diff --git a/.gitignore b/.gitignore index 62551d255..4c236fefd 100644 --- a/.gitignore +++ b/.gitignore @@ -1,3 +1,4 @@ .vscode node_modules -.history \ No newline at end of file +.history +ai-session \ No newline at end of file diff --git a/CURRENT_HIERARCHY.json b/CURRENT_HIERARCHY.json deleted file mode 100644 index 6ae7e82c5..000000000 --- a/CURRENT_HIERARCHY.json +++ /dev/null @@ -1,810 +0,0 @@ -{ - "name": "CrowdSec Documentation", - "type": "Root", - "short_description": "CrowdSec documentation site root — multi-product security platform docs", - "children": [ - { - "name": "Homepage", - "type": "presentation", - "path": "/", - "file_path": "crowdsec-docs/src/pages/index.tsx", - "short_description": "Documentation homepage with 3 product cards: Security Engine, Blocklists, CTI", - "children": [] - }, - { - "name": "Security Engine", - "type": "presentation", - "path": "/security-engine", - "file_path": "crowdsec-docs/src/pages/security-engine.tsx", - "short_description": "Product landing page — detect and block malicious behavior, analyzes logs, shares intelligence, powers AppSec protection", - "children": [] - }, - { - "name": "Blocklists", - "type": "presentation", - "path": "/blocklists", - "file_path": "crowdsec-docs/src/pages/blocklists.tsx", - "short_description": "Product landing page — subscribe to curated threat intelligence feeds, deploy in minutes to firewalls", - "children": [] - }, - { - "name": "CTI", - "type": "presentation", - "path": "/cti", - "file_path": "crowdsec-docs/src/pages/cti.tsx", - "short_description": "Product landing page — query CrowdSec threat intelligence to enrich investigations, get IP reputation data", - "children": [] - }, - { - "name": "Security Stack", - "type": "NavBarItem", - "short_description": "Navbar dropdown grouping all technical stack components", - "children": [ - { - "name": "Security Engine", - "type": "NavBarItem", - "links_to": "/docs/next/intro", - "short_description": "Entry point into the versioned Security Engine technical docs", - "children": [ - { - "name": "Introduction", - "type": "presentation", - "path": "/docs/next/intro", - "file_path": "crowdsec-docs/docs/intro.md", - "short_description": "What is the CrowdSec Security Engine — open-source lightweight security engine overview", - "children": [] - }, - { - "name": "Concepts", - "type": "presentation", - "path": "/docs/next/concepts", - "file_path": "crowdsec-docs/docs/concepts.md", - "short_description": "Core CrowdSec concepts and how components interact", - "children": [] - }, - { - "name": "Log Processor", - "type": "NavBarItem", - "short_description": "Core component that reads logs and detects attacks", - "children": [ - { - "name": "Introduction", - "type": "presentation", - "path": "/docs/next/log_processor/intro", - "file_path": "crowdsec-docs/docs/log_processor/intro.md", - "short_description": "Introduction to the Log Processor component", - "children": [] - }, - { - "name": "Data Sources", - "type": "NavBarItem", - "short_description": "Log acquisition datasources supported by the Security Engine", - "children": [ - { - "name": "Introduction", - "type": "presentation", - "path": "/docs/next/log_processor/data_sources/intro", - "file_path": "crowdsec-docs/docs/log_processor/data_sources/intro.md", - "short_description": "Overview of acquisition datasources", - "children": [] - }, - { "name": "AppSec", "type": "technical doc", "path": "/docs/next/log_processor/data_sources/appsec", "file_path": "crowdsec-docs/docs/log_processor/data_sources/appsec.md", "short_description": "Application Security Component data source", "children": [] }, - { "name": "AWS CloudWatch", "type": "technical doc", "path": "/docs/next/log_processor/data_sources/cloudwatch", "file_path": "crowdsec-docs/docs/log_processor/data_sources/cloudwatch.md", "short_description": "AWS CloudWatch log acquisition", "children": [] }, - { "name": "AWS Kinesis", "type": "technical doc", "path": "/docs/next/log_processor/data_sources/kinesis", "file_path": "crowdsec-docs/docs/log_processor/data_sources/kinesis.md", "short_description": "AWS Kinesis stream log acquisition", "children": [] }, - { "name": "AWS S3", "type": "technical doc", "path": "/docs/next/log_processor/data_sources/s3", "file_path": "crowdsec-docs/docs/log_processor/data_sources/s3.md", "short_description": "S3 bucket log acquisition", "children": [] }, - { "name": "Docker", "type": "technical doc", "path": "/docs/next/log_processor/data_sources/docker", "file_path": "crowdsec-docs/docs/log_processor/data_sources/docker.md", "short_description": "Docker container log acquisition", "children": [] }, - { "name": "File(s)", "type": "technical doc", "path": "/docs/next/log_processor/data_sources/file", "file_path": "crowdsec-docs/docs/log_processor/data_sources/file.md", "short_description": "Text and GZ file log acquisition", "children": [] }, - { "name": "HTTP", "type": "technical doc", "path": "/docs/next/log_processor/data_sources/http", "file_path": "crowdsec-docs/docs/log_processor/data_sources/http.md", "short_description": "HTTP endpoint log acquisition", "children": [] }, - { "name": "Journald", "type": "technical doc", "path": "/docs/next/log_processor/data_sources/journald", "file_path": "crowdsec-docs/docs/log_processor/data_sources/journald.md", "short_description": "Journalctl log acquisition", "children": [] }, - { "name": "Kafka", "type": "technical doc", "path": "/docs/next/log_processor/data_sources/kafka", "file_path": "crowdsec-docs/docs/log_processor/data_sources/kafka.md", "short_description": "Kafka topic log acquisition", "children": [] }, - { "name": "Kubernetes Audit", "type": "technical doc", "path": "/docs/next/log_processor/data_sources/kubernetes_audit", "file_path": "crowdsec-docs/docs/log_processor/data_sources/kubernetes_audit.md", "short_description": "Kubernetes audit log acquisition", "children": [] }, - { "name": "Loki", "type": "technical doc", "path": "/docs/next/log_processor/data_sources/loki", "file_path": "crowdsec-docs/docs/log_processor/data_sources/loki.md", "short_description": "Loki query log acquisition", "children": [] }, - { "name": "VictoriaLogs", "type": "technical doc", "path": "/docs/next/log_processor/data_sources/victorialogs", "file_path": "crowdsec-docs/docs/log_processor/data_sources/victorialogs.md", "short_description": "VictoriaLogs query acquisition", "children": [] }, - { "name": "Syslog", "type": "technical doc", "path": "/docs/next/log_processor/data_sources/syslog", "file_path": "crowdsec-docs/docs/log_processor/data_sources/syslog.md", "short_description": "Syslog server log acquisition", "children": [] }, - { "name": "Windows Event Log", "type": "technical doc", "path": "/docs/next/log_processor/data_sources/windows_evt_log", "file_path": "crowdsec-docs/docs/log_processor/data_sources/windows_evt_log.md", "short_description": "Windows Event Log acquisition", "children": [] }, - { "name": "Monitoring", "type": "technical doc", "path": "/docs/next/log_processor/data_sources/troubleshoot", "file_path": "crowdsec-docs/docs/log_processor/data_sources/troubleshoot.md", "short_description": "Prometheus metrics for acquisition monitoring", "children": [] } - ] - }, - { - "name": "Parsers", - "type": "NavBarItem", - "short_description": "YAML-based log parsing configurations", - "children": [ - { "name": "Introduction", "type": "presentation", "path": "/docs/next/log_processor/parsers/intro", "file_path": "crowdsec-docs/docs/log_processor/parsers/intro.md", "short_description": "What a parser is and how it works", "children": [] }, - { "name": "Format", "type": "technical doc", "path": "/docs/next/log_processor/parsers/format", "file_path": "crowdsec-docs/docs/log_processor/parsers/format.md", "short_description": "Parser configuration file format reference", "children": [] }, - { "name": "Creating Parsers", "type": "guide", "path": "/docs/next/log_processor/parsers/create", "file_path": "crowdsec-docs/docs/log_processor/parsers/create.md", "short_description": "Step-by-step guide to writing a custom parser", "children": [] }, - { "name": "Enrichers", "type": "technical doc", "path": "/docs/next/log_processor/parsers/enricher", "file_path": "crowdsec-docs/docs/log_processor/parsers/enricher.md", "short_description": "Parsers that rely on external methods for extra context", "children": [] }, - { "name": "Default Patterns", "type": "reference", "path": "/docs/next/log_processor/parsers/patterns", "file_path": "crowdsec-docs/docs/log_processor/parsers/patterns.md", "short_description": "Auto-generated documentation of all default patterns", "children": [] } - ] - }, - { - "name": "Scenarios", - "type": "NavBarItem", - "short_description": "YAML files that detect specific attack behaviors", - "children": [ - { "name": "Introduction", "type": "presentation", "path": "/docs/next/log_processor/scenarios/intro", "file_path": "crowdsec-docs/docs/log_processor/scenarios/intro.md", "short_description": "What a scenario is and how it detects behaviors", "children": [] }, - { "name": "Format", "type": "technical doc", "path": "/docs/next/log_processor/scenarios/format", "file_path": "crowdsec-docs/docs/log_processor/scenarios/format.md", "short_description": "Scenario configuration file format reference", "children": [] }, - { "name": "Simulation", "type": "guide", "path": "/docs/next/log_processor/scenarios/simulation", "file_path": "crowdsec-docs/docs/log_processor/scenarios/simulation.md", "short_description": "Test scenarios in simulation mode without triggering real bans", "children": [] }, - { "name": "Creating Scenarios", "type": "guide", "path": "/docs/next/log_processor/scenarios/create", "file_path": "crowdsec-docs/docs/log_processor/scenarios/create.md", "short_description": "Step-by-step guide to writing a custom scenario", "children": [] }, - { "name": "Deploy", "type": "guide", "path": "/docs/next/log_processor/scenarios/deploy", "file_path": "crowdsec-docs/docs/log_processor/scenarios/deploy.md", "short_description": "Deploying custom scenarios to the engine", "children": [] } - ] - }, - { - "name": "Collections", - "type": "NavBarItem", - "short_description": "Bundles of detection content installed together", - "children": [ - { "name": "Introduction", "type": "presentation", "path": "/docs/next/log_processor/collections/intro", "file_path": "crowdsec-docs/docs/log_processor/collections/intro.md", "short_description": "What collections are and how to use them", "children": [] }, - { "name": "Format", "type": "technical doc", "path": "/docs/next/log_processor/collections/format", "file_path": "crowdsec-docs/docs/log_processor/collections/format.md", "short_description": "Collection configuration file format", "children": [] } - ] - }, - { - "name": "Whitelists", - "type": "NavBarItem", - "short_description": "Rules to exclude trusted IPs or events from detection", - "children": [ - { "name": "Introduction", "type": "presentation", "path": "/docs/next/log_processor/whitelist/intro", "file_path": "crowdsec-docs/docs/log_processor/whitelist/intro.md", "short_description": "Overview of whitelist types and usage", "children": [] }, - { "name": "Format", "type": "technical doc", "path": "/docs/next/log_processor/whitelist/format", "file_path": "crowdsec-docs/docs/log_processor/whitelist/format.md", "short_description": "Whitelist configuration format", "children": [] }, - { "name": "IP / CIDR Whitelist", "type": "guide", "path": "/docs/next/log_processor/whitelist/create_ip", "file_path": "crowdsec-docs/docs/log_processor/whitelist/create_ip.md", "short_description": "Creating IP or CIDR-based whitelists", "children": [] }, - { "name": "Expression Whitelist", "type": "guide", "path": "/docs/next/log_processor/whitelist/create_expr", "file_path": "crowdsec-docs/docs/log_processor/whitelist/create_expr.md", "short_description": "Creating expression-based whitelists", "children": [] }, - { "name": "Postoverflow Whitelist", "type": "guide", "path": "/docs/next/log_processor/whitelist/create_postoverflow", "file_path": "crowdsec-docs/docs/log_processor/whitelist/create_postoverflow.md", "short_description": "Whitelisting at postoverflow stage", "children": [] }, - { "name": "FQDN Whitelist", "type": "guide", "path": "/docs/next/log_processor/whitelist/create_fqdn", "file_path": "crowdsec-docs/docs/log_processor/whitelist/create_fqdn.md", "short_description": "Whitelisting by fully qualified domain name", "children": [] }, - { "name": "CAPI Whitelist (deprecated)", "type": "guide", "path": "/docs/next/log_processor/whitelist/create_capi", "file_path": "crowdsec-docs/docs/log_processor/whitelist/create_capi.md", "short_description": "Deprecated CAPI-based whitelist", "children": [] } - ] - }, - { - "name": "Service Discovery", - "type": "NavBarItem", - "short_description": "Auto-detect running services and configure acquisitions", - "children": [ - { "name": "Introduction", "type": "presentation", "path": "/docs/next/log_processor/service-discovery-setup/intro", "file_path": "crowdsec-docs/docs/log_processor/service-discovery-setup/intro.md", "short_description": "Overview of automatic service discovery setup", "children": [] }, - { "name": "Detect YAML Syntax", "type": "technical doc", "path": "/docs/next/log_processor/service-discovery-setup/detect-yaml", "file_path": "crowdsec-docs/docs/log_processor/service-discovery-setup/detect-yaml.md", "short_description": "YAML syntax for service discovery definitions", "children": [] }, - { "name": "Expr Helpers", "type": "technical doc", "path": "/docs/next/log_processor/service-discovery-setup/setup-expr-helpers", "file_path": "crowdsec-docs/docs/log_processor/service-discovery-setup/setup-expr-helpers.md", "short_description": "Expr helpers available during service discovery", "children": [] } - ] - }, - { - "name": "Alert Context", - "type": "guide", - "path": "/docs/next/log_processor/alert_context/intro", - "file_path": "crowdsec-docs/docs/log_processor/alert_context/intro.md", - "short_description": "Attach contextual data to alerts during log processing", - "children": [] - } - ] - }, - { - "name": "Local API", - "type": "NavBarItem", - "short_description": "Core component connecting the engine to bouncers and the Central API", - "children": [ - { - "name": "Introduction", - "type": "presentation", - "path": "/docs/next/local_api/intro", - "file_path": "crowdsec-docs/docs/local_api/intro.md", - "short_description": "Role of the Local API in the CrowdSec architecture", - "children": [] - }, - { - "name": "Profiles", - "type": "NavBarItem", - "short_description": "Define which remediation decisions to apply when a scenario fires", - "children": [ - { "name": "Introduction", "type": "presentation", "path": "/docs/next/local_api/profiles/intro", "file_path": "crowdsec-docs/docs/local_api/profiles/intro.md", "short_description": "Overview of profiles and their role in remediation decisions", "children": [] }, - { "name": "Format", "type": "technical doc", "path": "/docs/next/local_api/profiles/format", "file_path": "crowdsec-docs/docs/local_api/profiles/format.md", "short_description": "Profile YAML configuration format", "children": [] }, - { "name": "CTI Profile Example", "type": "guide", "path": "/docs/next/local_api/profiles/cti_profile", "file_path": "crowdsec-docs/docs/local_api/profiles/cti_profile.md", "short_description": "Profile that uses CTI data to make remediation decisions", "children": [] }, - { "name": "Captcha Profile Example", "type": "guide", "path": "/docs/next/local_api/profiles/captcha_profile", "file_path": "crowdsec-docs/docs/local_api/profiles/captcha_profile.md", "short_description": "Profile that serves a captcha challenge", "children": [] }, - { "name": "PID Profile Example", "type": "guide", "path": "/docs/next/local_api/profiles/pid_profile", "file_path": "crowdsec-docs/docs/local_api/profiles/pid_profile.md", "short_description": "Profile using PID-based decision logic", "children": [] } - ] - }, - { - "name": "Notification Plugins", - "type": "NavBarItem", - "short_description": "Push alerts to third-party services via notification plugins", - "children": [ - { "name": "Introduction", "type": "presentation", "path": "/docs/next/local_api/notification_plugins/intro", "file_path": "crowdsec-docs/docs/local_api/notification_plugins/intro.md", "short_description": "Overview of notification plugins and how they work", "children": [] }, - { "name": "HTTP Plugin", "type": "feature page", "path": "/docs/next/local_api/notification_plugins/http", "file_path": "crowdsec-docs/docs/local_api/notification_plugins/http.md", "short_description": "HTTP-based notification plugin", "children": [] }, - { "name": "Email Plugin", "type": "feature page", "path": "/docs/next/local_api/notification_plugins/email", "file_path": "crowdsec-docs/docs/local_api/notification_plugins/email.md", "short_description": "Send alerts via email", "children": [] }, - { "name": "Slack Plugin", "type": "feature page", "path": "/docs/next/local_api/notification_plugins/slack", "file_path": "crowdsec-docs/docs/local_api/notification_plugins/slack.md", "short_description": "Send alerts to Slack", "children": [] }, - { "name": "Splunk Plugin", "type": "feature page", "path": "/docs/next/local_api/notification_plugins/splunk", "file_path": "crowdsec-docs/docs/local_api/notification_plugins/splunk.md", "short_description": "Send alerts to Splunk", "children": [] }, - { "name": "File Plugin", "type": "feature page", "path": "/docs/next/local_api/notification_plugins/file", "file_path": "crowdsec-docs/docs/local_api/notification_plugins/file.md", "short_description": "Write alerts to an external file", "children": [] }, - { "name": "Sentinel Plugin", "type": "feature page", "path": "/docs/next/local_api/notification_plugins/sentinel", "file_path": "crowdsec-docs/docs/local_api/notification_plugins/sentinel.md", "short_description": "Send alerts to Microsoft Sentinel", "children": [] }, - { "name": "Microsoft Teams", "type": "feature page", "path": "/docs/next/local_api/notification_plugins/teams", "file_path": "crowdsec-docs/docs/local_api/notification_plugins/teams.md", "short_description": "Send alerts to Microsoft Teams via HTTP plugin", "children": [] }, - { "name": "Elasticsearch Plugin", "type": "feature page", "path": "/docs/next/local_api/notification_plugins/elastic", "file_path": "crowdsec-docs/docs/local_api/notification_plugins/elastic.md", "short_description": "Send alerts to Elasticsearch", "children": [] }, - { "name": "Telegram Plugin", "type": "feature page", "path": "/docs/next/local_api/notification_plugins/telegram", "file_path": "crowdsec-docs/docs/local_api/notification_plugins/telegram.md", "short_description": "Send alerts to Telegram", "children": [] }, - { "name": "Gotify Plugin", "type": "feature page", "path": "/docs/next/local_api/notification_plugins/gotify", "file_path": "crowdsec-docs/docs/local_api/notification_plugins/gotify.md", "short_description": "Send alerts to Gotify", "children": [] }, - { "name": "Template Helpers", "type": "technical doc", "path": "/docs/next/local_api/notification_plugins/template_helpers", "file_path": "crowdsec-docs/docs/local_api/notification_plugins/template_helpers.md", "short_description": "Custom helpers for notification templates", "children": [] }, - { "name": "Writing Your Own Plugin (Go)", "type": "guide", "path": "/docs/next/local_api/notification_plugins/writing_your_own_plugin", "file_path": "crowdsec-docs/docs/local_api/notification_plugins/writing_your_own_plugin.md", "short_description": "Implement a custom notification plugin in Go", "children": [] }, - { "name": "Testing Notification Plugins", "type": "guide", "path": "/docs/next/local_api/notification_plugins/testing", "file_path": "crowdsec-docs/docs/local_api/notification_plugins/testing.md", "short_description": "Validate notification plugins from config to end-to-end delivery", "children": [] } - ] - }, - { "name": "Databases", "type": "technical doc", "path": "/docs/next/local_api/database", "file_path": "crowdsec-docs/docs/local_api/database.md", "short_description": "Backend database support (SQLite default)", "children": [] }, - { "name": "For Remediation Components", "type": "technical doc", "path": "/docs/next/local_api/bouncers", "file_path": "crowdsec-docs/docs/local_api/bouncers.md", "short_description": "How bouncers interact with the Local API", "children": [] }, - { "name": "Configuration", "type": "technical doc", "path": "/docs/next/local_api/configuration", "file_path": "crowdsec-docs/docs/local_api/configuration.md", "short_description": "LAPI configuration