You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: crowdsec-docs/unversioned/console/ip_reputation/api_keys.mdx
+3-231Lines changed: 3 additions & 231 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -47,240 +47,12 @@ Only Premium orgizations can buy keys with higher quotas. See [Premium API Keys]
47
47
/>
48
48
</div>
49
49
</div>
50
-
## Accessing the API
50
+
## Using the API
51
51
52
-
### cURL
52
+
CrowdSec provides [ready-made integrations](/u/cti_api/api_integration/integration_intro) for the most common security platforms — SIEM, SOAR, TIP, and investigation tools. If your platform is listed, that's the fastest way to get started.
53
53
54
-
You can test your newly created API key by running the following command in your terminal:
54
+
If you prefer to use your own scripts, call the API directly from the command line, or build custom playbooks, the API is a straightforward REST interface authenticated with your key.
"description": "IP has been reported for performing actions related to HTTP vulnerability scanning and discovery."
89
-
},
90
-
{
91
-
"name": "ssh:bruteforce",
92
-
"label": "SSH Bruteforce",
93
-
"description": "IP has been reported for performing brute force on ssh services."
94
-
},
95
-
{
96
-
"name": "http:exploit",
97
-
"label": "HTTP Exploit",
98
-
"description": "IP has been reported for attempting to exploit a vulnerability in a web application."
99
-
},
100
-
{
101
-
"name": "generic:exploit",
102
-
"label": "Exploitation attempt",
103
-
"description": "IP has been reported trying to exploit known vulnerability/CVE on unspecified protocols."
104
-
}
105
-
],
106
-
"history": {
107
-
"first_seen": "2022-05-28T16:00:00+00:00",
108
-
"last_seen": "2023-10-15T05:45:00+00:00",
109
-
"full_age": 507,
110
-
"days_age": 505
111
-
},
112
-
"classifications": {
113
-
"false_positives": [],
114
-
"classifications": []
115
-
},
116
-
"attack_details": [
117
-
{
118
-
"name": "crowdsecurity/http-probing",
119
-
"label": "HTTP Probing",
120
-
"description": "Detect site scanning/probing from a single ip",
121
-
"references": []
122
-
},
123
-
{
124
-
"name": "crowdsecurity/ssh-bf",
125
-
"label": "SSH Bruteforce",
126
-
"description": "Detect ssh bruteforce",
127
-
"references": []
128
-
},
129
-
{
130
-
"name": "crowdsecurity/ssh-slow-bf",
131
-
"label": "SSH Bruteforce",
132
-
"description": "Detect slow ssh bruteforce",
133
-
"references": []
134
-
},
135
-
{
136
-
"name": "crowdsecurity/http-bad-user-agent",
137
-
"label": "detection of bad user-agents",
138
-
"description": "Detect bad user-agents",
139
-
"references": []
140
-
},
141
-
{
142
-
"name": "crowdsecurity/suricata-major-severity",
143
-
"label": "Suricata Severity 1 Event",
144
-
"description": "Detect exploit attempts via emerging threat rules",
145
-
"references": []
146
-
},
147
-
{
148
-
"name": "crowdsecurity/modsecurity",
149
-
"label": "Modsecurity Alert",
150
-
"description": "Web exploitation via modsecurity",
151
-
"references": []
152
-
}
153
-
],
154
-
"target_countries": {
155
-
"AT": 0,
156
-
"AU": 2,
157
-
"BR": 0,
158
-
"CA": 4,
159
-
"CH": 0,
160
-
"CN": 0,
161
-
"DE": 79,
162
-
"DK": 0,
163
-
"ES": 0,
164
-
"FI": 12
165
-
},
166
-
"background_noise_score": 10,
167
-
"mitre_techniques": [
168
-
{
169
-
"name": "T1595",
170
-
"label": "Active Scanning",
171
-
"description": "Adversaries may execute active reconnaissance scans to gather information that can be used during targeting. Active scans are those where the adversary probes victim infrastructure via network traffic, as opposed to other forms of reconnaissance that do not involve direct interaction.\n\nAdversaries may perform different forms of active scanning depending on what information they seek to gather. These scans can also be performed in various ways, including using native features of network protocols such as ICMP.(Citation: Botnet Scan)(Citation: OWASP Fingerprinting) Information from these scans may reveal opportunities for other forms of reconnaissance (ex: [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593) or [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596)), establishing operational resources (ex: [Develop Capabilities](https://attack.mitre.org/techniques/T1587) or [Obtain Capabilities](https://attack.mitre.org/techniques/T1588)), and/or initial access (ex: [External Remote Services](https://attack.mitre.org/techniques/T1133) or [Exploit Public-Facing Application](https://attack.mitre.org/techniques/T1190))."
