable **threat intelligence**. There’s what you’ll find:
Copy file name to clipboardExpand all lines: crowdsec-docs/unversioned/cti_api/api_introduction.md
+5-2Lines changed: 5 additions & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -31,5 +31,8 @@ When querying the CTI API about a given IP, you will get to know more about:
31
31
32
32
## How to access it
33
33
34
-
See the [getting started](/cti_api/api_getting_started.mdx) section to see how to get your API key and start exploring data.
35
-
The [console](https://app.crowdsec.net) can also show a lighter version of the CTI API data.
34
+
See the [getting started](/u/cti_api/api_getting_started) section to see how to get your API key and start exploring data.
35
+
36
+
API keys are managed in the Console under **Settings → CTI API Keys**: [app.crowdsec.net/settings/cti-api-keys](https://app.crowdsec.net/settings/cti-api-keys). See [API Keys](/u/console/ip_reputation/api_keys) for step-by-step instructions.
37
+
38
+
For a no-code interface to the same data, see the [IP Reputation section of the Console](/u/console/ip_reputation/intro).
0 commit comments