options", "children": [] }, - { "name": "Authentication", "type": "technical doc", "path": "/docs/next/local_api/authentication", "file_path": "crowdsec-docs/docs/local_api/authentication.md", "short_description": "Three authentication modes for the Local API", "children": [] }, - { "name": "TLS Authentication", "type": "technical doc", "path": "/docs/next/local_api/tls_auth", "file_path": "crowdsec-docs/docs/local_api/tls_auth.md", "short_description": "TLS client authentication for the LAPI", "children": [] }, - { "name": "Centralized Allowlists", "type": "feature page", "path": "/docs/next/local_api/centralized_allowlists", "file_path": "crowdsec-docs/docs/local_api/centralized_allowlists.md", "short_description": "Manage IP-based allowlists at the LAPI level", "children": [] } - ] - }, - { - "name": "Central API", - "type": "NavBarItem", - "short_description": "CrowdSec's cloud-based community intelligence sharing layer", - "children": [ - { "name": "Introduction", "type": "presentation", "path": "/docs/next/central_api/intro", "file_path": "crowdsec-docs/docs/central_api/intro.md", "short_description": "Overview of the Central API and its role", "children": [] }, - { "name": "Community Blocklist", "type": "feature page", "path": "/docs/next/central_api/community_blocklist", "file_path": "crowdsec-docs/docs/central_api/community_blocklist.md", "short_description": "Curated list of IPs identified as malicious by the CrowdSec community", "children": [] } - ] - }, - { - "name": "Configuration", - "type": "NavBarItem", - "short_description": "Global configuration options for CrowdSec", - "children": [ - { "name": "CrowdSec Configuration", "type": "technical doc", "path": "/docs/next/configuration/crowdsec_configuration", "file_path": "crowdsec-docs/docs/configuration/crowdsec_configuration.md", "short_description": "Main YAML config file reference (/etc/crowdsec/config.yaml)", "children": [] }, - { "name": "Feature Flags", "type": "technical doc", "path": "/docs/next/configuration/feature_flags", "file_path": "crowdsec-docs/docs/configuration/feature_flags.md", "short_description": "Experimental feature flags for testing new capabilities", "children": [] }, - { "name": "Network Management", "type": "technical doc", "path": "/docs/next/configuration/network_management", "file_path": "crowdsec-docs/docs/configuration/network_management.md", "short_description": "TCP/8080 REST API networking configuration", "children": [] }, - { "name": "Helm Parameters", "type": "technical doc", "path": "/docs/next/configuration/values_parameters", "file_path": "crowdsec-docs/docs/configuration/values_parameters.md", "short_description": "Helm chart values parameters reference", "children": [] } - ] - }, - { - "name": "Observability", - "type": "NavBarItem", - "short_description": "Monitoring and metrics for the Security Engine", - "children": [ - { "name": "Introduction", "type": "presentation", "path": "/docs/next/observability/intro", "file_path": "crowdsec-docs/docs/observability/intro.md", "short_description": "Why observability matters in security software", "children": [] }, - { "name": "cscli Metrics", "type": "guide", "path": "/docs/next/observability/cscli", "file_path": "crowdsec-docs/docs/observability/cscli.md", "short_description": "View Prometheus metrics via cscli commands", "children": [] }, - { "name": "Prometheus", "type": "technical doc", "path": "/docs/next/observability/prometheus", "file_path": "crowdsec-docs/docs/observability/prometheus.md", "short_description": "Prometheus scrape endpoint for metrics collection", "children": [] }, - { "name": "Usage Metrics", "type": "technical doc", "path": "/docs/next/observability/usage_metrics", "file_path": "crowdsec-docs/docs/observability/usage_metrics.md", "short_description": "Usage metrics collection (requires CrowdSec v1.6.3+)", "children": [] }, - { "name": "Pprof", "type": "technical doc", "path": "/docs/next/observability/pprof", "file_path": "crowdsec-docs/docs/observability/pprof.md", "short_description": "Go profiling endpoint for debugging performance", "children": [] } - ] - }, - { - "name": "Expr (Expression Engine)", - "type": "NavBarItem", - "short_description": "Expression language used in parsers, scenarios, and profiles", - "children": [ - { "name": "Introduction", "type": "presentation", "path": "/docs/next/expr/intro", "file_path": "crowdsec-docs/docs/expr/intro.md", "short_description": "Overview of the Go expression evaluation engine", "children": [] }, - { "name": "Strings Helpers", "type": "reference", "path": "/docs/next/expr/strings_helpers", "file_path": "crowdsec-docs/docs/expr/strings_helpers.md", "short_description": "String manipulation helper functions", "children": [] }, - { "name": "File Helpers", "type": "reference", "path": "/docs/next/expr/file_helpers", "file_path": "crowdsec-docs/docs/expr/file_helpers.md", "short_description": "File I/O helpers (cached on startup)", "children": [] }, - { "name": "IP Helpers", "type": "reference", "path": "/docs/next/expr/ip_helpers", "file_path": "crowdsec-docs/docs/expr/ip_helpers.md", "short_description": "IP/CIDR helper functions", "children": [] }, - { "name": "JSON/XML/KV Helpers", "type": "reference", "path": "/docs/next/expr/json_helpers", "file_path": "crowdsec-docs/docs/expr/json_helpers.md", "short_description": "JSON/XML/key-value parsing helpers", "children": [] }, - { "name": "CTI Helpers", "type": "reference", "path": "/docs/next/expr/cti_helpers", "file_path": "crowdsec-docs/docs/expr/cti_helpers.md", "short_description": "Query the CTI API from inside expressions", "children": [] }, - { "name": "LibInjection Helpers", "type": "reference", "path": "/docs/next/expr/libinjection_helpers", "file_path": "crowdsec-docs/docs/expr/libinjection_helpers.md", "short_description": "SQL injection detection helpers", "children": [] }, - { "name": "Other Helpers", "type": "reference", "path": "/docs/next/expr/other_helpers", "file_path": "crowdsec-docs/docs/expr/other_helpers.md", "short_description": "Time formatting and miscellaneous helpers", "children": [] }, - { "name": "Alert Object", "type": "reference", "path": "/docs/next/expr/alert", "file_path": "crowdsec-docs/docs/expr/alert.md", "short_description": "Runtime representation of a bucket overflow (alert)", "children": [] }, - { "name": "Decision Object", "type": "reference", "path": "/docs/next/expr/decision", "file_path": "crowdsec-docs/docs/expr/decision.md", "short_description": "Runtime representation of a remediation decision", "children": [] }, - { "name": "Event Object", "type": "reference", "path": "/docs/next/expr/event", "file_path": "crowdsec-docs/docs/expr/event.md", "short_description": "Runtime representation of a processed log event", "children": [] } - ] - }, - { - "name": "Contributing", - "type": "NavBarItem", - "short_description": "Guides for contributing to CrowdSec ecosystem", - "children": [ - { "name": "Getting Started", "type": "guide", "path": "/docs/next/contributing/getting_started", "file_path": "crowdsec-docs/docs/contributing/getting_started.md", "short_description": "How to start contributing to CrowdSec", "children": [] }, - { "name": "Documentation", "type": "guide", "path": "/docs/next/contributing/contributing_doc", "file_path": "crowdsec-docs/docs/contributing/contributing_doc.md", "short_description": "How to write docs in Markdown with Docusaurus", "children": [] }, - { "name": "Hub (Parsers/Scenarios/Rules)", "type": "guide", "path": "/docs/next/contributing/contributing_hub", "file_path": "crowdsec-docs/docs/contributing/contributing_hub.md", "short_description": "Contributing parsers, scenarios, collections, and WAF rules to the Hub", "children": [] }, - { "name": "Remediation Components", "type": "guide", "path": "/docs/next/contributing/contributing_bouncers", "file_path": "crowdsec-docs/docs/contributing/contributing_bouncers.md", "short_description": "Publishing a new remediation component", "children": [] }, - { "name": "Bouncer & AppSec Specs", "type": "technical doc", "path": "/docs/next/contributing/specs/bouncer_appsec_specs", "file_path": "crowdsec-docs/docs/contributing/specs/bouncer_appsec_specs.md", "short_description": "Specification for remediation component and AppSec capabilities", "children": [] }, - { "name": "Remediation Metrics Specs", "type": "technical doc", "path": "/docs/next/contributing/specs/bouncer_metrics_specs", "file_path": "crowdsec-docs/docs/contributing/specs/bouncer_metrics_specs.md", "short_description": "Specification for implementing remediation metrics", "children": [] }, - { "name": "Test Environment", "type": "guide", "path": "/docs/next/contributing/contributing_test_env", "file_path": "crowdsec-docs/docs/contributing/contributing_test_env.md", "short_description": "Create a test environment for Linux development", "children": [] }, - { "name": "CrowdSec Core", "type": "guide", "path": "/docs/next/contributing/contributing_crowdsec", "file_path": "crowdsec-docs/docs/contributing/contributing_crowdsec.md", "short_description": "Report bugs or contribute to the core CrowdSec engine", "children": [] } - ] - }, - { - "name": "Contact the Team", - "type": "presentation", - "path": "/docs/next/contact_team", - "file_path": "crowdsec-docs/docs/contact_team.md", - "short_description": "Contact and support information", - "children": [] - } - ] - }, - { - "name": "Remediation Components", - "type": "NavBarItem", - "links_to": "/u/bouncers/intro", - "short_description": "Bouncers that enforce Security Engine decisions", - "children": [ - { - "name": "Introduction", - "type": "presentation", - "path": "/u/bouncers/intro", - "file_path": "crowdsec-docs/unversioned/bouncers/intro.md", - "short_description": "General presentation of what a remediation component (bouncer) is and how it connects to the Security Engine", - "children": [] - }, - { "name": "AWS WAF", "type": "feature page", "path": "/u/bouncers/aws_waf", "file_path": "crowdsec-docs/unversioned/bouncers/aws_waf.md", "short_description": "AWS WAF remediation component", "children": [] }, - { "name": "Apache", "type": "feature page", "path": "/u/bouncers/apache_bouncer", "file_path": "crowdsec-docs/unversioned/bouncers/apache_bouncer.md", "short_description": "Apache HTTP server remediation component", "children": [] }, - { "name": "Blocklist Mirror", "type": "feature page", "path": "/u/bouncers/blocklist-mirror", "file_path": "crowdsec-docs/unversioned/bouncers/blocklist-mirror.md", "short_description": "Expose decisions as a blocklist for external consumption", "children": [] }, - { "name": "Cloudflare", "type": "feature page", "path": "/u/bouncers/cloudflare", "file_path": "crowdsec-docs/unversioned/bouncers/cloudflare.md", "short_description": "Cloudflare firewall rules remediation component", "children": [] }, - { "name": "Cloudflare Workers", "type": "feature page", "path": "/u/bouncers/cloudflare-workers", "file_path": "crowdsec-docs/unversioned/bouncers/cloudflare-workers.md", "short_description": "Cloudflare Workers-based remediation", "children": [] }, - { "name": "Custom", "type": "feature page", "path": "/u/bouncers/custom", "file_path": "crowdsec-docs/unversioned/bouncers/custom.md", "short_description": "Custom remediation component for arbitrary use cases", "children": [] }, - { "name": "Envoy (Kubernetes)", "type": "feature page", "path": "/u/bouncers/envoy", "file_path": "crowdsec-docs/unversioned/bouncers/envoy.md", "short_description": "Envoy Gateway Kubernetes remediation component", "children": [] }, - { "name": "Fastly", "type": "feature page", "path": "/u/bouncers/fastly", "file_path": "crowdsec-docs/unversioned/bouncers/fastly.md", "short_description": "Fastly CDN remediation component", "children": [] }, - { "name": "Firewall", "type": "feature page", "path": "/u/bouncers/firewall", "file_path": "crowdsec-docs/unversioned/bouncers/firewall.md", "short_description": "OS-level firewall remediation (iptables/nftables/pf)", "children": [] }, - { "name": "HAProxy", "type": "feature page", "path": "/u/bouncers/haproxy", "file_path": "crowdsec-docs/unversioned/bouncers/haproxy.md", "short_description": "HAProxy load balancer remediation component", "children": [] }, - { "name": "HAProxy SPOA", "type": "feature page", "path": "/u/bouncers/haproxy_spoa", "file_path": "crowdsec-docs/unversioned/bouncers/haproxy_spoa.md", "short_description": "HAProxy SPOA (Stream Processing Offload Agent) integration", "children": [] }, - { "name": "Ingress Nginx", "type": "feature page", "path": "/u/bouncers/ingress-nginx", "file_path": "crowdsec-docs/unversioned/bouncers/ingress-nginx.md", "short_description": "Kubernetes NGINX Ingress remediation component", "children": [] }, - { "name": "Magento 2", "type": "feature page", "path": "/u/bouncers/magento", "file_path": "crowdsec-docs/unversioned/bouncers/magento.md", "short_description": "Magento 2 e-commerce platform remediation component", "children": [] }, - { "name": "MISP Feed Generator", "type": "feature page", "path": "/u/bouncers/misp-feed-generator", "file_path": "crowdsec-docs/unversioned/bouncers/misp-feed-generator.md", "short_description": "Generate MISP threat intel feeds from CrowdSec decisions", "children": [] }, - { "name": "Nginx", "type": "feature page", "path": "/u/bouncers/nginx", "file_path": "crowdsec-docs/unversioned/bouncers/nginx.md", "short_description": "Nginx web server remediation component", "children": [] }, - { "name": "OpenResty", "type": "feature page", "path": "/u/bouncers/openresty", "file_path": "crowdsec-docs/unversioned/bouncers/openresty.md", "short_description": "OpenResty (Nginx+Lua) remediation component", "children": [] }, - { "name": "PHP Standalone", "type": "feature page", "path": "/u/bouncers/php", "file_path": "crowdsec-docs/unversioned/bouncers/php.md", "short_description": "PHP standalone remediation component", "children": [] }, - { "name": "PHP Library", "type": "feature page", "path": "/u/bouncers/php-lib", "file_path": "crowdsec-docs/unversioned/bouncers/php-lib.md", "short_description": "PHP remediation library for custom integrations", "children": [] }, - { "name": "Windows Firewall", "type": "feature page", "path": "/u/bouncers/windows_firewall", "file_path": "crowdsec-docs/unversioned/bouncers/windows_firewall.md", "short_description": "Windows Firewall remediation component", "children": [] }, - { "name": "WordPress Plugin", "type": "feature page", "path": "/u/bouncers/wordpress", "file_path": "crowdsec-docs/unversioned/bouncers/wordpress.md", "short_description": "WordPress plugin for CrowdSec remediation", "children": [] }, - { "name": "Traefik (Kubernetes)", "type": "feature page", "path": "/u/bouncers/traefik", "file_path": "crowdsec-docs/unversioned/bouncers/traefik.md", "short_description": "Traefik Kubernetes reverse proxy remediation component", "children": [] }, - { "name": "Third Party", "type": "reference", "path": "https://hub.crowdsec.net/", "file_path": null, "short_description": "External link to the CrowdSec Hub for community-contributed bouncers", "children": [] } - ] - }, - { - "name": "Web Application Firewall (AppSec)", - "type": "NavBarItem", - "links_to": "/docs/next/appsec/intro", - "short_description": "CrowdSec WAF component documentation", - "children": [ - { "name": "Introduction", "type": "presentation", "path": "/docs/next/appsec/intro", "file_path": "crowdsec-docs/docs/appsec/intro.md", "short_description": "Overview of CrowdSec WAF (AppSec component)", "children": [] }, - { - "name": "Quickstarts", - "type": "NavBarItem", - "short_description": "Platform-specific WAF setup guides", - "children": [ - { "name": "General Setup", "type": "guide", "path": "/docs/next/appsec/quickstart/general_setup", "file_path": "crowdsec-docs/docs/appsec/quickstart/general_setup.md", "short_description": "Core AppSec setup applicable to all web servers", "children": [] }, - { "name": "NGINX Ingress (Helm)", "type": "guide", "path": "/docs/next/appsec/quickstart/nginx-ingress", "file_path": "crowdsec-docs/docs/appsec/quickstart/nginx-ingress.md", "short_description": "Kubernetes NGINX Ingress AppSec quickstart", "children": [] }, - { "name": "Envoy Gateway (Kubernetes)", "type": "guide", "path": "/docs/next/appsec/quickstart/envoy-gateway", "file_path": "crowdsec-docs/docs/appsec/quickstart/envoy-gateway.md", "short_description": "Kubernetes Envoy Gateway AppSec quickstart", "children": [] }, - { "name": "Nginx / OpenResty", "type": "guide", "path": "/docs/next/appsec/quickstart/nginxopenresty", "file_path": "crowdsec-docs/docs/appsec/quickstart/nginxopenresty.md", "short_description": "Nginx/OpenResty AppSec quickstart", "children": [] }, - { "name": "HAProxy SPOA", "type": "guide", "path": "/docs/next/appsec/quickstart/haproxy_spoa", "file_path": "crowdsec-docs/docs/appsec/quickstart/haproxy_spoa.md", "short_description": "HAProxy SPOA AppSec quickstart", "children": [] }, - { "name": "NPMplus", "type": "guide", "path": "/docs/next/appsec/quickstart/npmplus", "file_path": "crowdsec-docs/docs/appsec/quickstart/npmplus.md", "short_description": "NPMplus AppSec quickstart", "children": [] }, - { "name": "Traefik", "type": "guide", "path": "/docs/next/appsec/quickstart/traefik", "file_path": "crowdsec-docs/docs/appsec/quickstart/traefik.md", "short_description": "Traefik AppSec quickstart", "children": [] }, - { "name": "WordPress", "type": "guide", "path": "/docs/next/appsec/quickstart/wordpress", "file_path": "crowdsec-docs/docs/appsec/quickstart/wordpress.md", "short_description": "WordPress AppSec quickstart", "children": [] } - ] - }, - { - "name": "Configuration", - "type": "NavBarItem", - "short_description": "AppSec component configuration", - "children": [ - { "name": "Syntax", "type": "technical doc", "path": "/docs/next/appsec/configuration", "file_path": "crowdsec-docs/docs/appsec/configuration.md", "short_description": "AppSec configuration file syntax", "children": [] }, - { "name": "Creation & Testing", "type": "guide", "path": "/docs/next/appsec/configuration_creation_testing", "file_path": "crowdsec-docs/docs/appsec/configuration_creation_testing.md", "short_description": "Create and test AppSec configurations", "children": [] }, - { "name": "Allowlisting and Rule Overrides", "type": "guide", "path": "/docs/next/appsec/configuration_rule_management", "file_path": "crowdsec-docs/docs/appsec/configuration_rule_management.md", "short_description": "Disable or override rules at runtime", "children": [] }, - { "name": "Hooks", "type": "technical doc", "path": "/docs/next/appsec/hooks", "file_path": "crowdsec-docs/docs/appsec/hooks.md", "short_description": "Hook into AppSec processing stages to change behavior", "children": [] } - ] - }, - { - "name": "Rules", - "type": "NavBarItem", - "short_description": "AppSec WAF rules management", - "children": [ - { "name": "Syntax", "type": "technical doc", "path": "/docs/next/appsec/rules_syntax", "file_path": "crowdsec-docs/docs/appsec/rules_syntax.md", "short_description": "AppSec rules syntax reference", "children": [] }, - { "name": "Creation & Testing", "type": "guide", "path": "/docs/next/appsec/create_rules", "file_path": "crowdsec-docs/docs/appsec/create_rules.md", "short_description": "Create WAF rules for Hub submission", "children": [] }, - { "name": "Deployment", "type": "guide", "path": "/docs/next/appsec/rules_deploy", "file_path": "crowdsec-docs/docs/appsec/rules_deploy.md", "short_description": "Deploy custom WAF rules to the engine", "children": [] }, - { "name": "Examples", "type": "guide", "path": "/docs/next/appsec/rules_examples", "file_path": "crowdsec-docs/docs/appsec/rules_examples.md", "short_description": "WAF rule examples from the CrowdSec Hub", "children": [] } - ] - }, - { - "name": "OWASP CRS", - "type": "NavBarItem", - "short_description": "OWASP Core Rule Set integration", - "children": [ - { "name": "Introduction", "type": "presentation", "path": "/docs/next/appsec/crs/intro", "file_path": "crowdsec-docs/docs/appsec/crs/intro.md", "short_description": "CrowdSec WAF compatibility with OWASP CRS", "children": [] }, - { "name": "Installation", "type": "guide", "path": "/docs/next/appsec/crs/installation", "file_path": "crowdsec-docs/docs/appsec/crs/installation.md", "short_description": "Installing CRS rules", "children": [] }, - { "name": "Plugin Support", "type": "technical doc", "path": "/docs/next/appsec/crs/plugin_support", "file_path": "crowdsec-docs/docs/appsec/crs/plugin_support.md", "short_description": "CRS plugin mechanism to extend behavior", "children": [] }, - { "name": "Customization", "type": "guide", "path": "/docs/next/appsec/crs/crs_config", "file_path": "crowdsec-docs/docs/appsec/crs/crs_config.md", "short_description": "Customize