Skip to content

Commit adf4d41

Browse files
author
jdv
committed
updating content continues
1 parent b9ce3f7 commit adf4d41

12 files changed

Lines changed: 209 additions & 252 deletions
-72.1 KB
Loading
-148 KB
Loading
221 KB
Loading
223 KB
Loading
-235 KB
Binary file not shown.
-239 KB
Binary file not shown.

crowdsec-docs/unversioned/console/ip_reputation/api_keys.mdx

Lines changed: 34 additions & 33 deletions
Original file line numberDiff line numberDiff line change
@@ -8,44 +8,45 @@ import AcademyPromo from '@site/src/components/academy-promo';
88
import ThemedImage from "@theme/ThemedImage";
99
import useBaseUrl from "@docusaurus/useBaseUrl";
1010

11-
## Your first CTI Key
12-
13-
### Sign Up
14-
15-
Head over to the [CrowdSec Console](https://app.crowdsec.net/signup) and sign up for a new account.
16-
17-
<a href="https://app.crowdsec.net/signup" target="_blank">
18-
<ThemedImage
19-
alt="CrowdSec Signup Screen"
20-
sources={{
21-
light: useBaseUrl("/img/console_login_light.png"),
22-
dark: useBaseUrl("/img/console_login_dark.png"),
23-
}}
24-
/>
25-
</a>
26-
27-
## Getting an API Key
28-
29-
When you are authenticated you can click the `+` button in the top right hand corner near your profile icon to create a new API key.
30-
31-
<ThemedImage
32-
alt="CrowdSec Create API Key Dropdown"
33-
sources={{
34-
light: useBaseUrl("/img/console_create_api_key_dropdown_light.png"),
35-
dark: useBaseUrl("/img/console_create_api_key_dropdown_dark.png"),
36-
}}
37-
/>
38-
39-
On the next page you can create an API key by clicking the `+ New Key` button.
40-
11+
## Create CTI API Keys
12+
<div style={{display: 'flex', gap: '2rem', alignItems: 'flex-start'}}>
13+
<div style={{flex: '1'}}>
14+
* Click the `+` in the top right corner.
15+
* Alternatively you can also click the `+ New Key` in the **Settings → CTI API Keys** page.
16+
</div>
17+
<div style={{flex: '0 0 50%'}}>
18+
<ThemedImage
19+
alt="CrowdSec Create API Key Dropdown"
20+
sources={{
21+
light: useBaseUrl("/img/console_create_api_key_dropdown_light.png"),
22+
dark: useBaseUrl("/img/console_create_api_key_dropdown_dark.png"),
23+
}}
24+
/>
25+
</div>
26+
</div>
27+
28+
<hr/>
29+
30+
<div style={{display: 'flex', gap: '2rem', alignItems: 'flex-start'}}>
31+
<div style={{flex: '1'}}>
32+
There, you can chose among the various quotas options. We provide a free key in order to test your integrations.
33+
:::info
34+
The free quota will be better if your organization is Premium than if it's on the free Community plan.
35+
:::
36+
:::info
37+
Only Premium orgizations can buy keys with higher quotas. See [Premium API Keys](/u/console/ip_reputation/api_keys_premium) for more details.
38+
:::
39+
</div>
40+
<div style={{flex: '0 0 50%'}}>
4141
<ThemedImage
4242
alt="CrowdSec Create API Key Page"
4343
sources={{
44-
light: useBaseUrl("/img/console_create_api_key_page_light.png"),
45-
dark: useBaseUrl("/img/console_create_api_key_page_dark.png"),
44+
light: useBaseUrl("/img/console_create_api_key_form_light.png"),
45+
dark: useBaseUrl("/img/console_create_api_key_form_dark.png"),
4646
}}
4747
/>
48-
48+
</div>
49+
</div>
4950
## Accessing the API
5051

5152
### cURL
Lines changed: 71 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,76 @@
11
---
22
id: intro
3-
title: IP Reputation
4-
description: Explore CrowdSec IP Reputation
3+
title: IP Reputation / CTI
4+
description: Explore and query CrowdSec's IP Reputation data and manage CTI API keys from the Console.
55
---
66

7-
// Via the console you can query and explore CrowdSec IP Reputation data. You can also manage CTI API keys that will be used in the integration we created by CrowdSec for various SIEM/SOAR/TIP platforms or your own playbooks and scripts.
8-
// links to the various sub pages
9-
// if you want more technical details, check the technical CTI API documentation (linking to the main IP Reputation/CTI section's taxonomy page)
7+
CrowdSec's **IP Reputation / CTI** section of the Console gives you access to the world's largest crowdsourced threat intelligence network.
108