172
-
},
173
-
{
174
-
"name": "T1110",
175
-
"label": "Brute Force",
176
-
"description": "Adversaries may use brute force techniques to gain access to accounts when passwords are unknown or when password hashes are obtained. Without knowledge of the password for an account or set of accounts, an adversary may systematically guess the password using a repetitive or iterative mechanism. Brute forcing passwords can take place via interaction with a service that will check the validity of those credentials or offline against previously acquired credential data, such as password hashes.\n\nBrute forcing credentials may take place at various points during a breach. For example, adversaries may attempt to brute force access to [Valid Accounts](https://attack.mitre.org/techniques/T1078) within a victim environment leveraging knowledge gathered from other post-compromise behaviors such as [OS Credential Dumping](https://attack.mitre.org/techniques/T1003), [Account Discovery](https://attack.mitre.org/techniques/T1087), or [Password Policy Discovery](https://attack.mitre.org/techniques/T1201). Adversaries may also combine brute forcing activity with behaviors such as [External Remote Services](https://attack.mitre.org/techniques/T1133) as part of Initial Access."
177
-
},
178
-
{
179
-
"name": "T1190",
180
-
"label": "Exploit Public-Facing Application",
181
-
"description": "Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.\n\nExploited applications are often websites/web servers, but can also include databases (like SQL), standard services (like SMB or SSH), network device administration and management protocols (like SNMP and Smart Install), and any other system with Internet accessible open sockets.(Citation: NVD CVE-2016-6662)(Citation: CIS Multiple SMB Vulnerabilities)(Citation: US-CERT TA18-106A Network Infrastructure Devices 2018)(Citation: Cisco Blog Legacy Device Attacks)(Citation: NVD CVE-2014-7169) Depending on the flaw being exploited this may also involve [Exploitation for Defense Evasion](https://attack.mitre.org/techniques/T1211). \n\nIf an application is hosted on cloud-based infrastructure and/or is containerized, then exploiting it may lead to compromise of the underlying instance or container. This can allow an adversary a path to access the cloud or container APIs, exploit container host access via [Escape to Host](https://attack.mitre.org/techniques/T1611), or take advantage of weak identity and access management policies.\n\nAdversaries may also exploit edge network infrastructure and related appliances, specifically targeting devices that do not support robust host-based defenses.(Citation: Mandiant Fortinet Zero Day)(Citation: Wired Russia Cyberwar)\n\nFor websites and databases, the OWASP top 10 and CWE top 25 highlight the most common web-based vulnerabilities.(Citation: OWASP Top 10)(Citation: CWE top 25)"
182
-
}
183
-
],
184
-
"cves": [],
185
-
"scores": {
186
-
"overall": {
187
-
"aggressiveness": 5,
188
-
"threat": 2,
189
-
"trust": 4,
190
-
"anomaly": 0,
191
-
"total": 4
192
-
},
193
-
"last_day": {
194
-
"aggressiveness": 0,
195
-
"threat": 0,
196
-
"trust": 0,
197
-
"anomaly": 0,
198
-
"total": 0
199
-
},
200
-
"last_week": {
201
-
"aggressiveness": 5,
202
-
"threat": 2,
203
-
"trust": 4,
204
-
"anomaly": 0,
205
-
"total": 4
206
-
},
207
-
"last_month": {
208
-
"aggressiveness": 5,
209
-
"threat": 2,
210
-
"trust": 4,
211
-
"anomaly": 0,
212
-
"total": 4
213
-
}
214
-
},
215
-
"references": []
216
-
}
217
-
218
-
```
219
-
220
-
</details>
221
-
222
-
### ipdex
223
-
224
-
You can interact with the CrowdSec CTI API with the [`ipdex`](https://github.com/crowdsecurity/ipdex) tool.