CRS to avoid false positives", "children": [] } - ] - }, - { "name": "Alerts & Scenarios", "type": "technical doc", "path": "/docs/next/appsec/alerts_and_scenarios", "file_path": "crowdsec-docs/docs/appsec/alerts_and_scenarios.md", "short_description": "WAF behavior analysis and scenario integration", "children": [] }, - { "name": "Advanced Deployments", "type": "guide", "path": "/docs/next/appsec/advanced_deployments", "file_path": "crowdsec-docs/docs/appsec/advanced_deployments.md", "short_description": "Advanced WAF deployment strategies for gradual rollout", "children": [] }, - { "name": "Request Lifecycle", "type": "technical doc", "path": "/docs/next/appsec/request_lifecycle", "file_path": "crowdsec-docs/docs/appsec/request_lifecycle.md", "short_description": "AppSec stateless inspection and request flow", "children": [] }, - { "name": "Benchmark", "type": "technical doc", "path": "/docs/next/appsec/benchmark", "file_path": "crowdsec-docs/docs/appsec/benchmark.md", "short_description": "WAF component performance benchmark results", "children": [] }, - { "name": "Bouncer/AppSec Protocol", "type": "technical doc", "path": "/docs/next/appsec/protocol", "file_path": "crowdsec-docs/docs/appsec/protocol.md", "short_description": "WAF/bouncer communication protocol spec for custom integrations", "children": [] }, - { "name": "Troubleshooting", "type": "faq", "path": "/docs/next/appsec/troubleshooting", "file_path": "crowdsec-docs/docs/appsec/troubleshooting.md", "short_description": "WAF troubleshooting via cscli", "children": [] } - ] - }, - { - "name": "Cscli", - "type": "NavBarItem", - "links_to": "/docs/next/cscli/cscli", - "short_description": "CrowdSec command-line interface full reference", - "children": [ - { "name": "Introduction", "type": "presentation", "path": "/docs/next/cscli/cscli", "file_path": "crowdsec-docs/docs/cscli/cscli.md", "short_description": "cscli overview — manage CrowdSec from the command line", "children": [] }, - { "name": "cscli alerts", "type": "reference", "path": "/docs/next/cscli/cscli_alerts", "file_path": "crowdsec-docs/docs/cscli/cscli_alerts.md", "short_description": "List, delete, and inspect alerts", "children": [] }, - { "name": "cscli allowlists", "type": "reference", "path": "/docs/next/cscli/cscli_allowlists", "file_path": "crowdsec-docs/docs/cscli/cscli_allowlists.md", "short_description": "Manage centralized allowlists", "children": [] }, - { "name": "cscli appsec-configs", "type": "reference", "path": "/docs/next/cscli/cscli_appsec-configs", "file_path": "crowdsec-docs/docs/cscli/cscli_appsec-configs.md", "short_description": "Manage AppSec configurations from Hub", "children": [] }, - { "name": "cscli appsec-rules", "type": "reference", "path": "/docs/next/cscli/cscli_appsec-rules", "file_path": "crowdsec-docs/docs/cscli/cscli_appsec-rules.md", "short_description": "Manage AppSec/WAF rules from Hub", "children": [] }, - { "name": "cscli bouncers", "type": "reference", "path": "/docs/next/cscli/cscli_bouncers", "file_path": "crowdsec-docs/docs/cscli/cscli_bouncers.md", "short_description": "Manage registered bouncers (requires local API)", "children": [] }, - { "name": "cscli capi", "type": "reference", "path": "/docs/next/cscli/cscli_capi", "file_path": "crowdsec-docs/docs/cscli/cscli_capi.md", "short_description": "Manage Central API interactions", "children": [] }, - { "name": "cscli collections", "type": "reference", "path": "/docs/next/cscli/cscli_collections", "file_path": "crowdsec-docs/docs/cscli/cscli_collections.md", "short_description": "Install, update, remove Hub collections", "children": [] }, - { "name": "cscli completion", "type": "reference", "path": "/docs/next/cscli/cscli_completion", "file_path": "crowdsec-docs/docs/cscli/cscli_completion.md", "short_description": "Generate shell completion scripts", "children": [] }, - { "name": "cscli config", "type": "reference", "path": "/docs/next/cscli/cscli_config", "file_path": "crowdsec-docs/docs/cscli/cscli_config.md", "short_description": "View and modify CrowdSec configuration", "children": [] }, - { "name": "cscli console", "type": "reference", "path": "/docs/next/cscli/cscli_console", "file_path": "crowdsec-docs/docs/cscli/cscli_console.md", "short_description": "Manage CrowdSec Console interactions", "children": [] }, - { "name": "cscli contexts", "type": "reference", "path": "/docs/next/cscli/cscli_contexts", "file_path": "crowdsec-docs/docs/cscli/cscli_contexts.md", "short_description": "Manage alert context configurations", "children": [] }, - { "name": "cscli decisions", "type": "reference", "path": "/docs/next/cscli/cscli_decisions", "file_path": "crowdsec-docs/docs/cscli/cscli_decisions.md", "short_description": "Add/List/Delete/Import decisions from LAPI", "children": [] }, - { "name": "cscli explain", "type": "reference", "path": "/docs/next/cscli/cscli_explain", "file_path": "crowdsec-docs/docs/cscli/cscli_explain.md", "short_description": "Explain log pipeline step by step", "children": [] }, - { "name": "cscli hub", "type": "reference", "path": "/docs/next/cscli/cscli_hub", "file_path": "crowdsec-docs/docs/cscli/cscli_hub.md", "short_description": "List/update hub content (parsers, scenarios, etc.)", "children": [] }, - { "name": "cscli hubtest", "type": "reference", "path": "/docs/next/cscli/cscli_hubtest", "file_path": "crowdsec-docs/docs/cscli/cscli_hubtest.md", "short_description": "Run functional tests on Hub configurations", "children": [] }, - { "name": "cscli lapi", "type": "reference", "path": "/docs/next/cscli/cscli_lapi", "file_path": "crowdsec-docs/docs/cscli/cscli_lapi.md", "short_description": "Manage Local API interactions", "children": [] }, - { "name": "cscli machines", "type": "reference", "path": "/docs/next/cscli/cscli_machines", "file_path": "crowdsec-docs/docs/cscli/cscli_machines.md", "short_description": "Manage local API machines", "children": [] }, - { "name": "cscli metrics", "type": "reference", "path": "/docs/next/cscli/cscli_metrics", "file_path": "crowdsec-docs/docs/cscli/cscli_metrics.md", "short_description": "Display CrowdSec Prometheus metrics", "children": [] }, - { "name": "cscli notifications", "type": "reference", "path": "/docs/next/cscli/cscli_notifications", "file_path": "crowdsec-docs/docs/cscli/cscli_notifications.md", "short_description": "Helper for notification plugin configuration", "children": [] }, - { "name": "cscli papi", "type": "reference", "path": "/docs/next/cscli/cscli_papi", "file_path": "crowdsec-docs/docs/cscli/cscli_papi.md", "short_description": "Manage Polling API (PAPI) interactions", "children": [] }, - { "name": "cscli parsers", "type": "reference", "path": "/docs/next/cscli/cscli_parsers", "file_path": "crowdsec-docs/docs/cscli/cscli_parsers.md", "short_description": "Manage Hub parsers", "children": [] }, - { "name": "cscli postoverflows", "type": "reference", "path": "/docs/next/cscli/cscli_postoverflows", "file_path": "crowdsec-docs/docs/cscli/cscli_postoverflows.md", "short_description": "Manage Hub postoverflows", "children": [] }, - { "name": "cscli scenarios", "type": "reference", "path": "/docs/next/cscli/cscli_scenarios", "file_path": "crowdsec-docs/docs/cscli/cscli_scenarios.md", "short_description": "Manage Hub scenarios", "children": [] }, - { "name": "cscli setup", "type": "reference", "path": "/docs/next/cscli/cscli_setup", "file_path": "crowdsec-docs/docs/cscli/cscli_setup.md", "short_description": "Tools to configure CrowdSec", "children": [] }, - { "name": "cscli simulation", "type": "reference", "path": "/docs/next/cscli/cscli_simulation", "file_path": "crowdsec-docs/docs/cscli/cscli_simulation.md", "short_description": "Manage simulation status of scenarios", "children": [] }, - { "name": "cscli support", "type": "reference", "path": "/docs/next/cscli/cscli_support", "file_path": "crowdsec-docs/docs/cscli/cscli_support.md", "short_description": "Commands for support and diagnostics", "children": [] }, - { "name": "cscli version", "type": "reference", "path": "/docs/next/cscli/cscli_version", "file_path": "crowdsec-docs/docs/cscli/cscli_version.md", "short_description": "Display CrowdSec version information", "children": [] } - ] - }, - { - "name": "Guides", - "type": "NavBarItem", - "links_to": "/u/user_guides/intro", - "short_description": "Practical how-to guides for managing CrowdSec", - "children": [ - { "name": "Introduction", "type": "presentation", "path": "/u/user_guides/intro", "file_path": "crowdsec-docs/unversioned/user_guides/intro.md", "short_description": "Overview of available user guides", "children": [] }, - { "name": "Hub Management", "type": "guide", "path": "/u/user_guides/hub_mgmt", "file_path": "crowdsec-docs/unversioned/user_guides/hub_mgmt.md", "short_description": "Install, upgrade, remove and view hub content via cscli", "children": [] }, - { "name": "Decisions Management", "type": "guide", "path": "/u/user_guides/decisions_mgmt", "file_path": "crowdsec-docs/unversioned/user_guides/decisions_mgmt.md", "short_description": "Manage ban/captcha decisions from cscli", "children": [] }, - { "name": "Bouncers Configuration", "type": "guide", "path": "/u/user_guides/bouncers_configuration", "file_path": "crowdsec-docs/unversioned/user_guides/bouncers_configuration.md", "short_description": "Configure bouncers communicating via LAPI", "children": [] }, - { "name": "Machines Management", "type": "guide", "path": "/u/user_guides/machines_mgmt", "file_path": "crowdsec-docs/unversioned/user_guides/machines_mgmt.md", "short_description": "Register and manage CrowdSec machines", "children": [] }, - { "name": "Local API Management", "type": "guide", "path": "/u/user_guides/lapi_mgmt", "file_path": "crowdsec-docs/unversioned/user_guides/lapi_mgmt.md", "short_description": "Manage the LAPI core component", "children": [] }, - { "name": "Manual Installation", "type": "guide", "path": "/u/user_guides/building", "file_path": "crowdsec-docs/unversioned/user_guides/building.md", "short_description": "Manually install CrowdSec from Debian package", "children": [] }, - { "name": "Replay Mode", "type": "guide", "path": "/u/user_guides/replay_mode", "file_path": "crowdsec-docs/unversioned/user_guides/replay_mode.md", "short_description": "Replay old log files in forensic mode", "children": [] }, - { "name": "Understand Log Processing (cscli explain)", "type": "guide", "path": "/u/user_guides/cscli_explain", "file_path": "crowdsec-docs/unversioned/user_guides/cscli_explain.md", "short_description": "Use cscli explain to understand how logs are parsed", "children": [] }, - { "name": "Run cscli on macOS", "type": "guide", "path": "/u/user_guides/cscli_macos", "file_path": "crowdsec-docs/unversioned/user_guides/cscli_macos.md", "short_description": "How to run cscli on a macOS machine", "children": [] }, - { "name": "Multi-Server Setup", "type": "guide", "path": "/u/user_guides/multiserver_setup", "file_path": "crowdsec-docs/unversioned/user_guides/multiserver_setup.md", "short_description": "Deploy CrowdSec across multiple servers", "children": [] }, - { "name": "Consuming Fastly Logs", "type": "guide", "path": "/u/user_guides/consuming_fastly_logs", "file_path": "crowdsec-docs/unversioned/user_guides/consuming_fastly_logs.md", "short_description": "Ingest and process Fastly CDN log data", "children": [] }, - { "name": "Contextualize Alerts", "type": "guide", "path": "/u/user_guides/alert_context", "file_path": "crowdsec-docs/unversioned/user_guides/alert_context.md", "short_description": "Send extra context data within alerts without storing raw logs", "children": [] }, - { "name": "Log Centralization", "type": "guide", "path": "/u/user_guides/log_centralization", "file_path": "crowdsec-docs/unversioned/user_guides/log_centralization.md", "short_description": "Centralize logs from multiple servers into one CrowdSec instance", "children": [] }, - { "name": "WAF Reverse Proxy Setup", "type": "guide", "path": "/u/user_guides/waf_rp_howto", "file_path": "crowdsec-docs/unversioned/user_guides/waf_rp_howto.md", "short_description": "Deploy CrowdSec WAF with Nginx as reverse proxy for fleet protection", "children": [] } - ] - }, - { - "name": "SDK", - "type": "NavBarItem", - "links_to": "/docs/next/getting_started/sdk_intro", - "short_description": "CrowdSec SDKs for signal sharing partners", - "children": [ - { "name": "Introduction", "type": "presentation", "path": "/docs/next/getting_started/sdk_intro", "file_path": "crowdsec-docs/docs/getting_started/sdk_intro.md", "short_description": "Overview of Python and PHP SDKs for signal sharing", "children": [] }, - { "name": "Python SDK", "type": "guide", "path": "/docs/next/getting_started/install_pyagent", "file_path": "crowdsec-docs/docs/getting_started/install_pyagent.md", "short_description": "Python soft agent for signal sharing partners", "children": [] }, - { "name": "PHP SDK", "type": "guide", "path": "/docs/next/getting_started/install_php_softagent", "file_path": "crowdsec-docs/docs/getting_started/install_php_softagent.md", "short_description": "PHP soft agent for signal sharing", "children": [] }, - { "name": "Drupal Plugin", "type": "feature page", "path": "/docs/next/getting_started/install_drupal_plugin", "file_path": "crowdsec-docs/docs/getting_started/install_drupal_plugin.md", "short_description": "CrowdSec Drupal plugin for real-time site protection", "children": [] } - ] - } - ] - }, - { - "name": "Blocklists", - "type": "NavBarItem", - "links_to": "/u/blocklists/getting_started", - "short_description": "Curated threat intelligence blocklist subscription and integration", - "children": [ - { "name": "Introduction", "type": "presentation", "path": "/u/blocklists/intro", "file_path": "crowdsec-docs/unversioned/blocklists/intro.md", "short_description": "Welcome and overview of the blocklists product", "children": [] }, - { "name": "Getting Started", "type": "guide", "path": "/u/blocklists/getting_started", "file_path": "crowdsec-docs/unversioned/blocklists/getting_started.md", "short_description": "First steps to subscribe and use blocklists", "children": [] }, - { "name": "Featured Blocklists", "type": "feature page", "path": "/u/console/blocklists/featured", "file_path": "crowdsec-docs/unversioned/console/blocklists/featured.md", "short_description": "Top recommended blocklists in the CrowdSec catalog", "children": [] }, - { "name": "Blocklists Catalog", "type": "feature page", "path": "/u/console/blocklists/catalog", "file_path": "crowdsec-docs/unversioned/console/blocklists/catalog.md", "short_description": "Full catalog covering various threat types and sources", "children": [] }, - { "name": "Blocklist Details", "type": "feature page", "path": "/u/console/blocklists/details", "file_path": "crowdsec-docs/unversioned/console/blocklists/details.md", "short_description": "Statistics and benefit analysis for a specific blocklist", "children": [] }, - { "name": "Subscription", "type": "guide", "path": "/u/console/blocklists/subscription", "file_path": "crowdsec-docs/unversioned/console/blocklists/subscription.md", "short_description": "How to subscribe to a blocklist via the Console", "children": [] }, - { "name": "Security Engine Integration", "type": "guide", "path": "/u/blocklists/security_engine", "file_path": "crowdsec-docs/unversioned/blocklists/security_engine.md", "short_description": "Use blocklists with the Security Engine", "children": [] }, - { - "name": "Integrations", - "type": "NavBarItem", - "short_description": "Integrate blocklists with external firewalls and security tools", - "children": [ - { "name": "Introduction", "type": "presentation", "path": "/u/integrations/intro", "file_path": "crowdsec-docs/unversioned/integrations/intro.md", "short_description": "Overview of blocklist integration options", "children": [] }, - { "name": "Raw IP List", "type": "guide", "path": "/u/integrations/rawiplist", "file_path": "crowdsec-docs/unversioned/integrations/rawiplist.md", "short_description": "Consume blocklist as a raw IP text feed", "children": [] }, - { "name": "Remediation Component", "type": "guide", "path": "/u/integrations/remediationcomponent", "file_path": "crowdsec-docs/unversioned/integrations/remediationcomponent.md", "short_description": "Use blocklists with a remediation component", "children": [] }, - { "name": "Checkpoint", "type": "guide", "path": "/u/integrations/checkpoint", "file_path": "crowdsec-docs/unversioned/integrations/checkpoint.md", "short_description": "Checkpoint firewall blocklist integration", "children": [] }, - { "name": "Cisco", "type": "guide", "path": "/u/integrations/cisco", "file_path": "crowdsec-docs/unversioned/integrations/cisco.md", "short_description": "Cisco firewall blocklist integration", "children": [] }, - { "name": "F5", "type": "guide", "path": "/u/integrations/f5", "file_path": "crowdsec-docs/unversioned/integrations/f5.md", "short_description": "F5 firewall blocklist integration", "children": [] }, - { "name": "Fortinet", "type": "guide", "path": "/u/integrations/fortinet", "file_path": "crowdsec-docs/unversioned/integrations/fortinet.md", "short_description": "Fortinet firewall blocklist integration", "children": [] }, - { "name": "Juniper", "type": "guide", "path": "/u/integrations/juniper", "file_path": "crowdsec-docs/unversioned/integrations/juniper.md", "short_description": "Juniper firewall blocklist integration", "children": [] }, - { "name": "Mikrotik", "type": "guide", "path": "/u/integrations/mikrotik", "file_path": "crowdsec-docs/unversioned/integrations/mikrotik.md", "short_description": "Mikrotik router blocklist integration", "children": [] }, - { "name": "OPNsense", "type": "guide", "path": "/u/integrations/opnsense", "file_path": "crowdsec-docs/unversioned/integrations/opnsense.md", "short_description": "OPNsense firewall blocklist integration", "children": [] }, - { "name": "Palo Alto", "type": "guide", "path": "/u/integrations/paloalto", "file_path": "crowdsec-docs/unversioned/integrations/paloalto.md", "short_description": "Palo Alto Networks firewall blocklist integration", "children": [] }, - { "name": "pfSense", "type": "guide", "path": "/u/integrations/pfsense", "file_path": "crowdsec-docs/unversioned/integrations/pfsense.md", "short_description": "pfSense firewall blocklist integration", "children": [] }, - { "name": "Sophos", "type": "guide", "path": "/u/integrations/sophos", "file_path": "crowdsec-docs/unversioned/integrations/sophos.md", "short_description": "Sophos firewall blocklist integration", "children": [] } - ] - } - ] - }, - { - "name": "CTI", - "type": "NavBarItem", - "links_to": "/u/cti_api/intro", - "short_description": "Cyber Threat Intelligence platform documentation", - "children": [ - { "name": "Introduction", "type": "presentation", "path": "/u/cti_api/intro", "file_path": "crowdsec-docs/unversioned/cti_api/intro.md", "short_description": "Welcome to CrowdSec CTI — real-time threat intelligence from the global sensor network", "children": [] }, - { - "name": "Web UI", - "type": "NavBarItem", - "short_description": "CrowdSec CTI web interface guides", - "children": [ - { "name": "Getting Started", "type": "guide", "path": "/u/cti_api/getting_started", "file_path": "crowdsec-docs/unversioned/cti_api/getting_started.md", "short_description": "First steps in the CTI web platform", "children": [] }, - { "name": "IP Report", "type": "feature page", "path": "/u/cti_api/ip_report", "file_path": "crowdsec-docs/unversioned/cti_api/ip_report.md", "short_description": "How to investigate an IP address in the CTI platform", "children": [] }, - { "name": "Advanced Search", "type": "feature page", "path": "/u/cti_api/advanced_search", "file_path": "crowdsec-docs/unversioned/cti_api/advanced_search.md", "short_description": "Advanced search features in the CTI platform", "children": [] }, - { "name": "Search Queries", "type": "technical doc", "path": "/u/cti_api/search_queries", "file_path": "crowdsec-docs/unversioned/cti_api/search_queries.md", "short_description": "Lucene-based search query syntax for the CTI", "children": [] }, - { "name": "CVE Explorer", "type": "feature page", "path": "/u/cti_api/cve_explorer", "file_path": "crowdsec-docs/unversioned/cti_api/cve_explorer.md", "short_description": "Threat intelligence dashboard combining CVE metadata with detection data", "children": [] } - ] - }, - { - "name": "API", - "type": "NavBarItem", - "short_description": "CTI API access and integration", - "children": [ - { "name": "API Getting Started", "type": "guide", "path": "/u/cti_api/api_getting_started", "file_path": "crowdsec-docs/unversioned/cti_api/api_getting_started.md", "short_description": "Get