9+
From the Console you can:
10+
- **Investigate IPs** directly in the Web UI — no code required
11+
- **Explore Specific Classifications** with search queries
12+
- **Query at scale** using the CTI REST API with a managed API key
13+
14+
---
15+
16+
## Web UI Features
17+
18+
### IP Search
19+
20+
The [CTI home page](https://app.crowdsec.net/cti) lets you search any IP address or run Lucene queries against the threat database. Predefined searches give quick access to common patterns, and the **Top 10 Most Aggressive IPs** leaderboard shows the most active threat actors in the last 24 hours.
21+
22+
[IP Search →](/u/console/ip_reputation/search_ui)
23+
24+
### Advanced Search
25+
26+
The [Advanced Search page](https://app.crowdsec.net/cti) supports Lucene queries with a live faceted filter panel (reputation, country, AS, behaviors, classifications). Use it for threat hunting, bulk investigation, or building targeted blocklists.
27+
28+
[Advanced Search →](/u/console/ip_reputation/search_ui_advanced)
29+
[Search Query Reference →](/u/cti_api/search_queries)
30+
31+
### IP Report
32+
33+
Clicking any IP opens a full report with its reputation, key metadata, behaviors, classifications, MITRE techniques, CVEs, and time-windowed scores.
34+
35+
[IP Report →](/u/console/ip_reputation/ip_report)
36+
37+
### Live Exploit Tracker
38+
39+
The [Live Exploit Tracker ↗️](https://tracker.crowdsec.net/) is the evolution of the CVE Explorer — a dedicated platform for tracking vulnerabilities that are actively being exploited in the wild, powered by live data from the CrowdSec network.
40+
:::info
41+
It now resides outside the Console to provide a more focused experience and richer features, but remains fully accessible with the same CTI API key.
42+
:::
43+
44+
Beyond listing CVEs, it adds exploitation context that helps you **prioritize and act**:
45+
46+
- **CrowdSec Score** — a SOC-oriented priority signal based on observed attack patterns
47+
- **Opportunity Score** — how targeted vs. opportunistic the exploitation is (0 = mass automated scan, 5 = precisely targeted campaign)
48+
- **Momentum Score** — whether exploitation volume is growing, stable, or declining
49+
- **Exploitation Status** — from *early exploitation* to *background noise*
50+
- **Timeline** — first/last seen, CVE publication, CISA KEV addition, and key events
51+
- **Malicious IPs** — IPs actively exploiting a given CVE, with full CTI context, for threat hunting or direct blocklist integration
52+
53+
[Explore the Live Exploit Tracker ↗️](https://tracker.crowdsec.net/)
54+
55+
---
56+
57+
## API Access
58+
59+
You can query the same data programmatically using a CTI API key and the [CTI REST API](/u/cti_api/intro).
60+
61+
| Plan | Quota | Use case |
62+
|---|---|---|
63+
| **Free** | 40 queries / month | POC, low-traffic scripts |
64+
| **Premium** | 120 queries / month | Regular enrichment, small integrations |
65+
| **Premium Options** | 5K / 25K / 100K queries / month | Production integrations, SIEMs, SOARs |
66+
67+
Manage your keys in the Console under **Settings → CTI API Keys**, or go straight to [app.crowdsec.net/settings/cti-api-keys](https://app.crowdsec.net/settings/cti-api-keys).
68+
69+
[Get your first API key →](/u/console/ip_reputation/api_keys)
70+
[Premium quotas →](/u/console/ip_reputation/api_keys_premium)
71+
72+
---
73+
74+
:::tip Want the full technical reference?
75+
For API endpoints, request/response schemas, integrations (SIEM, SOAR, TIP platforms), and data taxonomy, see the [CTI API documentation](/u/cti_api/intro).
76+
:::

crowdsec-docs/unversioned/console/ip_reputation/search_ui.mdx

Lines changed: 55 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -3,33 +3,58 @@ id: search_ui
33
title: Search UI
44
---
55