Copy file name to clipboardExpand all lines: crowdsec-docs/unversioned/console/ip_reputation/api_keys_premium.mdx
+11-3Lines changed: 11 additions & 3 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -4,7 +4,15 @@ title: Premium CTI API Keys
4
4
sidebar_position: 2
5
5
---
6
6
7
-
// Premium plan come with increased quotas on its free CTI KEY
8
-
// also allow oyu to buy bigger quotas CTI API Keys if needed
7
+
A [Premium Plan](/u/console/premium_upgrade) unlocks two benefits for CTI API access:
9
8
10
-
...
9
+
-**Increased free quota** — the complimentary CTI key included with every account has a higher weekly allowance on a Premium plan than on the free Community plan.
10
+
-**Purchasable high-quota keys** — Premium organizations can buy additional CTI API keys with larger monthly quotas (5K, 25K, or 100K queries/month) to support production integrations, automated enrichment pipelines, and high-volume use cases.
11
+
12
+
For current quota tiers and pricing, go to **Settings → CTI API Keys** in the Console and click **+ New Key** — all available options and their costs are shown there.
13
+
14
+
:::warning CTI API Keys and trials
15
+
- Purchasing a CTI API Key does **not** grant access to a Premium Plan trial.
16
+
- Purchasing a CTI API Key while a trial is active will **immediately end the trial**.
17
+
- Cancelled CTI API Keys are **non-refundable** and will not be prorated — the full price remains due regardless of when the cancellation occurs.
Copy file name to clipboardExpand all lines: crowdsec-docs/unversioned/cti_api/api_integration/integration_intro.md
+10Lines changed: 10 additions & 0 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -3,6 +3,16 @@ id: integration_intro
3
3
title: Integrations
4
4
---
5
5
6
+
CrowdSec has developed native integrations for the most common security platforms so you can enrich your workflows with IP reputation data without writing any code. If your platform isn't listed, the API is a standard REST interface — you can query it directly with cURL, write your own scripts, or build custom playbooks in any SIEM, SOAR, or TIP that supports HTTP enrichment:
Copy file name to clipboardExpand all lines: crowdsec-docs/unversioned/cti_api/api_integration/integration_ipdex.md
+18-11Lines changed: 18 additions & 11 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -4,27 +4,34 @@ title: IPDEX
4
4
sidebar_position: 1
5
5
---
6
6
7
-
`ipdex` is a simple CLI tool developed by CrowdSec to gather insight about a list of IPs or an IP using the CrowdSec CTI (Cyber Threat Intelligence) API.
7
+
`ipdex` is a tool developed by CrowdSec to investigate IP reputation using the CrowdSec CTI API. It is available as a **web application** and a **CLI**, and is particularly useful as a Proof of Value tool to assess CrowdSec's threat intelligence coverage across both blocklists and threat intel data.
The [ipdex web app](https://ipdex.crowdsec.net/) lets you upload a list of IPs or a log file and instantly get a reputation report — no installation required.
12
12
13
-
You can check the [install guide on ipdex repository](https://github.com/crowdsecurity/ipdex?tab=readme-ov-file#1-install).
13
+
14
14
15
+
For full usage documentation, see [ipdex.crowdsec.net/docs](https://ipdex.crowdsec.net/docs).
15
16
16
-
## Usage
17
+
## CLI
17
18
18
-
You can check the [user guide on ipdex repository](https://github.com/crowdsecurity/ipdex?tab=readme-ov-file#user-guide).
19
+
The CLI version is available for local use and automation. It connects to the CTI API using your API key.
19
20
20
-
Here are some screenshot to demonstrate ipdex user experience.
0 commit comments