started querying the CTI API directly", "children": [] }, - { "name": "Swagger", "type": "reference", "path": "https://crowdsecurity.github.io/cti-api/", "file_path": null, "short_description": "Interactive CTI API specification (external)", "children": [] } - ] - }, - { - "name": "Taxonomy", - "type": "NavBarItem", - "short_description": "Definitions of CTI data objects, scores, and classifications", - "children": [ - { "name": "Introduction", "type": "presentation", "path": "/u/cti_api/taxonomy/intro", "file_path": "crowdsec-docs/unversioned/cti_api/taxonomy/intro.md", "short_description": "Overview of CrowdSec CTI taxonomy", "children": [] }, - { "name": "CTI Object Format", "type": "reference", "path": "/u/cti_api/taxonomy/cti_object", "file_path": "crowdsec-docs/unversioned/cti_api/taxonomy/cti_object.md", "short_description": "The structure of a CTI data object", "children": [] }, - { "name": "Scores", "type": "reference", "path": "/u/cti_api/taxonomy/scores", "file_path": "crowdsec-docs/unversioned/cti_api/taxonomy/scores.md", "short_description": "Understanding CTI confidence and aggressiveness scores", "children": [] }, - { "name": "Scenarios", "type": "reference", "path": "/u/cti_api/taxonomy/scenarios", "file_path": "crowdsec-docs/unversioned/cti_api/taxonomy/scenarios.md", "short_description": "CTI scenario taxonomy definitions", "children": [] }, - { "name": "Behaviors", "type": "reference", "path": "/u/cti_api/taxonomy/behaviors", "file_path": "crowdsec-docs/unversioned/cti_api/taxonomy/behaviors.md", "short_description": "CTI behavior taxonomy definitions", "children": [] }, - { "name": "Classifications", "type": "reference", "path": "/u/cti_api/taxonomy/classifications", "file_path": "crowdsec-docs/unversioned/cti_api/taxonomy/classifications.md", "short_description": "CTI classification labels", "children": [] }, - { "name": "Safe Classifications", "type": "reference", "path": "/u/cti_api/taxonomy/false_positives", "file_path": "crowdsec-docs/unversioned/cti_api/taxonomy/false_positives.md", "short_description": "Classifications for safe/false-positive IPs", "children": [] }, - { "name": "Benign Classifications", "type": "reference", "path": "/u/cti_api/taxonomy/benign", "file_path": "crowdsec-docs/unversioned/cti_api/taxonomy/benign.md", "short_description": "Benign IP classification definitions", "children": [] } - ] - }, - { - "name": "Integrations", - "type": "NavBarItem", - "short_description": "Connect the CTI API to SIEM, SOAR, and security tools", - "children": [ - { "name": "Overview", "type": "presentation", "path": "/u/cti_api/api_integration/integration_intro", "file_path": "crowdsec-docs/unversioned/cti_api/api_integration/integration_intro.md", "short_description": "Overview of all CTI API integration options", "children": [] }, - { "name": "IPDEX", "type": "feature page", "path": "/u/cti_api/api_integration/integration_ipdex", "file_path": "crowdsec-docs/unversioned/cti_api/api_integration/integration_ipdex.md", "short_description": "CLI tool to query CrowdSec CTI", "children": [] }, - { "name": "Chrome Extension", "type": "feature page", "path": "/u/cti_api/api_integration/integration_chrome", "file_path": "crowdsec-docs/unversioned/cti_api/api_integration/integration_chrome.md", "short_description": "Browser extension for quick CTI IP lookups", "children": [] }, - { "name": "Gigasheet", "type": "feature page", "path": "/u/cti_api/api_integration/integration_gigasheet", "file_path": "crowdsec-docs/unversioned/cti_api/api_integration/integration_gigasheet.md", "short_description": "CTI integration with Gigasheet spreadsheet tool", "children": [] }, - { "name": "IntelOwl", "type": "feature page", "path": "/u/cti_api/api_integration/integration_intelowl", "file_path": "crowdsec-docs/unversioned/cti_api/api_integration/integration_intelowl.md", "short_description": "CrowdSec analyzer plugin for IntelOwl", "children": [] }, - { "name": "Maltego", "type": "feature page", "path": "/u/cti_api/api_integration/integration_maltego", "file_path": "crowdsec-docs/unversioned/cti_api/api_integration/integration_maltego.md", "short_description": "Maltego transforms for IP enrichment via CTI", "children": [] }, - { "name": "MISP", "type": "feature page", "path": "/u/cti_api/api_integration/integration_misp", "file_path": "crowdsec-docs/unversioned/cti_api/api_integration/integration_misp.md", "short_description": "MISP plugin for IP attribute enrichment with CTI", "children": [] }, - { "name": "Microsoft Sentinel", "type": "feature page", "path": "/u/cti_api/api_integration/integration_ms_sentinel", "file_path": "crowdsec-docs/unversioned/cti_api/api_integration/integration_ms_sentinel.md", "short_description": "Sentinel Playbook for CTI enrichment", "children": [] }, - { "name": "MSTICpy", "type": "feature page", "path": "/u/cti_api/api_integration/integration_msticpy", "file_path": "crowdsec-docs/unversioned/cti_api/api_integration/integration_msticpy.md", "short_description": "MSTICpy CrowdSec Threat Intelligence Provider", "children": [] }, - { "name": "OpenCTI", "type": "feature page", "path": "/u/cti_api/api_integration/integration_opencti", "file_path": "crowdsec-docs/unversioned/cti_api/api_integration/integration_opencti.md", "short_description": "OpenCTI internal enrichment connector for IP observables", "children": [] }, - { "name": "Palo Alto XSOAR", "type": "feature page", "path": "/u/cti_api/api_integration/integration_paloalto_xsoar", "file_path": "crowdsec-docs/unversioned/cti_api/api_integration/integration_paloalto_xsoar.md", "short_description": "Palo Alto Cortex XSOAR CTI plugin", "children": [] }, - { "name": "QRadar", "type": "feature page", "path": "/u/cti_api/api_integration/integration_qradar", "file_path": "crowdsec-docs/unversioned/cti_api/api_integration/integration_qradar.md", "short_description": "QRadar app using CrowdSec CTI smoke endpoint", "children": [] }, - { "name": "Microsoft Security Copilot", "type": "feature page", "path": "/u/cti_api/api_integration/integration_securitycopilot", "file_path": "crowdsec-docs/unversioned/cti_api/api_integration/integration_securitycopilot.md", "short_description": "CrowdSec intelligence plugin for Security Copilot", "children": [] }, - { "name": "Sekoia XDR", "type": "feature page", "path": "/u/cti_api/api_integration/integration_sekoia_xdr", "file_path": "crowdsec-docs/unversioned/cti_api/api_integration/integration_sekoia_xdr.md", "short_description": "CTI API in Sekoia XDR playbooks", "children": [] }, - { "name": "Splunk SIEM", "type": "feature page", "path": "/u/cti_api/api_integration/integration_splunk_siem", "file_path": "crowdsec-docs/unversioned/cti_api/api_integration/integration_splunk_siem.md", "short_description": "Splunk SIEM app with CrowdSec CTI IP lookup command", "children": [] }, - { "name": "Splunk SOAR", "type": "feature page", "path": "/u/cti_api/api_integration/integration_splunk_soar", "file_path": "crowdsec-docs/unversioned/cti_api/api_integration/integration_splunk_soar.md", "short_description": "Splunk SOAR app for CrowdSec IP enrichment", "children": [] }, - { "name": "TheHive/Cortex", "type": "feature page", "path": "/u/cti_api/api_integration/integration_thehive", "file_path": "crowdsec-docs/unversioned/cti_api/api_integration/integration_thehive.md", "short_description": "Cortex analyzer for CrowdSec CTI smoke database report", "children": [] } - ] - }, - { "name": "FAQ", "type": "faq", "path": "/u/cti_api/faq", "file_path": "crowdsec-docs/unversioned/cti_api/faq.md", "short_description": "Frequently asked questions about CrowdSec CTI", "children": [] } - ] - }, - { - "name": "Console", - "type": "NavBarItem", - "links_to": "/u/console/intro", - "short_description": "CrowdSec Console web platform documentation", - "children": [ - { "name": "Introduction", "type": "presentation", "path": "/u/console/intro", "file_path": "crowdsec-docs/unversioned/console/intro.md", "short_description": "What the CrowdSec Console is and what it provides", "children": [] }, - { "name": "Getting Started", "type": "guide", "path": "/u/console/getting_started", "file_path": "crowdsec-docs/unversioned/console/getting_started.md", "short_description": "First steps to set up and use the CrowdSec Console", "children": [] }, - { - "name": "Security Engines", - "type": "NavBarItem", - "short_description": "Manage registered Security Engines in the Console", - "children": [ - { "name": "Dashboard", "type": "feature page", "path": "/u/console/security_engines/dashboard", "file_path": "crowdsec-docs/unversioned/console/security_engines/dashboard.md", "short_description": "Security Engines overview dashboard", "children": [] }, - { "name": "Filter and Sort", "type": "feature page", "path": "/u/console/security_engines/filter_and_sort", "file_path": "crowdsec-docs/unversioned/console/security_engines/filter_and_sort.md", "short_description": "Filter and sort Security Engines in the dashboard", "children": [] }, - { "name": "Pending Security Engines", "type": "guide", "path": "/u/console/security_engines/pending_security_engines", "file_path": "crowdsec-docs/unversioned/console/security_engines/pending_security_engines.md", "short_description": "Accept or decline engines waiting for enrollment", "children": [] }, - { "name": "Name and Tags", "type": "guide", "path": "/u/console/security_engines/name_and_tags", "file_path": "crowdsec-docs/unversioned/console/security_engines/name_and_tags.md", "short_description": "Edit Security Engine name and tags", "children": [] }, - { "name": "Transfer Engine", "type": "guide", "path": "/u/console/security_engines/transfer_engine", "file_path": "crowdsec-docs/unversioned/console/security_engines/transfer_engine.md", "short_description": "Transfer a Security Engine to another organization", "children": [] }, - { "name": "Archive Engine", "type": "guide", "path": "/u/console/security_engines/archive_engine", "file_path": "crowdsec-docs/unversioned/console/security_engines/archive_engine.md", "short_description": "Archive a Security Engine from the organization", "children": [] }, - { "name": "Remove Engine", "type": "guide", "path": "/u/console/security_engines/remove_engine", "file_path": "crowdsec-docs/unversioned/console/security_engines/remove_engine.md", "short_description": "Remove a Security Engine from an organization", "children": [] }, - { "name": "Troubleshooting", "type": "faq", "path": "/u/console/security_engines/troubleshooting", "file_path": "crowdsec-docs/unversioned/console/security_engines/troubleshooting.md", "short_description": "Troubleshooting hints for Security Engines in the Console", "children": [] }, - { "name": "Am I Under Attack (Premium)", "type": "feature page", "path": "/u/console/security_engines/am_i_under_attack", "file_path": "crowdsec-docs/unversioned/console/security_engines/am_i_under_attack.md", "short_description": "Premium alerting for abnormal attack surge detection", "children": [] }, - { "name": "Multi-Organization Selection", "type": "feature page", "path": "/u/console/security_engines/select_multiple_organizations", "file_path": "crowdsec-docs/unversioned/console/security_engines/select_multiple_organizations.md", "short_description": "Manage engines across multiple organizations", "children": [] }, - { "name": "Details Page", "type": "feature page", "path": "/u/console/security_engines/details_page", "file_path": "crowdsec-docs/unversioned/console/security_engines/details_page.md", "short_description": "View detailed information for a specific Security Engine", "children": [] } - ] - }, - { - "name": "Blocklists (Console)", - "type": "NavBarItem", - "short_description": "Blocklist management within the Console", - "children": [ - { "name": "Featured Blocklists", "type": "feature page", "path": "/u/console/blocklists/featured", "file_path": "crowdsec-docs/unversioned/console/blocklists/featured.md", "short_description": "Highlighted top blocklists in the catalog", "children": [] }, - { "name": "Catalog", "type": "feature page", "path": "/u/console/blocklists/catalog", "file_path": "crowdsec-docs/unversioned/console/blocklists/catalog.md", "short_description": "Wide catalog covering various threat types and sources", "children": [] }, - { "name": "Details", "type": "feature page", "path": "/u/console/blocklists/details", "file_path": "crowdsec-docs/unversioned/console/blocklists/details.md", "short_description": "Detailed statistics and benefit analysis for a blocklist", "children": [] }, - { "name": "Subscription", "type": "guide", "path": "/u/console/blocklists/subscription", "file_path": "crowdsec-docs/unversioned/console/blocklists/subscription.md", "short_description": "How to subscribe to a blocklist from the Console", "children": [] } - ] - }, - { - "name": "Alerts", - "type": "NavBarItem", - "short_description": "Alert visualization, analysis, and management", - "children": [ - { "name": "Introduction", "type": "presentation", "path": "/u/console/alerts/intro", "file_path": "crowdsec-docs/unversioned/console/alerts/intro.md", "short_description": "Introduction to the Alerts section", "children": [] }, - { "name": "Visualizer", "type": "feature page", "path": "/u/console/alerts/visualizer", "file_path": "crowdsec-docs/unversioned/console/alerts/visualizer.md", "short_description": "Visual alert timeline and maps", "children": [] }, - { "name": "Alerts Analysis", "type": "feature page", "path": "/u/console/alerts/alerts_analysis", "file_path": "crowdsec-docs/unversioned/console/alerts/alerts_analysis.md", "short_description": "Analyzing and understanding alert patterns", "children": [] }, - { "name": "Alerts Context", "type": "feature page", "path": "/u/console/alerts/alerts_contexts", "file_path": "crowdsec-docs/unversioned/console/alerts/alerts_contexts.md", "short_description": "Understanding context attached to alerts", "children": [] }, - { "name": "Background Noise Filtering (Premium)", "type": "feature page", "path": "/u/console/alerts/background_noise", "file_path": "crowdsec-docs/unversioned/console/alerts/background_noise.md", "short_description": "Premium filtering to focus on alerts that matter", "children": [] }, - { "name": "Quotas", "type": "technical doc", "path": "/u/console/alerts/quotas", "file_path": "crowdsec-docs/unversioned/console/alerts/quotas.md", "short_description": "Alert storage quotas and limits", "children": [] } - ] - }, - { "name": "Remediation Sync (Premium)", "type": "feature page", "path": "/u/console/remediation_sync", "file_path": "crowdsec-docs/unversioned/console/remediation_sync.md", "short_description": "Sync remediation decisions across Security Engines (Premium)", "children": [] }, - { "name": "Remediation Metrics", "type": "feature page", "path": "/u/console/remediation_metrics", "file_path": "crowdsec-docs/unversioned/console/remediation_metrics.md", "short_description": "View bouncer enforcement metrics in the Console", "children": [] }, - { - "name": "Decisions", - "type": "NavBarItem", - "short_description": "View and manage ban/remediation decisions", - "children": [ - { "name": "Introduction", "type": "presentation", "path": "/u/console/decisions/decisions_intro", "file_path": "crowdsec-docs/unversioned/console/decisions/decisions_intro.md", "short_description": "Introduction to decisions in the Console", "children": [] }, - { "name": "Decisions Management (Premium)", "type": "feature page", "path": "/u/console/decisions/decisions_management", "file_path": "crowdsec-docs/unversioned/console/decisions/decisions_management.md", "short_description": "Manage and override decisions from the Console (Premium)", "children": [] } - ] - }, - { "name": "Centralized Allowlists (Premium)", "type": "feature page", "path": "/u/console/allowlists", "file_path": "crowdsec-docs/unversioned/console/allowlists.md", "short_description": "Manage allowlists centrally across all Security Engines (Premium)", "children": [] }, - { - "name": "Enterprise Plan", - "type": "NavBarItem", - "short_description": "Enterprise support and billing features", - "children": [ - { "name": "Enterprise Support", "type": "feature page", "path": "/u/console/enterprise_plan/enterprise_support", "file_path": "crowdsec-docs/unversioned/console/enterprise_plan/enterprise_support.md", "short_description": "Enterprise-tier support features and SLAs", "children": [] }, - { "name": "Invoices", "type": "feature page", "path": "/u/console/enterprise_plan/enterprise_invoices", "file_path": "crowdsec-docs/unversioned/console/enterprise_plan/enterprise_invoices.md", "short_description": "Invoice management for Enterprise plan", "children": [] } - ] - }, - { "name": "Threat Forecast (Premium)", "type": "feature page", "path": "/u/console/threat_forecast", "file_path": "crowdsec-docs/unversioned/console/threat_forecast.md", "short_description": "Predictive threat forecasting based on global intelligence (Premium)", "children": [] }, - { - "name": "Service API", - "type": "NavBarItem", - "short_description": "Programmatic access to Console features via REST API", - "children": [ - { "name": "Getting Started", "type": "guide", "path": "/u/console/service_api/getting_started", "file_path": "crowdsec-docs/unversioned/console/service_api/getting_started.md", "short_description": "Get started with the Console Service API", "children": [] }, - { "name": "Authentication Quickstart", "type": "guide", "path": "/u/console/service_api/quickstart/authentication", "file_path": "crowdsec-docs/unversioned/console/service_api/quickstart/authentication.md", "short_description": "Authenticate with the Service API", "children": [] }, - { "name": "Blocklists Quickstart", "type": "guide", "path": "/u/console/service_api/quickstart/blocklists", "file_path": "crowdsec-docs/unversioned/console/service_api/quickstart/blocklists.md", "short_description": "Manage blocklists via the Service API", "children": [] }, - { "name": "Integrations Quickstart", "type": "guide", "path": "/u/console/service_api/quickstart/integrations", "file_path": "crowdsec-docs/unversioned/console/service_api/quickstart/integrations.md", "short_description": "Set up integrations via the Service API", "children": [] }, - { "name": "Blocklists Reference", "type": "technical doc", "path": "/u/console/service_api/blocklists", "file_path": "crowdsec-docs/unversioned/console/service_api/blocklists.md", "short_description": "Full blocklists API reference — create, populate, subscribe, share", "children": [] }, - { "name": "Integrations Reference", "type": "technical doc", "path": "/u/console/service_api/integrations", "file_path": "crowdsec-docs/unversioned/console/service_api/integrations.md", "short_description": "Supported integration formats reference", "children": [] }, - { "name": "Python SDK", "type": "guide", "path": "/u/console/service_api/sdks/python", "file_path": "crowdsec-docs/unversioned/console/service_api/sdks/python.md", "short_description": "Python SDK for the Console Service API", "children": [] }, - { "name": "FAQ", "type": "faq", "path": "/u/console/service_api/faq", "file_path": "crowdsec-docs/unversioned/console/service_api/faq.md", "short_description": "Service API frequently asked questions", "children": [] } - ] - }, - { - "name": "Notification Integrations (Premium)", - "type": "NavBarItem", - "short_description": "Push Console alerts to external communication tools", - "children": [ - { "name": "Overview", "type": "presentation", "path": "/u/console/notification_integrations/overview", "file_path": "crowdsec-docs/unversioned/console/notification_integrations/overview.md", "short_description": "Overview of notification integrations for the Console", "children": [] }, - { "name": "Notification Rule", "type": "technical doc", "path": "/u/console/notification_integrations/rule", "file_path": "crowdsec-docs/unversioned/console/notification_integrations/rule.md", "short_description": "Configure notification trigger rules", "children": [] }, - { "name": "Discord", "type": "feature page", "path": "/u/console/notification_integrations/discord", "file_path": "crowdsec-docs/unversioned/console/notification_integrations/discord.md", "short_description": "Send Console alerts to Discord", "children": [] }, - { "name": "Slack", "type": "feature page", "path": "/u/console/notification_integrations/slack", "file_path": "crowdsec-docs/unversioned/console/notification_integrations/slack.md", "short_description": "Send Console alerts to Slack", "children": [] }, - { "name": "Webhook", "type": "feature page", "path": "/u/console/notification_integrations/webhook", "file_path": "crowdsec-docs/unversioned/console/notification_integrations/webhook.md", "short_description": "Send