6-
import ConsolePromo from '@site/src/components/console-promo';
7-
8-
# Getting Started
9-
10-
The CrowdSec Console provides a range of tools designed to bolster your infrastructure's security. We offer a range of features that can be tailored to your specific needs, including the ability to manage your Security Engines, subscribe to CrowdSec CTI, and integrate blocklists.
11-
12-
Depending on your use case you may want to start with the following guides:
13-
14-
<ConsolePromo
15-
title="CrowdSec Security Engine"
16-
description="The CrowdSec Security Engine is a powerful, open-source software for detecting and blocking malicious IPs, safeguarding both infrastructure and application security."
17-
image="Hero Security Engine.png"
18-
link="/u/getting_started/post_installation/console/"
19-
/>
20-
<br/>
21-
<ConsolePromo
22-
title="CrowdSec CTI"
23-
description="CrowdSec Cyber Threat Intelligence is the largest and most diverse CTI network on earth, delivering key contextualized and curated benchmarking insights from real users across the globe."
24-
image="Hero CTI Engine.png"
25-
link="/u/cti_api/getting_started/"
26-
/>
27-
<br/>
28-
<ConsolePromo
29-
title="CrowdSec Blocklists"
30-
description="Get immediate protection against active malicious IPs with CrowdSec’s actionable and real-time Blocklists."
31-
image="Hero Blocklists.png"
32-
link="/u/blocklists/getting_started/"
33-
/>
34-
<br/>
35-
If you're new to CrowdSec, we recommend starting with the [Security Engine](/getting_started/introduction.mdx) guide, however, if you are unsure where to start, feel free to browse our [main website for more information](https://www.crowdsec.net/).
6+
Welcome to **CrowdSec’s Cyber Threat Intelligence (CTI)**!
7+
This guide will help you navigate the **CTI Web UI** and make the most of its features, from searching for IP details to exploring real-time threat insights. Let’s get started!
8+
9+
> You can access CrowdSec's CTI via our **Web UI** on the [**CTI Home page** ↗️](https://app.crowdsec.net/cti)
10+
> Or [Create a **CTI API key** and use our **CTI API**](/u/cti_api/api_getting_started)
11+
12+
## Features on the CTI Web UI
13+
14+
The **CTI home page** is designed to give you instant access to valuable **threat intelligence**. There’s what you’ll find:
15+
<!-- Not using bullet points to avoid VS annoying auto table of content "fix" -->
16+
[An IP or Query search bar](#search-bar)
17+
[A shortcut to search your own IP](#check-your-own-ip)
18+
[Predefined query to explore our CTI](#predefined-searches)
19+
[A top 10 of the most agressive IPs](#top-10-most-aggressive-ips)
20+
21+
### Search Bar
22+
23+
A powerful search bar at the top of the page allows you to:
24+
25+
- Search for any IP address to see detailed information about its activity, risk level, and geolocation. (Example: `192.168.0.0`)
26+
- Use Lucene queries for more advanced searches to filter data based on specific criteria, such as threat type or country. _Example queries:_
27+
- `reputation:malicious`
28+
- `behaviors.label:"HTTP Bruteforce" AND location.country:"FR"`
29+
30+
![CTI Search Bar](/img/console/cti/searchbar.png)
31+
32+
### Check Your Own IP
33+
34+
A dedicated button lets you check the details of your own IP address with one click.
35+
When clicked, this feature automatically redirects you to your IP detail page.
36+
37+
![Search Check own IP button](/img/console/cti/searchbar_check_ip_button.png)
38+
39+
### Predefined Searches
40+
41+
To save time, the home page offers predefined searches showcasing typical use cases. These searches are built with Lucene queries and allow you to explore. Each predefined query is clickable, leading to a results page where you can further refine or explore the data.
42+
43+
![CTI Featured Searches](/img/console/cti/featured_searches.png)
44+
45+
### Top 10 Most Aggressive IPs
46+
47+
A dynamic leaderboard displays the top 10 most aggressive IPs observed by CrowdSec in the last 24 hours. Each entry includes:
48+
49+
- The IP address.
50+
- The attack type (e.g., brute force, DDoS).
51+
- The geographical location of the IP.
52+
- The IP range
53+
- The AS
54+
- The background noise level (More info [here](https://doc.crowdsec.net/u/console/alerts/background_noise))
55+
56+
Clicking on an IP in the list takes you to its detail page, where you can explore its full profile.
57+
58+
![Top 10 IPs](/img/console/cti/top_ten_ips.png)
59+
60+
> Start exploring the CTI home page [here](https://app.crowdsec.net/cti) and discover the latest threat intelligence to protect your infrastructure.

crowdsec-docs/unversioned/cti_api/api_introduction.md

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -31,5 +31,8 @@ When querying the CTI API about a given IP, you will get to know more about:
3131

3232
## How to access it
3333

34-
See the [getting started](/cti_api/api_getting_started.mdx) section to see how to get your API key and start exploring data.
35-
The [console](https://app.crowdsec.net) can also show a lighter version of the CTI API data.
34+
See the [getting started](/u/cti_api/api_getting_started) section to see how to get your API key and start exploring data.
35+
36+
API keys are managed in the Console under **Settings → CTI API Keys**: [app.crowdsec.net/settings/cti-api-keys](https://app.crowdsec.net/settings/cti-api-keys). See [API Keys](/u/console/ip_reputation/api_keys) for step-by-step instructions.
37+
38+
For a no-code interface to the same data, see the [IP Reputation section of the Console](/u/console/ip_reputation/intro).

0 commit comments

Comments
 (0)