Console alerts to a custom webhook", "children": [] } - ] - }, - { "name": "Stack Health", "type": "feature page", "path": "/u/console/stackhealth", "file_path": "crowdsec-docs/unversioned/console/stackhealth.md", "short_description": "Monitor infrastructure health and CrowdSec configuration status", "children": [] }, - { - "name": "Premium Upgrade", - "type": "NavBarItem", - "short_description": "Information about upgrading to CrowdSec Premium", - "children": [ - { "name": "Premium Upgrade", "type": "presentation", "path": "/u/console/premium_upgrade", "file_path": "crowdsec-docs/unversioned/console/premium_upgrade/index.md", "short_description": "Premium features for DevOps, SecOps, and MSP roles", "children": [] }, - { "name": "Optimal Premium Setup", "type": "guide", "path": "/u/console/premium_upgrade/optimal_setup", "file_path": "crowdsec-docs/unversioned/console/premium_upgrade/optimal_setup.md", "short_description": "Best practices for setting up your Premium upgrade", "children": [] }, - { "name": "Test Premium Value", "type": "guide", "path": "/u/console/premium_upgrade/testing_premium", "file_path": "crowdsec-docs/unversioned/console/premium_upgrade/testing_premium.md", "short_description": "Practical ways to measure Premium value during a trial", "children": [] }, - { "name": "Features Overview", "type": "feature page", "path": "/u/console/premium_upgrade/features_overview", "file_path": "crowdsec-docs/unversioned/console/premium_upgrade/features_overview.md", "short_description": "Comprehensive overview of all Premium features", "children": [] } - ] - } - ] - }, - { - "name": "Resources", - "type": "NavBarItem", - "short_description": "Dropdown with links to guides and external Academy", - "children": [ - { - "name": "Guides", - "type": "NavBarItem", - "links_to": "/u/user_guides/intro", - "short_description": "Duplicate link to the Guides section (also under Security Stack)", - "children": [] - }, - { - "name": "Academy", - "type": "reference", - "path": "https://academy.crowdsec.net/courses", - "file_path": null, - "short_description": "External CrowdSec Academy for video courses", - "children": [] - } - ] - }, - { - "name": "FAQ / Troubleshooting", - "type": "NavBarItem", - "links_to": "/u/troubleshooting/intro", - "short_description": "Centralized troubleshooting and FAQ section", - "children": [ - { "name": "Introduction", "type": "presentation", "path": "/u/troubleshooting/intro", "file_path": "crowdsec-docs/unversioned/troubleshooting/intro.md", "short_description": "Entry point for all troubleshooting documentation", "children": [] }, - { "name": "Use Cases and Quick Solutions", "type": "faq", "path": "/u/troubleshooting/usecases", "file_path": "crowdsec-docs/unversioned/troubleshooting/usecases.md", "short_description": "Common use cases with quick solution paths", "children": [] }, - { "name": "Security Engine", "type": "faq", "path": "/u/troubleshooting/security_engine", "file_path": "crowdsec-docs/unversioned/troubleshooting/security_engine.md", "short_description": "Troubleshooting the Security Engine", "children": [] }, - { "name": "Remediation Components", "type": "faq", "path": "/u/troubleshooting/remediation_components", "file_path": "crowdsec-docs/unversioned/troubleshooting/remediation_components.md", "short_description": "Troubleshooting remediation components/bouncers", "children": [] }, - { "name": "CTI", "type": "faq", "path": "/u/troubleshooting/cti", "file_path": "crowdsec-docs/unversioned/troubleshooting/cti.md", "short_description": "Troubleshooting CTI API access and behavior", "children": [] }, - { - "name": "Issue Pages (linked from Stack Health)", - "type": "NavBarItem", - "short_description": "Specific issue resolution pages for automated health check findings", - "children": [ - { "name": "Log Processor Offline", "type": "faq", "path": "/u/troubleshooting/issue_lp_offline", "file_path": "crowdsec-docs/unversioned/troubleshooting/issue_lp_offline.md", "short_description": "Resolve a Log Processor showing as offline", "children": [] }, - { "name": "No Logs Parsed", "type": "faq", "path": "/u/troubleshooting/issue_lp_no_logs_parsed", "file_path": "crowdsec-docs/unversioned/troubleshooting/issue_lp_no_logs_parsed.md", "short_description": "Logs read but not parsed correctly", "children": [] }, - { "name": "No Logs Read", "type": "faq", "path": "/u/troubleshooting/issue_lp_no_logs_read", "file_path": "crowdsec-docs/unversioned/troubleshooting/issue_lp_no_logs_read.md", "short_description": "Log Processor not acquiring any log lines in 24h", "children": [] }, - { "name": "No Alerts Generated", "type": "faq", "path": "/u/troubleshooting/issue_lp_no_alerts", "file_path": "crowdsec-docs/unversioned/troubleshooting/issue_lp_no_alerts.md", "short_description": "Log Processor running but not generating alerts", "children": [] }, - { "name": "Security Engine Offline", "type": "faq", "path": "/u/troubleshooting/issue_se_offline", "file_path": "crowdsec-docs/unversioned/troubleshooting/issue_se_offline.md", "short_description": "Security Engine not reported to CAPI for 48+ hours", "children": [] }, - { "name": "Security Engine No Alerts", "type": "faq", "path": "/u/troubleshooting/issue_se_no_alerts", "file_path": "crowdsec-docs/unversioned/troubleshooting/issue_se_no_alerts.md", "short_description": "Security Engine not forwarding alerts to CAPI in 48h", "children": [] }, - { "name": "No Remediation Component", "type": "faq", "path": "/u/troubleshooting/issue_se_no_rc", "file_path": "crowdsec-docs/unversioned/troubleshooting/issue_se_no_rc.md", "short_description": "No remediation component registered to the engine", "children": [] }, - { "name": "No Active Remediation Component", "type": "faq", "path": "/u/troubleshooting/issue_se_no_active_rc", "file_path": "crowdsec-docs/unversioned/troubleshooting/issue_se_no_active_rc.md", "short_description": "No active remediation components connected", "children": [] }, - { "name": "Too Many Alerts", "type": "faq", "path": "/u/troubleshooting/issue_se_too_many_alerts", "file_path": "crowdsec-docs/unversioned/troubleshooting/issue_se_too_many_alerts.md", "short_description": "Abnormally high alert volume indicating misconfiguration", "children": [] }, - { "name": "Mismatching Collections", "type": "faq", "path": "/u/troubleshooting/issue_mismatch_collections", "file_path": "crowdsec-docs/unversioned/troubleshooting/issue_mismatch_collections.md", "short_description": "Collection installed but related log files not being read", "children": [] }, - { "name": "CAPI 403 Forbidden", "type": "faq", "path": "/u/troubleshooting/issue_capi_403", "file_path": "crowdsec-docs/unversioned/troubleshooting/issue_capi_403.md", "short_description": "Getting a 403 from the CrowdSec Central API", "children": [] }, - { "name": "Firewall Integration Offline", "type": "faq", "path": "/u/troubleshooting/issue_integration_fw_offline", "file_path": "crowdsec-docs/unversioned/troubleshooting/issue_integration_fw_offline.md", "short_description": "Firewall pulling from Blocklist-as-a-Service is offline", "children": [] }, - { "name": "Firewall Integration Zero IPs", "type": "faq", "path": "/u/troubleshooting/issue_integration_fw_zero_ips", "file_path": "crowdsec-docs/unversioned/troubleshooting/issue_integration_fw_zero_ips.md", "short_description": "Firewall integration pulling zero IPs from subscribed blocklists", "children": [] }, - { "name": "Remediation Component Integration Offline", "type": "faq", "path": "/u/troubleshooting/issue_integration_rc_offline", "file_path": "crowdsec-docs/unversioned/troubleshooting/issue_integration_rc_offline.md", "short_description": "Remediation component blocklist integration is offline", "children": [] }, - { "name": "Console Issues", "type": "faq", "path": "/u/troubleshooting/console_issues", "file_path": "crowdsec-docs/unversioned/troubleshooting/console_issues.md", "short_description": "Console health check issues and resolutions", "children": [] } - ] - } - ] - }, - { - "name": "Getting Started", - "type": "NavBarItem", - "links_to": "/u/getting_started/intro", - "short_description": "Installation and onboarding for the Security Engine (sidebar-only, not in top navbar)", - "children": [ - { "name": "Introduction", "type": "presentation", "path": "/u/getting_started/intro", "file_path": "crowdsec-docs/unversioned/getting_started/intro.md", "short_description": "What is CrowdSec Security Engine — lightweight collaborative IDS overview", "children": [] }, - { - "name": "Installation", - "type": "NavBarItem", - "short_description": "Platform-specific installation guides", - "children": [ - { "name": "Linux", "type": "guide", "path": "/u/getting_started/installation/linux", "file_path": "crowdsec-docs/unversioned/getting_started/installation/linux.md", "short_description": "Install the Security Engine on Linux", "children": [] }, - { "name": "FreeBSD", "type": "guide", "path": "/u/getting_started/installation/freebsd", "file_path": "crowdsec-docs/unversioned/getting_started/installation/freebsd.md", "short_description": "Install the Security Engine on FreeBSD", "children": [] }, - { "name": "Windows", "type": "guide", "path": "/u/getting_started/installation/windows", "file_path": "crowdsec-docs/unversioned/getting_started/installation/windows.md", "short_description": "Install the Security Engine on Windows", "children": [] }, - { "name": "macOS", "type": "guide", "path": "/u/getting_started/installation/macos", "file_path": "crowdsec-docs/unversioned/getting_started/installation/macos.md", "short_description": "Run CrowdSec on macOS via Docker (no native binary)", "children": [] }, - { "name": "Docker", "type": "guide", "path": "/u/getting_started/installation/docker", "file_path": "crowdsec-docs/unversioned/getting_started/installation/docker.md", "short_description": "Run the Security Engine in a Docker container", "children": [] }, - { "name": "Kubernetes", "type": "guide", "path": "/u/getting_started/installation/kubernetes", "file_path": "crowdsec-docs/unversioned/getting_started/installation/kubernetes.md", "short_description": "Deploy the Security Engine on Kubernetes", "children": [] }, - { "name": "pfSense", "type": "guide", "path": "/u/getting_started/installation/pfsense", "file_path": "crowdsec-docs/unversioned/getting_started/installation/pfsense.md", "short_description": "Install CrowdSec on pfSense firewall", "children": [] }, - { "name": "OPNsense", "type": "guide", "path": "/u/getting_started/installation/opnsense", "file_path": "crowdsec-docs/unversioned/getting_started/installation/opnsense.md", "short_description": "Install CrowdSec on OPNsense firewall", "children": [] }, - { "name": "WHM Plugin", "type": "guide", "path": "/u/getting_started/installation/whm", "file_path": "crowdsec-docs/unversioned/getting_started/installation/whm.md", "short_description": "WHM plugin to control CrowdSec from the WHM dashboard", "children": [] } - ] - }, - { "name": "Stack Health-Check", "type": "guide", "path": "/u/getting_started/health_check", "file_path": "crowdsec-docs/unversioned/getting_started/health_check.md", "short_description": "Verify your CrowdSec setup is working correctly after install", "children": [] }, - { - "name": "Post Installation Steps", - "type": "NavBarItem", - "short_description": "Actions to take after a successful install", - "children": [ - { "name": "Console Enrollment", "type": "guide", "path": "/u/getting_started/post_installation/console", "file_path": "crowdsec-docs/unversioned/getting_started/post_installation/console.md", "short_description": "Enroll your Security Engine with the CrowdSec Console", "children": [] }, - { "name": "Blocklists Setup", "type": "guide", "path": "/u/getting_started/post_installation/console_blocklists", "file_path": "crowdsec-docs/unversioned/getting_started/post_installation/console_blocklists.md", "short_description": "Set up blocklists from the Console post-install", "children": [] }, - { "name": "Hub Setup", "type": "guide", "path": "/u/getting_started/post_installation/console_hub", "file_path": "crowdsec-docs/unversioned/getting_started/post_installation/console_hub.md", "short_description": "Configure hub content via the Console post-install", "children": [] }, - { "name": "Whitelists", "type": "guide", "path": "/u/getting_started/post_installation/whitelists", "file_path": "crowdsec-docs/unversioned/getting_started/post_installation/whitelists.md", "short_description": "Set up whitelists to ignore trusted IPs", "children": [] }, - { "name": "Acquisition Setup", "type": "guide", "path": "/u/getting_started/post_installation/acquisition", "file_path": "crowdsec-docs/unversioned/getting_started/post_installation/acquisition.md", "short_description": "Auto-detect and configure log sources (CrowdSec >= 1.7.0)", "children": [] }, - { "name": "Add New Log Sources", "type": "guide", "path": "/u/getting_started/post_installation/acquisition_new", "file_path": "crowdsec-docs/unversioned/getting_started/post_installation/acquisition_new.md", "short_description": "Add file-based log acquisitions manually", "children": [] }, - { "name": "Troubleshoot Acquisition", "type": "faq", "path": "/u/getting_started/post_installation/acquisition_troubleshoot", "file_path": "crowdsec-docs/unversioned/getting_started/post_installation/acquisition_troubleshoot.md", "short_description": "Fix issues with log acquisition configuration", "children": [] }, - { "name": "Profiles", "type": "guide", "path": "/u/getting_started/post_installation/profiles", "file_path": "crowdsec-docs/unversioned/getting_started/post_installation/profiles.md", "short_description": "Configure remediation profiles post-install", "children": [] }, - { "name": "Metrics", "type": "guide", "path": "/u/getting_started/post_installation/metrics", "file_path": "crowdsec-docs/unversioned/getting_started/post_installation/metrics.md", "short_description": "Set up Prometheus metrics for your Security Engine", "children": [] }, - { "name": "General Troubleshoot", "type": "faq", "path": "/u/getting_started/post_installation/troubleshoot", "file_path": "crowdsec-docs/unversioned/getting_started/post_installation/troubleshoot.md", "short_description": "General post-install troubleshooting guide", "children": [] } - ] - } - ] - }, - { - "name": "Tracker API", - "type": "NavBarItem", - "links_to": "/u/tracker_api/getting_started", - "short_description": "Live Exploit Tracker API — not in main navbar but has its own sidebar", - "children": [ - { "name": "Introduction", "type": "presentation", "path": "/u/tracker_api/getting_started", "file_path": "crowdsec-docs/unversioned/tracker_api/getting_started.md", "short_description": "Introduction to the Live Exploit Tracker API", "children": [] }, - { "name": "Prioritize", "type": "guide", "path": "/u/tracker_api/prioritize", "file_path": "crowdsec-docs/unversioned/tracker_api/prioritize.md", "short_description": "How to prioritize vulnerabilities using the tracker API", "children": [] }, - { "name": "Mitigate", "type": "guide", "path": "/u/tracker_api/mitigate", "file_path": "crowdsec-docs/unversioned/tracker_api/mitigate.md", "short_description": "How to mitigate vulnerabilities using the tracker API", "children": [] }, - { "name": "API Reference", "type": "reference", "path": "/u/tracker_api/api_reference", "file_path": "crowdsec-docs/unversioned/tracker_api/api_reference.md", "short_description": "Swagger-based API reference for the tracker", "children": [] }, - { "name": "Web Interface", "type": "feature page", "path": "/u/tracker_api/web_interface", "file_path": "crowdsec-docs/unversioned/tracker_api/web_interface.md", "short_description": "Human-friendly web UI for consuming the exploit tracker", "children": [] } - ] - } - ] -} diff --git a/crowdsec-docs/docusaurus.config.ts b/crowdsec-docs/docusaurus.config.ts index cc343e081..fdd185d17 100644 --- a/crowdsec-docs/docusaurus.config.ts +++ b/crowdsec-docs/docusaurus.config.ts @@ -210,6 +210,7 @@ const redirects = [ // other CTI pages redirect / fixes { from: "/next/cti_api/intro", to: "/u/console/ip_reputation/api_keys" }, { from: "/next/cti_api/getting_started", to: "/u/console/ip_reputation/api_keys" }, + { from: "/u/console/ip_reputation/api_keys_premium", to: "/u/console/ip_reputation/api_keys" }, ]; function redirectsGlobalDataPlugin() { diff --git a/crowdsec-docs/sidebarsUnversioned.ts b/crowdsec-docs/sidebarsUnversioned.ts index 8dcd7f2f7..a1d8fcebf 100644 --- a/crowdsec-docs/sidebarsUnversioned.ts +++ b/crowdsec-docs/sidebarsUnversioned.ts @@ -11,6 +11,12 @@ const sidebarsUnversionedConfig: SidebarConfig = { label: "Introduction", id: "cti_api/intro", }, + // ── EXPLORE ────────────────────────────────────────────────────────── + { + type: "html", + value: "Explore", + defaultStyle: false, + }, { type: "link", label: "Web UI", @@ -19,6 +25,20 @@ const sidebarsUnversionedConfig: SidebarConfig = { tag: "otherSection", }, }, + { + type: "link", + label: "Live Exploit Tracker", + href: "/u/tracker_api/intro", + customProps: { + tag: "otherSection", + }, + }, + // ── API ────────────────────────────────────────────────────────────── + { + type: "html", + value: "
API", + defaultStyle: false, + }, { type: "doc", label: "API Access", @@ -50,16 +70,12 @@ const sidebarsUnversionedConfig: SidebarConfig = { "cti_api/api_integration/integration_thehive", ], }, + // ── TECHNICAL DOC ───────────────────────────────────────────────────── { type: "html", - value: "
", + value: "
Technical Doc", defaultStyle: false, }, - { - type: "doc", - label: "Advanced Query Syntax", - id: "cti_api/search_queries", - }, { type: "category", label: "Taxonomy", @@ -75,15 +91,19 @@ const sidebarsUnversionedConfig: SidebarConfig = { ], }, { - type: "html", - value: "
", - defaultStyle: false, + type: "doc", + label: "Advanced Query Syntax", + id: "cti_api/search_queries", }, { type: "link", - label: "Swagger", + label: "Swagger ↗", href: "https://crowdsecurity.github.io/cti-api/", }, + { + type: "html", + value: "
", + }, { type: "doc", label: "FAQ", @@ -206,6 +226,12 @@ const sidebarsUnversionedConfig: SidebarConfig = { value: "
", defaultStyle: false, }, + // ── Security Stack ────────────────────────────────────────────────────────── + { + type: "html", + value: "Security Stack", + defaultStyle: false, + }, { type: "category", label: "Security Engine", @@ -353,10 +379,19 @@ const sidebarsUnversionedConfig: SidebarConfig = { value: "
", defaultStyle: false, }, + // ── Blocklist & Allowlists ────────────────────────────────────────────────────────── + { + type: "html", + value: "Blocklist & Allowlists", + defaultStyle: false, + }, { label: "Blocklists", type: "doc", id: "blocklists/intro", + customProps: { + tag: "otherSection", + }, }, { id: "console/allowlists", @@ -379,67 +414,73 @@ const sidebarsUnversionedConfig: SidebarConfig = { value: "
", defaultStyle: false, }, + // ── IP Reputation / CTI ────────────────────────────────────────────────────────── + { + type: "html", + value: "IP Reputation / CTI", + defaultStyle: false, + }, + { + id: "console/ip_reputation/intro", + type: "doc", + label: "Web UI Overview", + }, { type: "category", - label: "IP Reputation / CTI", + label: "Search UI", link: { type: "doc", - id: "console/ip_reputation/intro", + id: "console/ip_reputation/search_ui", }, items: [ { - type: "category", - label: "Search UI", - link: { - type: "doc", - id: "console/ip_reputation/search_ui", + type: "doc", + label: "Advanced Search", + id: "console/ip_reputation/search_ui_advanced", + }, + { + type: "doc", + label: "IP Reputation Report", + id: "console/ip_reputation/ip_report", + }, + { + type: "link", + label: "Search Queries Syntax", + href: "/u/cti_api/search_queries", + customProps: { + tag: "otherSection", }, - items: [ - { - type: "doc", - label: "Advanced Search", - id: "console/ip_reputation/search_ui_advanced", - }, - { - type: "link", - label: "Search Queries Syntax", - href: "/u/cti_api/search_queries", - customProps: { - tag: "otherSection", - }, - }, - { - type: "doc", - label: "IP Reputation Report", - id: "console/ip_reputation/ip_report", - }, - ], }, { - type: "category", - label: "API Keys", - link: { - type: "doc", - id: "console/ip_reputation/api_keys", + type: "doc", + label: "IP Reputation Report", + id: "console/ip_reputation/ip_report", + }, + ], + }, + { + type: "category", + label: "API Keys", + link: { + type: "doc", + id: "console/ip_reputation/api_keys", + }, + items: [ + { + type: "link", + label: "CTI API Integrations", + href: "/u/cti_api/api_integration/integration_intro", + customProps: { + tag: "otherSection", + }, + }, + { + type: "link", + label: "Enrichment Fields Ref", + href: "/u/cti_api/taxonomy/intro", + customProps: { + tag: "otherSection", }, - items: [ - { - type: "link", - label: "CTI API Integrations", - href: "/u/cti_api/api_integration/integration_intro", - customProps: { - tag: "otherSection", - }, - }, - { - type: "link", - label: "Enrichment Fields Ref", - href: "/u/cti_api/taxonomy/intro", - customProps: { - tag: "otherSection", - }, - }, - ], }, ], }, @@ -448,28 +489,22 @@ const sidebarsUnversionedConfig: SidebarConfig = { value: "
", defaultStyle: false, }, + // ── Other ────────────────────────────────────────────────────────── { type: "category", - label: "Notification integrations", + label: "Notifications", + link: { + type: "doc", + id: "console/notification_integrations/overview", + }, customProps: { tag: "premium", }, items: [ - { - type: "doc", - label: "Overview", - id: "console/notification_integrations/overview", - customProps: { - tag: "premium", - }, - }, { type: "doc", label: "Notification Rule", id: "console/notification_integrations/rule", - customProps: { - tag: "premium", - }, }, { type: "doc", @@ -492,24 +527,17 @@ const sidebarsUnversionedConfig: SidebarConfig = { { type: "category", label: "Service API", + link: { + type: "doc", + id: "console/service_api/getting_started", + }, customProps: { tag: "premium", }, items: [ - { - type: "doc", - id: "console/service_api/getting_started", - label: "Getting Started", - customProps: { - tag: "premium", - }, - }, { type: "category", label: "Quickstart", - customProps: { - tag: "premium", - }, items: [ "console/service_api/quickstart/authentication", "console/service_api/quickstart/blocklists", @@ -531,17 +559,11 @@ const sidebarsUnversionedConfig: SidebarConfig = { { type: "category", label: "SDKs", - customProps: { - tag: "premium", - }, items: [ { type: "doc", label: "Python", id: "console/service_api/sdks/python", - customProps: { - tag: "premium", - }, }, ], }, @@ -559,9 +581,6 @@ const sidebarsUnversionedConfig: SidebarConfig = { type: "doc", id: "console/service_api/faq", label: "FAQ", - customProps: { - tag: "premium", - }, }, ], }, diff --git a/crowdsec-docs/src/components/cti-integration-tile.tsx b/crowdsec-docs/src/components/cti-integration-tile.tsx new file mode 100644 index 000000000..6b336a18f --- /dev/null +++ b/crowdsec-docs/src/components/cti-integration-tile.tsx @@ -0,0 +1,156 @@ +import useBaseUrl from "@docusaurus/useBaseUrl"; +// biome-ignore lint/correctness/noUnusedImports: React is needed for JSX +import React, { useRef, useState } from "react"; +import { type CtiIntegrationData, ctiIntegrations } from "./data/cti-integrations"; + +export { ctiIntegrations }; + +export default function CtiIntegrationTile({ name, slug, href, plugin, desc, color }: CtiIntegrationData) { + const logoSrc = useBaseUrl(`/img/cti-integrations/logo-${slug}.png`); + const fallbackSrc = useBaseUrl("/img/cti-integrations/logo-default.png"); + const [tooltip, setTooltip] = useState(false); + const tooltipRef = useRef(null); + + return ( +
+ {/* left gradient strip */} +
+ { + const wrapper = (e.currentTarget as HTMLAnchorElement).parentElement as HTMLDivElement; + wrapper.style.boxShadow = `0 4px 12px ${color}30`; + wrapper.style.borderColor = `${color}70`; + setTooltip(true); + }} + onMouseLeave={(e) => { + const wrapper = (e.currentTarget as HTMLAnchorElement).parentElement as HTMLDivElement; + wrapper.style.boxShadow = "none"; + wrapper.style.borderColor = "var(--ifm-color-emphasis-200)"; + setTooltip(false); + }} + > +
+ {`${name} { + (e.currentTarget as HTMLImageElement).onerror = null; + (e.currentTarget as HTMLImageElement).src = fallbackSrc; + }} + style={{ width: "28px", height: "28px", objectFit: "contain", pointerEvents: "none", userSelect: "none" }} + /> +
+
+ + {name} + + + {plugin} + +
+ + + {/* Hover tooltip */} + {tooltip && ( +
+
+ {name} +
+ {desc} + {/* Arrow */} +
+
+ )} +
+ ); +} diff --git a/crowdsec-docs/src/components/data/cti-integrations.ts b/crowdsec-docs/src/components/data/cti-integrations.ts new file mode 100644 index 000000000..a05e0b8d7 --- /dev/null +++ b/crowdsec-docs/src/components/data/cti-integrations.ts @@ -0,0 +1,139 @@ +export interface CtiIntegrationData { + name: string; + slug: string; + href: string; + plugin: string; // vendor-specific plugin/extension/module name shown as subtext + desc: string; // shown on hover tooltip + color: string; +} + +export const ctiIntegrations: CtiIntegrationData[] = [ + { + name: "IPDEX", + slug: "ipdex", + href: "/u/cti_api/api_integration/integration_ipdex", + plugin: "CrowdSec CTI Reports", + desc: "IPDEX extracts IP addresses from your logs and cross-references them against CrowdSec's global threat intelligence network — instantly.", + color: "#e55c2f", + }, + { + name: "Chrome", + slug: "chrome", + href: "/u/cti_api/api_integration/integration_chrome", + plugin: "CrowdSec CTI Extension", + desc: "Browser extension to instantly look up any IP on a page without leaving your browser.", + color: "#4285f4", + }, + { + name: "Gigasheet", + slug: "gigasheet", + href: "/u/cti_api/api_integration/integration_gigasheet", + plugin: "No-Code API Enrichment", + desc: "Enrich spreadsheet columns with CTI data using Gigasheet's no-code API enrichment feature — no scripting required.", + color: "#00b4d8", + }, + { + name: "IntelOwl", + slug: "intelowl", + href: "/u/cti_api/api_integration/integration_intelowl", + plugin: "CrowdSec Analyzer", + desc: "Open-source threat intelligence platform with a built-in CrowdSec analyzer for automated IP enrichment.", + color: "#e63946", + }, + { + name: "Maltego", + slug: "maltego", + href: "/u/cti_api/api_integration/integration_maltego", + plugin: "CrowdSec Transform", + desc: "Link analysis and data visualization tool. Use the CrowdSec Transform to pivot from IPs to full reputation context.", + color: "#efefef", + }, + { + name: "MISP", + slug: "misp", + href: "/u/cti_api/api_integration/integration_misp", + plugin: "CrowdSec Feed Module", + desc: "Open-source threat sharing platform. Import CrowdSec CTI data as a MISP feed for collaborative threat intelligence workflows.", + color: "#1a73e8", + }, + { + name: "MSTICpy", + slug: "msticpy", + href: "/u/cti_api/api_integration/integration_msticpy", + plugin: "CrowdSec TI Provider", + desc: "Microsoft's open-source security Python library. Query CrowdSec CTI directly from Jupyter notebooks and threat hunting scripts.", + color: "#00a4ef", + }, + { + name: "Microsoft Sentinel", + slug: "ms-sentinel", + href: "/u/cti_api/api_integration/integration_ms_sentinel", + plugin: "CrowdSec Threat Intelligence", + desc: "Cloud-native SIEM. Enrich Sentinel incidents and hunting queries with CrowdSec IP reputation data via the native connector.", + color: "#0078d4", + }, + { + name: "OpenCTI", + slug: "opencti", + href: "/u/cti_api/api_integration/integration_opencti", + plugin: "CrowdSec Connector", + desc: "Open-source CTI platform. Ingest CrowdSec reputation data as a structured connector for correlation and sharing.", + color: "#e55c2f", + }, + { + name: "Palo Alto XSOAR", + slug: "paloalto_xsoar", + href: "/u/cti_api/api_integration/integration_paloalto_xsoar", + plugin: "CrowdSec Integration", + desc: "SOAR platform by Palo Alto Networks. Automate IP reputation lookups in playbooks using the CrowdSec integration.", + color: "#fa582d", + }, + { + name: "QRadar", + slug: "qradar", + href: "/u/cti_api/api_integration/integration_qradar", + plugin: "CrowdSec App", + desc: "IBM SIEM solution. Enrich QRadar offenses and rules with CrowdSec IP reputation via the dedicated app.", + color: "#0530ad", + }, + { + name: "Security Copilot", + slug: "securitycopilot", + href: "/u/cti_api/api_integration/integration_securitycopilot", + plugin: "CrowdSec Plugin", + desc: "Microsoft's AI-powered security assistant. Query CrowdSec CTI data inline using natural language prompts.", + color: "#0078d4", + }, + { + name: "Sekoia XDR", + slug: "sekoia", + href: "/u/cti_api/api_integration/integration_sekoia_xdr", + plugin: "CrowdSec CTI Intake", + desc: "Extended Detection and Response platform. Feed CrowdSec IP reputation into Sekoia for detection and threat hunting.", + color: "#6c47ff", + }, + { + name: "Splunk SIEM", + slug: "splunk_siem", + href: "/u/cti_api/api_integration/integration_splunk_siem", + plugin: "CrowdSec Add-on for Splunk", + desc: "Enrich Splunk Enterprise Security searches and dashboards with live CrowdSec IP reputation data.", + color: "#65a637", + }, + { + name: "Splunk SOAR", + slug: "splunk_soar", + href: "/u/cti_api/api_integration/integration_splunk_soar", + plugin: "CrowdSec App for SOAR", + desc: "Automate IP enrichment and response playbooks in Splunk SOAR using the CrowdSec threat intelligence app.", + color: "#65a637", + }, + { + name: "TheHive", + slug: "thehive", + href: "/u/cti_api/api_integration/integration_thehive", + plugin: "CrowdSec Analyzer", + desc: "Open-source SIRP for incident response teams. Add CrowdSec as a Cortex analyzer to auto-enrich observables.", + color: "#f5a623", + }, +]; diff --git a/crowdsec-docs/src/components/integration-tile.tsx b/crowdsec-docs/src/components/integration-tile.tsx new file mode 100644 index 000000000..7ff35de31 --- /dev/null +++ b/crowdsec-docs/src/components/integration-tile.tsx @@ -0,0 +1,119 @@ +import useBaseUrl from "@docusaurus/useBaseUrl"; +import React from "react"; + +interface IntegrationTileProps { + name: string; + slug: string; + href: string; + desc?: string; + color: string; + children?: React.ReactNode; +} + +export const firewallIntegrations = [ + { + name: "Checkpoint", + slug: "checkpoint", + href: "/u/integrations/checkpoint", + desc: "Custom Intelligence (IoC) Feeds", + color: "#cc0000", + }, + { name: "Cisco", slug: "cisco", href: "/u/integrations/cisco", desc: "Security Intelligence feeds", color: "#1ba0d8" }, + { name: "F5", slug: "f5", href: "/u/integrations/f5", desc: "External IP blocklist / Feed lists", color: "#e4002b" }, + { name: "Fortinet", slug: "fortinet", href: "/u/integrations/fortinet", desc: "IP address Threat Feeds", color: "#ee3124" }, + { name: "Juniper", slug: "juniper", href: "/u/integrations/juniper", desc: "Security Dynamic Address feeds", color: "#84b135" }, + { name: "Mikrotik", slug: "mikrotik", href: "/u/integrations/mikrotik", desc: "IP blocklist ingestion", color: "#9f1d20" }, + { name: "OPNsense", slug: "opnsense", href: "/u/integrations/opnsense", desc: "URL Table (IPs) aliases", color: "#d94f00" }, + { name: "Palo Alto", slug: "paloalto", href: "/u/integrations/paloalto", desc: "External Dynamic Lists (EDL)", color: "#fa582d" }, + { name: "pfSense", slug: "pfsense", href: "/u/integrations/pfsense", desc: "URL Table (IPs) aliases", color: "#212d6e" }, + { name: "Sophos", slug: "sophos", href: "/u/integrations/sophos", desc: "Third-Party Threat Feeds", color: "#1f6bff" }, +]; + +export default function IntegrationTile({ name, slug, href, desc, color, children }: IntegrationTileProps) { + const logoSrc = useBaseUrl(`/img/blaas/logo-${slug}.png`); + const fallbackSrc = useBaseUrl("/img/blaas/logo-default.png"); + + return ( +
+
+ { + const wrapper = (e.currentTarget as HTMLAnchorElement).parentElement as HTMLDivElement; + wrapper.style.boxShadow = `0 4px 12px ${color}30`; + wrapper.style.borderColor = `${color}70`; + }} + onMouseLeave={(e) => { + const wrapper = (e.currentTarget as HTMLAnchorElement).parentElement as HTMLDivElement; + wrapper.style.boxShadow = "none"; + wrapper.style.borderColor = "var(--ifm-color-emphasis-200)"; + }} + > +
+ {`${name} { + (e.currentTarget as HTMLImageElement).onerror = null; + (e.currentTarget as HTMLImageElement).src = fallbackSrc; + }} + style={{ width: "32px", height: "32px", objectFit: "contain", pointerEvents: "none", userSelect: "none" }} + /> +
+
+ + {name} + + + {children || desc} + +
+ +
+ ); +} diff --git a/crowdsec-docs/src/css/custom.css b/crowdsec-docs/src/css/custom.css index 18a40585f..47f8656ed 100644 --- a/crowdsec-docs/src/css/custom.css +++ b/crowdsec-docs/src/css/custom.css @@ -79,6 +79,115 @@ div.markdown { @apply text-justify; } +/* Pull embedded full-bleed content flush with the doc container edges */ +.doc-flush { + margin-left: calc(-1 * var(--ifm-spacing-horizontal)); + margin-right: calc(-1 * var(--ifm-spacing-horizontal)); + margin-top: calc(-1 * var(--ifm-spacing-vertical, 1rem)); +} + +/* ── Shared doc-page primitives ────────────────────────────────────────── */ + +/* Monospace eyebrow label above a section title */ +.doc-eyebrow { + font-family: var(--ifm-font-family-monospace); + font-size: 10px; + letter-spacing: 1.2px; + text-transform: uppercase; + color: var(--ifm-color-emphasis-600); + margin-bottom: 4px; +} + +/* Section title */ +.doc-section-title { + font-weight: 700; + font-size: 1.15rem; + margin-bottom: 0.4rem; +} + +/* Card: used for differentiator items, ref cards, etc. */ +.doc-card { + background: rgb(var(--card) / var(--tw-bg-opacity, 1)); + border: 1px solid var(--ifm-color-emphasis-200); + border-radius: 10px; + padding: 14px 16px; +} + +/* Quick-access strip — label + pill buttons in a row (matches homepage "Already running?" strip) */ +.doc-quick-strip { + display: flex; + align-items: center; + gap: 16px; + flex-wrap: wrap; + padding: 10px 16px; + background: rgb(var(--card) / var(--tw-bg-opacity, 1)); + border: 1px solid var(--ifm-color-emphasis-200); + border-radius: 10px; + margin-bottom: 2rem; +} + +.doc-quick-strip__label { + font-family: var(--ifm-font-family-monospace); + font-size: 10.5px; + letter-spacing: 0.8px; + text-transform: uppercase; + color: var(--ifm-color-emphasis-600); + white-space: nowrap; + flex-shrink: 0; +} + +.doc-quick-strip__pills { + display: flex; + flex-wrap: wrap; + gap: 6px; +} + +.doc-quick-strip__pill { + display: inline-flex; + align-items: center; + gap: 6px; + padding: 5px 12px; + border-radius: 7px; + font-size: 12.5px; + line-height: 1; + white-space: nowrap; + color: var(--ifm-color-emphasis-700); + border: 1px solid var(--ifm-color-emphasis-200); + background: var(--ifm-background-color); + text-decoration: none; + text-align: left; + transition: + border-color 0.15s, + color 0.15s; +} + +/* Reset markdown-injected styles when pills appear inside doc content */ +div.markdown .doc-quick-strip__pill { + margin-bottom: 0; + display: inline-flex; +} + +/* Horizontal rule divider with centered text label */ +.doc-section-sep { + display: flex; + align-items: center; + gap: 12px; + color: var(--ifm-color-emphasis-600); + font-size: 10px; + font-family: var(--ifm-font-family-monospace); + letter-spacing: 1px; + text-transform: uppercase; + margin-bottom: 1rem; +} + +.doc-section-sep::before, +.doc-section-sep::after { + content: ""; + flex: 1; + height: 1px; + background: var(--ifm-color-emphasis-200); +} + a { @apply text-primary; } diff --git a/crowdsec-docs/src/pages/cti.tsx b/crowdsec-docs/src/pages/cti.tsx deleted file mode 100644 index 0462986b3..000000000 --- a/crowdsec-docs/src/pages/cti.tsx +++ /dev/null @@ -1,187 +0,0 @@ -import Link from "@docusaurus/Link"; -import { - FeatureCard, - FeatureCardProps, - IntegrationItem, - IntegrationItemProps, - ProductPageLayout, - Section, -} from "../components/product-page"; - -const gettingStarted: FeatureCardProps[] = [ - { - title: "Introduction", - description: "Learn what the CTI API offers and how to use it.", - link: "/u/cti_api/intro", - icon: "📖", - }, - { - title: "Console Quickstart", - description: "Use the web interface to search and explore CTI data.", - link: "/u/console/ip_reputation/intro", - icon: "🖥️", - }, - { - title: "API Quickstart", - description: "Integrate CTI data programmatically into your workflows.", - link: "/u/console/ip_reputation/api_keys", - icon: "🔌", - }, -]; - -const coreFeatures: FeatureCardProps[] = [ - { - title: "IP Reports", - description: "Get full context for any IP, including reputation and activity.", - link: "/u/console/ip_reputation/ip_report", - icon: "📋", - }, - { - title: "Search Queries", - description: "Search CTI data with filters and query operators.", - link: "/u/cti_api/search_queries", - icon: "🔍", - }, - { - title: "Advanced Search", - description: "Build complex queries to spot patterns at scale.", - link: "/u/console/ip_reputation/search_ui_advanced", - icon: "🎯", - }, - { - title: "CVE Explorer", - description: "Explore CVEs and see active exploitation by IP.", - link: "/u/console/ip_reputation/intro#live-exploit-tracker", - icon: "🛡️", - }, -]; - -const taxonomy: FeatureCardProps[] = [ - { - title: "Taxonomy Overview", - description: "Learn how CTI data is structured and labeled.", - link: "/u/cti_api/taxonomy/intro", - icon: "📊", - }, - { - title: "Reputation Scores", - description: "See how scores are computed and what they mean.", - link: "/u/cti_api/taxonomy/scores", - icon: "⭐", - }, - { - title: "Behaviors", - description: "Explore the behaviors we track across attacks.", - link: "/u/cti_api/taxonomy/behaviors", - icon: "🔬", - }, - { - title: "Classifications", - description: "Understand threat classifications and categories.", - link: "/u/cti_api/taxonomy/classifications", - icon: "🏷️", - }, -]; - -const integrations: IntegrationItemProps[] = [ - { title: "Splunk SIEM", link: "/u/cti_api/api_integration/integration_splunk_siem" }, - { title: "Splunk SOAR", link: "/u/cti_api/api_integration/integration_splunk_soar" }, - { title: "Microsoft Sentinel", link: "/u/cti_api/api_integration/integration_ms_sentinel" }, - { title: "Security Copilot", link: "/u/cti_api/api_integration/integration_securitycopilot" }, - { title: "Palo Alto XSOAR", link: "/u/cti_api/api_integration/integration_paloalto_xsoar" }, - { title: "IBM QRadar", link: "/u/cti_api/api_integration/integration_qradar" }, - { title: "TheHive", link: "/u/cti_api/api_integration/integration_thehive" }, - { title: "OpenCTI", link: "/u/cti_api/api_integration/integration_opencti" }, - { title: "MISP", link: "/u/cti_api/api_integration/integration_misp" }, - { title: "Maltego", link: "/u/cti_api/api_integration/integration_maltego" }, - { title: "Sekoia XDR", link: "/u/cti_api/api_integration/integration_sekoia_xdr" }, - { title: "IntelOwl", link: "/u/cti_api/api_integration/integration_intelowl" }, -]; - -const resources: FeatureCardProps[] = [ - { - title: "API Reference", - description: "Full API reference with endpoints and parameters.", - link: "https://crowdsecurity.github.io/cti-api/", - icon: "📚", - }, - { - title: "FAQ", - description: "Common questions about access, limits, and data.", - link: "/u/cti_api/faq", - icon: "❓", - }, - { - title: "Chrome Extension", - description: "Check IP reputation directly in your browser.", - link: "/u/cti_api/api_integration/integration_chrome", - icon: "🌐", - }, -]; - -const CTIPage = () => { - return ( - -
-
- {gettingStarted.map((item) => ( - - ))} -
-
- -
-
- {coreFeatures.map((item) => ( - - ))} -
-
- -
-
- {taxonomy.map((item) => ( - - ))} -
-
- -
-
- {integrations.map((item) => ( - - ))} -
-
- - View all integrations → - -
-
- -
-
- {resources.map((item) => ( - - ))} -
-
- - ); -}; - -export default CTIPage; diff --git a/crowdsec-docs/src/pages/index.tsx b/crowdsec-docs/src/pages/index.tsx index 0fecb7733..db1571b49 100644 --- a/crowdsec-docs/src/pages/index.tsx +++ b/crowdsec-docs/src/pages/index.tsx @@ -1,75 +1,484 @@ import Link from "@docusaurus/Link"; import Layout from "@theme/Layout"; import SearchBar from "@theme/SearchBar"; -import React, { useEffect } from "react"; +import { ExternalLink } from "lucide-react"; +import React, { useEffect, useState } from "react"; import { Button } from "../ui/button"; -type ProductCardProps = { - title: string; - description: string; +// ── Intent card ────────────────────────────────────────────────────────────── + +type IntentCardProps = { icon: React.ReactNode; - link: string; - features: string[]; - bestFor: string; + title: string; + desc: string; + pill: string; + accent: string; + href: string; + aka?: string[]; }; -const ProductCard = ({ title, description, icon, link, features, bestFor }: ProductCardProps): React.JSX.Element => ( - -
-
-
+const IntentCard = ({ icon, title, desc, pill, accent, href, aka }: IntentCardProps) => ( + { + const el = e.currentTarget as HTMLAnchorElement; + el.style.borderColor = accent; + el.style.boxShadow = `0 8px 24px ${accent}22, 0 0 0 1px ${accent}`; + el.style.transform = "translateY(-2px)"; + el.style.borderRadius = "14px"; + }} + onMouseLeave={(e) => { + const el = e.currentTarget as HTMLAnchorElement; + el.style.borderColor = ""; + el.style.boxShadow = ""; + el.style.transform = ""; + }} + > +
+
+
{icon}
-

- {title} -

+
{title}
-

{description}

-

{bestFor}

-
    - {features.map((feature) => ( -
  • - ✓ - {feature} -
    • - ))} -
-
- Explore product → +
+ {desc}
+
+ + → {pill} + +
+ {aka && aka.length > 0 && ( +
+ + aka + + {aka.map((tag) => ( + + {tag} + + ))} +
+ )}
- + +); + +// ── Schema / path block ─────────────────────────────────────────────────────── + +type Step = { + num: number; + icon: string; + title: string; + desc: string; + hint?: string; +}; + +type SchemaBlockProps = { + id: string; + color: string; + eyebrowIcon: string; + eyebrow: string; + title: string; + ctaLabel: string; + ctaHref: string; + steps: Step[]; + open: boolean; + onToggle: () => void; +}; + +const SchemaBlock = ({ id, color, eyebrowIcon, eyebrow, title, ctaLabel, ctaHref, steps, open, onToggle }: SchemaBlockProps) => ( +
+ {/* left accent strip */} +
+ {/* subtle radial glow */} +
+ + {/* header — always visible, clickable to toggle */} + + + {/* collapsible step flow */} + {open && ( +
+ {steps.map((step, i) => ( +
+ {i > 0 && ( +
+ → +
+ )} + {step.hint && ( +
+ {step.hint} +
+ )} +
+ {step.num} +
+
{step.icon}
+
{step.title}
+
{step.desc}
+
+ ))} +
+ )} +
); -const products: ProductCardProps[] = [ +// ── Data ────────────────────────────────────────────────────────────────────── + +const ORANGE = "#f97316"; +const GREEN = "#22d3a0"; +const BLUE = "#60a5fa"; + +const intents: IntentCardProps[] = [ + { + icon: Security Engine, + accent: ORANGE, + title: "Detect & Block attacks on my servers", + desc: "Locally identify and ban bad behaving IPs observed in your logs and requests with CrowdSec Detection Scenarios, and Virtual-Patching Collections.", + pill: "Security Engine", + href: "/security-engine", + aka: ["IDPS", "WAF", "CrowdSec FOSS"], + }, + { + icon: Blocklists, + accent: GREEN, + title: "Push a Blocklists into my firewall, CDN or WAF", + desc: "You manage network perimeter devices and want a URL to subscribe to — no agent to install.", + pill: "Blocklist Integration Endpoint", + href: "/blocklists", + aka: ["Threat Feeds", "IOC Streams", "Deny-list"], + }, + { + icon: CTI, + accent: BLUE, + title: "Investigate IPs Behaviors and Enrich Alerts", + desc: "You're a security analyst or developer who wants IP context, behaviors, CVEs, Aggressivity... In a browser or via REST API.", + pill: "IP Reputation & CTI", + href: "/u/cti_api/intro", + aka: ["IoC Lookup", "Threat Intel"], + }, +]; + +const schemas: Omit[] = [ { - title: "Security Engine", - description: "Analyze your logs to detect attacks, block malicious IPs, and protect web applications.", - icon: Security Engine, - link: "/security-engine", - features: ["Behavior-based detection", "Community threat sharing", "AppSec / WAF for web apps", "Open source"], - bestFor: "Best for self-hosted detection and protection.", + id: "schema-engine", + color: ORANGE, + eyebrowIcon: "🛡️", + eyebrow: "Security Engine", + title: "Detect and block malicious behaviors on your infrastructure", + ctaLabel: "Install CrowdSec →", + ctaHref: "/security-engine", + steps: [ + { + num: 1, + icon: "⚡", + title: "Install the Security Engine", + desc: "Runs on your server, detects attack patterns in real time — immediately protected, and continuously updated with CrowdSec Community Blocklist.", + }, + { + num: 2, + icon: "🛡️", + hint: "RECOMMENDED", + title: "Activate the WAF module", + desc: "Layer in the AppSec component to inspect HTTP traffic and block web exploits before they reach your app.", + }, + { + num: 3, + icon: "📋", + hint: "OPTIONAL", + title: "Subscribe to blocklists", + desc: "Add a selection of extra blocklists on top of the built-in detection & community blocklist", + }, + { + num: 4, + icon: "✍️", + hint: "OPTIONAL", + title: "Craft your own rules", + desc: "Write custom scenarios for your stack, then share them back with the community on the Hub.", + }, + ], }, { - title: "Blocklists", - description: "Deploy curated threat intel feeds to protect your network without running detection yourself.", - icon: Blocklists, - link: "/blocklists", - features: ["Curated IP lists", "Ready to deploy", "Automatic updates", "Multiple categories"], - bestFor: "Best for fast protection with minimal setup.", + id: "schema-blocklists", + color: GREEN, + eyebrowIcon: "🚫", + eyebrow: "Blocklists", + title: "Push curated threat feeds directly into your firewall, CDN, or WAF", + ctaLabel: "Discover Blocklists →", + ctaHref: "/blocklists", + steps: [ + { + num: 1, + icon: "🔌", + title: "Create a blocklist integration endpoint", + desc: "Generates a dedicated URL and credentials to serve blocklists to your perimeter devices.", + }, + { + num: 2, + icon: "🗂️", + title: "Choose which blocklists to serve", + desc: "Select from curated feeds by threat category: scanners, bots, TOR exits, exploits, and more.", + }, + { + num: 3, + icon: "🔗", + title: "Plug it in as an external threat feed", + desc: "Point your firewall, CDN, or WAF at the endpoint. Use the feed to protect your infrastructure.", + }, + ], }, { - title: "CTI", - description: "Query CrowdSec threat intelligence to enrich investigations, automate lookups, and integrate with tools.", - icon: CTI, - link: "/cti", - features: ["REST API access", "IP reputation scores", "Attack context", "SIEM integrations"], - bestFor: "Best for enrichment, integrations, and investigations.", + id: "schema-cti", + color: BLUE, + eyebrowIcon: "🔍", + eyebrow: "IP Reputation & CTI", + title: "Query threat intel — in the browser or via API in your tools", + ctaLabel: "Explore CTI →", + ctaHref: "/u/cti_api/intro", + steps: [ + { + num: 1, + icon: "🖥️", + title: "Look up any IP in the Console", + desc: "Search instantly from our Web UI— get reputation score, behaviors, attack history, and CVE links.", + }, + { + num: 2, + icon: "🔑", + hint: "Integrate", + title: "Generate a CTI API key", + desc: "Unlock programmatic access to 30+ data points on IPs detected by CrowdSec Network.", + }, + { + num: 3, + icon: "⚙️", + hint: "Enrich", + title: "Connect to your SIEM/SOAR/TIP", + desc: "Native integrations for Splunk, Sentinel, QRadar, TheHive, OpenCTI, MISP, and more.", + }, + ], }, ]; +// ── Page ────────────────────────────────────────────────────────────────────── + const HomePage = () => { - // Add class to body to hide navbar search on homepage useEffect(() => { document.body.classList.add("homepage"); document.documentElement.classList.add("homepage"); @@ -79,29 +488,39 @@ const HomePage = () => { }; }, []); + const [openSchema, setOpenSchema] = useState(null); + + const toggleSchema = (id: string) => setOpenSchema((prev) => (prev === id ? null : id)); + return (
- {/* Hero Section */} -
-
-
-
-

CrowdSec Documentation

-

- Pronounced: Krowd-Sek [/kraʊd-sek/] -

-

- Community-driven security that unifies detection, blocklists, and threat intel for modern - infrastructure. -

-
- CrowdSec Logo -
+ {/* Hero */} +
+
+
+

+ Find the right +
+ CrowdSec tool for you +

+

+ IDPS/WAF | Blocklist feeds | IP Reputation +

- {/* Search Section */} + {/* Search */}
@@ -110,78 +529,206 @@ const HomePage = () => {
- {/* Product Selection */} -
-
-

- Choose your starting point -

-

- Each path links to setup, how-tos, and reference docs. -

- -
- {products.map((product) => ( - + {/* Intent strip */} +
+
+
+ I want to… +
+
+ {intents.map((i) => ( + ))}
+ + {/* Existing user strip */} +
+ + Already running CrowdSec? + +
+ {[ + { label: "🖥️ Open the Console", href: "https://app.crowdsec.net", external: true }, + { label: "🛡️ Activate the WAF", href: "/docs/next/appsec/intro" }, + { label: "📊 Measure what is being Blocked", href: "/u/console/remediation_metrics" }, + { label: "🩺 Check my Stack Health", href: "/u/console/stackhealth" }, + ].map(({ label, href, external }) => ( + + {label} + {external && } + + ))} +
+
- {/* Help Section */} -
-
-

- Not sure where to start? -

-

- Answer a few questions and get a recommended path with install steps for your stack. -

-
- - - - - - + {/* How each path works — accordion */} +
+
+
+
💡 how each path works +
+ + {schemas.map((s) => ( + toggleSchema(s.id)} /> + ))}
- {/* Quick Links */} -
-
-

Popular Docs

-
- - - - - - - - - - - - - - - + {/* Not sure / fallback */} +
+
+
+
+
Not sure where to start?
+
+ Answer a few questions and get a recommended path with install steps for your stack. +
+
+
+ + + + + + +
+
+
+
+ + {/* Popular docs */} +
+
+
+ Popular docs +
+
+ {[ + { label: "🖥️ Console", href: "/u/console/intro" }, + { label: "🛡️ AppSec / WAF", href: "/docs/next/appsec/intro" }, + { label: "💻 CLI Reference", href: "/docs/next/cscli/" }, + { label: "🔑 CTI API Keys", href: "/u/console/ip_reputation/api_keys" }, + { label: "❓ Troubleshooting", href: "/u/troubleshooting/intro" }, + // Need to redo the prompt this one is out of date + // { + // label: "📖 Docs AI Assistant", + // href: "https://chatgpt.com/g/g-682c3a61a78081918417571116c2b563-crowdsec-documentation", + // external: true, + // }, + { label: "🌐 WWW - CrowdSec", href: "https://www.crowdsec.net", external: true }, + ].map(({ label, href, external }) => ( + + {label} + {external && } + + ))}
diff --git a/crowdsec-docs/src/theme/DocSidebarItem/Category/index.tsx b/crowdsec-docs/src/theme/DocSidebarItem/Category/index.tsx index 5ad37769c..42f6e7de1 100644 --- a/crowdsec-docs/src/theme/DocSidebarItem/Category/index.tsx +++ b/crowdsec-docs/src/theme/DocSidebarItem/Category/index.tsx @@ -195,7 +195,7 @@ export default function DocSidebarItemCategory({ {...props} > {label} - {!collapsible && isPremium && ( + {isPremium && ( Premium diff --git a/crowdsec-docs/static/img/blaas/logo-checkpoint.png b/crowdsec-docs/static/img/blaas/logo-checkpoint.png new file mode 100644 index 000000000..41ce0b625 Binary files /dev/null and b/crowdsec-docs/static/img/blaas/logo-checkpoint.png differ diff --git a/crowdsec-docs/static/img/blaas/logo-cisco.png b/crowdsec-docs/static/img/blaas/logo-cisco.png new file mode 100644 index 000000000..5909f67c7 Binary files /dev/null and b/crowdsec-docs/static/img/blaas/logo-cisco.png differ diff --git a/crowdsec-docs/static/img/blaas/logo-default.png b/crowdsec-docs/static/img/blaas/logo-default.png new file mode 100644 index 000000000..468cf5f4f Binary files /dev/null and b/crowdsec-docs/static/img/blaas/logo-default.png differ diff --git a/crowdsec-docs/static/img/blaas/logo-f5.png b/crowdsec-docs/static/img/blaas/logo-f5.png new file mode 100644 index 000000000..23da38486 Binary files /dev/null and b/crowdsec-docs/static/img/blaas/logo-f5.png differ diff --git a/crowdsec-docs/static/img/blaas/logo-fortinet.png b/crowdsec-docs/static/img/blaas/logo-fortinet.png new file mode 100644 index 000000000..49f4ec406 Binary files /dev/null and b/crowdsec-docs/static/img/blaas/logo-fortinet.png differ diff --git a/crowdsec-docs/static/img/blaas/logo-juniper.png b/crowdsec-docs/static/img/blaas/logo-juniper.png new file mode 100644 index 000000000..6e80ba980 Binary files /dev/null and b/crowdsec-docs/static/img/blaas/logo-juniper.png differ diff --git a/crowdsec-docs/static/img/blaas/logo-mikrotik.png b/crowdsec-docs/static/img/blaas/logo-mikrotik.png new file mode 100644 index 000000000..7545c47c6 Binary files /dev/null and b/crowdsec-docs/static/img/blaas/logo-mikrotik.png differ diff --git a/crowdsec-docs/static/img/blaas/logo-opnsense.png b/crowdsec-docs/static/img/blaas/logo-opnsense.png new file mode 100644 index 000000000..0511fea68 Binary files /dev/null and b/crowdsec-docs/static/img/blaas/logo-opnsense.png differ diff --git a/crowdsec-docs/static/img/blaas/logo-paloalto.png b/crowdsec-docs/static/img/blaas/logo-paloalto.png new file mode 100644 index 000000000..72371b771 Binary files /dev/null and b/crowdsec-docs/static/img/blaas/logo-paloalto.png differ diff --git a/crowdsec-docs/static/img/blaas/logo-pfsense.png b/crowdsec-docs/static/img/blaas/logo-pfsense.png new file mode 100644 index 000000000..1b4d566a7 Binary files /dev/null and b/crowdsec-docs/static/img/blaas/logo-pfsense.png differ diff --git a/crowdsec-docs/static/img/blaas/logo-sophos.png b/crowdsec-docs/static/img/blaas/logo-sophos.png new file mode 100644 index 000000000..358c0f94d Binary files /dev/null and b/crowdsec-docs/static/img/blaas/logo-sophos.png differ diff --git a/crowdsec-docs/static/img/cti-integrations/logo-chrome.png b/crowdsec-docs/static/img/cti-integrations/logo-chrome.png new file mode 100644 index 000000000..649fa44bc Binary files /dev/null and b/crowdsec-docs/static/img/cti-integrations/logo-chrome.png differ diff --git a/crowdsec-docs/static/img/cti-integrations/logo-default.png b/crowdsec-docs/static/img/cti-integrations/logo-default.png new file mode 100644 index 000000000..468cf5f4f Binary files /dev/null and b/crowdsec-docs/static/img/cti-integrations/logo-default.png differ diff --git a/crowdsec-docs/static/img/cti-integrations/logo-gigasheet.png b/crowdsec-docs/static/img/cti-integrations/logo-gigasheet.png new file mode 100644 index 000000000..61adfa146 Binary files /dev/null and b/crowdsec-docs/static/img/cti-integrations/logo-gigasheet.png differ diff --git a/crowdsec-docs/static/img/cti-integrations/logo-intelowl.png b/crowdsec-docs/static/img/cti-integrations/logo-intelowl.png new file mode 100644 index 000000000..d0cc7aed1 Binary files /dev/null and b/crowdsec-docs/static/img/cti-integrations/logo-intelowl.png differ diff --git a/crowdsec-docs/static/img/cti-integrations/logo-maltego.png b/crowdsec-docs/static/img/cti-integrations/logo-maltego.png new file mode 100644 index 000000000..ccd27565e Binary files /dev/null and b/crowdsec-docs/static/img/cti-integrations/logo-maltego.png differ diff --git a/crowdsec-docs/static/img/cti-integrations/logo-misp.png b/crowdsec-docs/static/img/cti-integrations/logo-misp.png new file mode 100644 index 000000000..65db78ff9 Binary files /dev/null and b/crowdsec-docs/static/img/cti-integrations/logo-misp.png differ diff --git a/crowdsec-docs/static/img/cti-integrations/logo-ms-sentinel.png b/crowdsec-docs/static/img/cti-integrations/logo-ms-sentinel.png new file mode 100644 index 000000000..5edc39ebd Binary files /dev/null and b/crowdsec-docs/static/img/cti-integrations/logo-ms-sentinel.png differ diff --git a/crowdsec-docs/static/img/cti-integrations/logo-msticpy.png b/crowdsec-docs/static/img/cti-integrations/logo-msticpy.png new file mode 100644 index 000000000..9d612f995 Binary files /dev/null and b/crowdsec-docs/static/img/cti-integrations/logo-msticpy.png differ diff --git a/crowdsec-docs/static/img/cti-integrations/logo-opencti.png b/crowdsec-docs/static/img/cti-integrations/logo-opencti.png new file mode 100644 index 000000000..c03f27e77 Binary files /dev/null and b/crowdsec-docs/static/img/cti-integrations/logo-opencti.png differ diff --git a/crowdsec-docs/static/img/cti-integrations/logo-paloalto_xsoar.png b/crowdsec-docs/static/img/cti-integrations/logo-paloalto_xsoar.png new file mode 100644 index 000000000..d88a19a24 Binary files /dev/null and b/crowdsec-docs/static/img/cti-integrations/logo-paloalto_xsoar.png differ diff --git a/crowdsec-docs/static/img/cti-integrations/logo-qradar.png b/crowdsec-docs/static/img/cti-integrations/logo-qradar.png new file mode 100644 index 000000000..9f9cd3305 Binary files /dev/null and b/crowdsec-docs/static/img/cti-integrations/logo-qradar.png differ diff --git a/crowdsec-docs/static/img/cti-integrations/logo-securitycopilot.png b/crowdsec-docs/static/img/cti-integrations/logo-securitycopilot.png new file mode 100644 index 000000000..0e27ff864 Binary files /dev/null and b/crowdsec-docs/static/img/cti-integrations/logo-securitycopilot.png differ diff --git a/crowdsec-docs/static/img/cti-integrations/logo-sekoia.png b/crowdsec-docs/static/img/cti-integrations/logo-sekoia.png new file mode 100644 index 000000000..00c8ab8a8 Binary files /dev/null and b/crowdsec-docs/static/img/cti-integrations/logo-sekoia.png differ diff --git a/crowdsec-docs/static/img/cti-integrations/logo-splunk_siem.png b/crowdsec-docs/static/img/cti-integrations/logo-splunk_siem.png new file mode 100644 index 000000000..abfe1df49 Binary files /dev/null and b/crowdsec-docs/static/img/cti-integrations/logo-splunk_siem.png differ diff --git a/crowdsec-docs/static/img/cti-integrations/logo-splunk_soar.png b/crowdsec-docs/static/img/cti-integrations/logo-splunk_soar.png new file mode 100644 index 000000000..8c38a1c4a Binary files /dev/null and b/crowdsec-docs/static/img/cti-integrations/logo-splunk_soar.png differ diff --git a/crowdsec-docs/static/img/cti-integrations/logo-thehive.png b/crowdsec-docs/static/img/cti-integrations/logo-thehive.png new file mode 100644 index 000000000..67f4c16d1 Binary files /dev/null and b/crowdsec-docs/static/img/cti-integrations/logo-thehive.png differ diff --git a/crowdsec-docs/unversioned/console/ip_reputation/api_keys.mdx b/crowdsec-docs/unversioned/console/ip_reputation/api_keys.mdx index a131e0a41..d4b4389f8 100644 --- a/crowdsec-docs/unversioned/console/ip_reputation/api_keys.mdx +++ b/crowdsec-docs/unversioned/console/ip_reputation/api_keys.mdx @@ -31,12 +31,12 @@ export const PremiumBadge = () => ( {" — "} {quota} {" · "} - {desc} + {desc} {label.includes("Premium") && }
))}
-
+
API quotas are separate from Web UI quotas. Unused quota does not roll over.
diff --git a/crowdsec-docs/unversioned/console/ip_reputation/intro.mdx b/crowdsec-docs/unversioned/console/ip_reputation/intro.mdx index cd0cf6b83..ec889d7a6 100644 --- a/crowdsec-docs/unversioned/console/ip_reputation/intro.mdx +++ b/crowdsec-docs/unversioned/console/ip_reputation/intro.mdx @@ -4,72 +4,75 @@ title: IP Reputation / CTI description: Explore and query CrowdSec's IP Reputation data and manage CTI API keys from the Console. --- -CrowdSec's **IP Reputation / CTI** section of the Console gives you access to the world's largest crowdsourced threat intelligence network. - -From the Console you can: -- **Investigate IPs** directly in the Web UI — no code required -- **Explore Specific Classifications** with search queries -- **Query at scale** using the CTI REST API with a managed API key - ---- - -## Web UI Features - -### IP Search - -The [CTI home page](https://app.crowdsec.net/cti) lets you search any IP address or run Lucene queries against the threat database. Predefined searches give quick access to common patterns, and the **Top 10 Most Aggressive IPs** leaderboard shows the most active threat actors in the last 24 hours. - -[IP Search →](/u/console/ip_reputation/search_ui) - -### Advanced Search - -The [Advanced Search page](https://app.crowdsec.net/cti) supports Lucene queries with a live faceted filter panel (reputation, country, AS, behaviors, classifications). Use it for threat hunting, bulk investigation, or building targeted blocklists. - -[Advanced Search →](/u/console/ip_reputation/search_ui_advanced) -[Search Query Reference →](/u/cti_api/search_queries) - -### IP Report - -Clicking any IP opens a full report with its reputation, key metadata, behaviors, classifications, MITRE techniques, CVEs, and time-windowed scores. - -[IP Report →](/u/console/ip_reputation/ip_report) - -### Live Exploit Tracker - -The [Live Exploit Tracker ↗️](https://tracker.crowdsec.net/) is the evolution of the CVE Explorer — a dedicated platform for tracking vulnerabilities that are actively being exploited in the wild, powered by live data from the CrowdSec network. -:::info -It now resides outside the Console to provide a more focused experience and richer features, but remains fully accessible with the same CTI API key. -::: - -Beyond listing CVEs, it adds exploitation context that helps you **prioritize and act**: - -- **CrowdSec Score** — a SOC-oriented priority signal based on observed attack patterns -- **Opportunity Score** — how targeted vs. opportunistic the exploitation is (0 = mass automated scan, 5 = precisely targeted campaign) -- **Momentum Score** — whether exploitation volume is growing, stable, or declining -- **Exploitation Status** — from *early exploitation* to *background noise* -- **Timeline** — first/last seen, CVE publication, CISA KEV addition, and key events -- **Malicious IPs** — IPs actively exploiting a given CVE, with full CTI context, for threat hunting or direct blocklist integration - -[Explore the Live Exploit Tracker ↗️](https://tracker.crowdsec.net/) - ---- - -## API Access - -You can query the same data programmatically using a CTI API key and the [CTI REST API](/u/cti_api/intro). - -| Plan | Quota | Use case | -|---|---|---| -| **Free** | 40 queries / month | POC, low-traffic scripts | -| **Premium** | 120 queries / month | Regular enrichment, small integrations | -| **Premium Options** | 5K / 25K / 100K queries / month | Production integrations, SIEMs, SOARs | - -Manage your keys in the Console under **Settings → CTI API Keys**, or go straight to [app.crowdsec.net/settings/cti-api-keys](https://app.crowdsec.net/settings/cti-api-keys). +import Link from "@docusaurus/Link"; +import { ExternalLink } from "lucide-react"; + +export const BLUE = "#60a5fa"; +export const GREEN = "#22d3a0"; +export const PURPLE = "#a78bfa"; + +

+ Query behavioral intelligence on any IP — reputation scores, attack patterns, linked CVEs, and activity history — sourced from hundreds of thousands of real CrowdSec deployments worldwide. +

+ +{/* ── Row 1: two cards side by side ──────────────────────────────────── */} + +
+ + {/* Card 1: Web UI exploration (merged Search + IP Report) */} +
+
🔍
+
Explore in the Web UI
+
+ No setup needed. Search any IP directly from your browser — run Lucene queries with live faceted filters (reputation, country, AS, behaviors, classifications) and open any result to see its full report: threat score, behaviors mapped to MITRE ATT&CK, linked CVEs, and time-windowed activity. The homepage also surfaces a Top 10 Most Aggressive IPs leaderboard updated every 24h. +
+
+ IP Search → + Advanced Search → + IP Report → + Lucene Query Reference → +
+
+ + {/* Card 2: Enrich your Alerts (API Key) */} +
+
🔑
+
Enrich your Alerts
+
+ Unlock programmatic access to 30+ enrichment fields per IP — reputation, behaviors, CVEs, attack context, MITRE mappings, and more. Use it to enrich SIEM alerts, automate lookups, or feed threat intel platforms. Free tier included, no credit card needed. +
+ +
+ Create an API key → + Data Taxonomy → + API Reference +
+
+ +
+ +{/* ── You might also be interested in: LET ───────────────────────────── */} + +
+
You might also be interested in
+
+
🚨
+
+ +
+ A dedicated platform tracking CVEs actively exploited in the wild — with exploitation momentum, opportunity scores, and the IPs behind each attack. Uses the same CTI API key. +
+ Explore the Live Exploit Tracker → +
+
+
[Get your first API key →](/u/console/ip_reputation/api_keys) --- -:::tip Want the full technical reference? +:::tip Full technical reference For API endpoints, request/response schemas, integrations (SIEM, SOAR, TIP platforms), and data taxonomy, see the [CTI API documentation](/u/cti_api/intro). ::: diff --git a/crowdsec-docs/unversioned/console/stackhealth.mdx b/crowdsec-docs/unversioned/console/stackhealth.mdx index 3410b8ed4..a79276f24 100644 --- a/crowdsec-docs/unversioned/console/stackhealth.mdx +++ b/crowdsec-docs/unversioned/console/stackhealth.mdx @@ -4,7 +4,8 @@ title: Stack Health --- The **Stack Health** Feature is a monitoring tool within the CrowdSec Console helping you keep your infrastructure operational and properly configured. -Its primary goal is to identify configuration issues, connectivity problems, or potential misconfigurations that could impact your detection capabilities. +Its primary goal is to identify configuration issues, connectivity problems, or potential misconfigurations that could impact your detection capabilities. +*You can also do a manual health check of your stack by following this post installation [Health-Check guide](/u/getting_started/health_check).* --- diff --git a/crowdsec-docs/unversioned/cti_api/api_integration/integration_intro.md b/crowdsec-docs/unversioned/cti_api/api_integration/integration_intro.md deleted file mode 100644 index 7b0e0991b..000000000 --- a/crowdsec-docs/unversioned/cti_api/api_integration/integration_intro.md +++ /dev/null @@ -1,30 +0,0 @@ ---- -id: integration_intro -title: Integrations ---- - -CrowdSec has developed native integrations for the most common security platforms so you can enrich your workflows with IP reputation data without writing any code. If your platform isn't listed, the API is a standard REST interface — you can query it directly with cURL, write your own scripts, or build custom playbooks in any SIEM, SOAR, or TIP that supports HTTP enrichment: - -```shell -curl -H "x-api-key: $API_KEY" https://cti.api.crowdsec.net/v2/smoke/1.2.3.4 | jq . -``` - -For the full API reference, see the [Swagger documentation](https://crowdsecurity.github.io/cti-api/). - ---- - -| Integration | Description | -|---------------------------|----------------------------------------| -| [Chrome](/cti_api/api_integration/integration_browser_chrome.md) | A Chrome extension which allows you to quickly search an IP on a web page | -| [Gigasheet](/cti_api/api_integration/integration_gigasheet.md) | Gigasheet's No-Code API-data-enrichment feature | -| [IntelOwl](/cti_api/api_integration/integration_intelowl.md) | IntelOwl is an open-source framework and platform for analyzing and processing threat intelligence data | -| [Maltego](/cti_api/api_integration/integration_maltego.md) | Maltego is a powerful and versatile data visualization and link analysis tool used primarily in the field of digital forensics, cybersecurity, and intelligence gathering | -| [MISP](/cti_api/api_integration/integration_misp.md) | MISP, short for Malware Information Sharing Platform & Threat Sharing, is an open-source threat intelligence platform designed to facilitate the sharing and collaboration | -| [MSTICpy](/cti_api/api_integration/integration_msticpy.md) | MSTICpy, short for Microsoft Threat Intelligence Python Security Tools and Common Practices, is an open-source Python library developed by Microsoft | -| [OpenCTI](/cti_api/api_integration/integration_opencti.md) | OpenCTI is an open-source threat intelligence platform that focuses on facilitating the collection, management, and analysis of cyber threat intelligence data | -| [PaloAlto XSOAR](/cti_api/api_integration/integration_paloalto_xsoar.md) | Palo Alto Networks Cortex XSOAR is a Security Orchestration, Automation, and Response (SOAR) platform | -| [QRadar](/cti_api/api_integration/integration_qradar.md) | QRadar is a widely-used Security Information and Event Management (SIEM) solution designed to provide comprehensive visibility into an organization's cybersecurity landscape | -| [Sekoia XDR](/cti_api/api_integration/integration_sekoia_xdr.md) | Sekoia XDR (Extended Detection and Response) is a cybersecurity platform that combines threat detection, incident response, and proactive threat hunting capabilities into a unified solution | -| [Splunk SIEM](/cti_api/api_integration/integration_splunk_siem.md) | Splunk Enterprise Security is a Security Information and Event Management (SIEM) solution that helps organizations centralize, analyze, and manage security-related data from various sources | -| [Splunk SOAR](/cti_api/api_integration/integration_splunk_soar.md) | Splunk SOAR (Security Orchestration, Automation, and Response) is a security platform designed to streamline and automate the incident response and security operations processes | -| [TheHive](/cti_api/api_integration/integration_thehive.md) | TheHive is an open-source, collaborative, and customizable Security Incident Response Platform (SIRP) designed to assist cybersecurity teams in managing and mitigating security incidents effectively | diff --git a/crowdsec-docs/unversioned/cti_api/api_integration/integration_intro.mdx b/crowdsec-docs/unversioned/cti_api/api_integration/integration_intro.mdx new file mode 100644 index 000000000..f04f9c4da --- /dev/null +++ b/crowdsec-docs/unversioned/cti_api/api_integration/integration_intro.mdx @@ -0,0 +1,24 @@ +--- +id: integration_intro +title: Integrations +--- + +import CtiIntegrationTile, { ctiIntegrations } from '@site/src/components/cti-integration-tile'; + +CrowdSec has native integrations for the most common security platforms — enrich your workflows with IP reputation data without writing any code. + +If your platform isn't listed, the API is a standard REST interface you can query directly: + +```shell +curl -H "x-api-key: $API_KEY" https://cti.api.crowdsec.net/v2/smoke/1.2.3.4 | jq . +``` + +For the full reference, see the [Swagger documentation](https://crowdsecurity.github.io/cti-api/). + +--- + +
+ {ctiIntegrations.map(({ name, slug, href, plugin, desc, color }) => ( + + ))} +
diff --git a/crowdsec-docs/unversioned/cti_api/intro.md b/crowdsec-docs/unversioned/cti_api/intro.md deleted file mode 100644 index 889eb4bb5..000000000 --- a/crowdsec-docs/unversioned/cti_api/intro.md +++ /dev/null @@ -1,69 +0,0 @@ ---- -id: intro -title: CrowdSec CTI - Cyber Threat Intelligence -sidebar_position: 1 ---- - -CrowdSec's **Cyber Threat Intelligence (CTI)** exposes the threat data collected by the global CrowdSec network — millions of IPs enriched with behaviors, classifications, scores, MITRE techniques, and CVE associations — through a REST API designed for programmatic integration. - -This section covers the **API** side of CTI: authentication, datasets, data format, taxonomy, and integrations with third-party security platforms. - -:::tip Prefer a visual interface? -The [IP Reputation section of the Console](/u/console/ip_reputation/intro) presents exploration via the Console UI to: get details about a specific IP, run advanced queries, and manage your CTI API Key(s) -::: - ---- - -## What the API Gives You - -For any queried IP, the CTI API returns: - -| Field | Description | -| --- | --- | -| **Reputation** | Malicious, Suspicious, Known, Benign, Safe, or Unknown | -| **Behaviors** | Attack types observed (SSH Bruteforce, HTTP Scan, CVE exploitation, etc.) | -| **Classifications** | TOR exit node, VPN/Proxy, CDN, scanner, false positive, and more | -| **Scores** | Aggressiveness, threat, trust, and anomaly — computed over 1d / 7d / 30d windows | -| **MITRE ATT&CK** | Techniques mapped to the IP's observed behaviors | -| **CVEs** | Vulnerabilities the IP has been actively exploiting | -| **History** | First seen / last seen, activity age | -| **Target countries** | Geographic distribution of attacks from this IP | - -Full field-level documentation: [CTI Object format](/u/cti_api/taxonomy/cti_object). - ---- - -## Taxonomy - -Understanding the CTI data model is key to making good use of the API. The [Taxonomy section](/u/cti_api/taxonomy/intro) documents: - -- [**CTI Format**](/u/cti_api/taxonomy/cti_object) — complete response structure and field reference -- [**Scores**](/u/cti_api/taxonomy/scores) — how aggressiveness, threat, trust, and anomaly are computed -- [**Behaviors**](/u/cti_api/taxonomy/behaviors) — defined attack behaviors and their labels -- [**Classifications**](/u/cti_api/taxonomy/classifications) — IP category tags (VPN, TOR, CDN, scanner, etc.) -- [**False Positives**](/u/cti_api/taxonomy/false_positives) — categories excluded from malicious verdicts -- [**Scenarios**](/u/cti_api/taxonomy/scenarios) — the detection scenarios that triggered reports for an IP - ---- - -## Getting Started - -1. **Get an API key** — create one in the [Console](https://app.crowdsec.net/settings/cti-api-keys). A free key is available to all registered users. See [API Keys](/u/console/ip_reputation/api_keys). -2. **Make your first request** — see [API Introduction](/u/cti_api/api_introduction) for the base URL, authentication header, and an example response. -3. **Integrate** — connect CrowdSec CTI to your SIEM, SOAR, or TIP using one of the [supported integrations](/u/cti_api/api_integration/integration_intro). - ---- - -## Integrations - -CrowdSec CTI has native integrations with major security platforms: - -| Category | Platforms | -| --- | --- | -| **SIEM** | Splunk Enterprise Security, QRadar, Microsoft Sentinel | -| **SOAR** | Splunk SOAR, Palo Alto XSOAR, TheHive | -| **TIP** | MISP, OpenCTI, Sekoia XDR | -| **Investigation** | Maltego, MSTICpy, IntelOwl | -| **Other** | Chrome extension, Gigasheet | - -[See all integrations →](/u/cti_api/api_integration/integration_intro) diff --git a/crowdsec-docs/unversioned/cti_api/intro.mdx b/crowdsec-docs/unversioned/cti_api/intro.mdx new file mode 100644 index 000000000..0fad953ea --- /dev/null +++ b/crowdsec-docs/unversioned/cti_api/intro.mdx @@ -0,0 +1,170 @@ +--- +id: intro +title: CrowdSec IP Reputation / CTI +sidebar_position: 1 +--- + +import Link from "@docusaurus/Link"; +import { ExternalLink } from "lucide-react"; +import CtiIntegrationTile, { ctiIntegrations } from '@site/src/components/cti-integration-tile'; + +export const BLUE = "#60a5fa"; +export const ORANGE = "#f97316"; +export const PURPLE = "#a78bfa"; +export const GREEN = "#22d3a0"; + +{/* ── Hero ─────────────────────────────────────────────────────────────── */} + +

+ Understand the IPs behind attacks +

+

+

CrowdSec tracks malicious IPs across hundreds of thousands of real deployments worldwide. +
Every lookup gives you behavioral context — what the IP was doing, where, and when.

+

+ +{/* Quick access strip — same pattern as "Already running CrowdSec?" on the homepage */} +
+ Quick access +
+ 🔍 Look up an IP + 🔑 Get an API key + 🎯 Hunt for threats +
+
+ +{/* ── How do you want to use it? ──────────────────────────────────────── */} + +
+
Entry points
+
How do you want to use it?
+
+ {[ + { + badge: "🔍 No setup needed", icon: "🖥️", accent: BLUE, + title: "Web UI investigation - in the Console", + desc: "Search any IP instantly. Explore threat history and the top aggressive IPs in the last 24h — no API key needed.", + links: [{ label: "Web UI guide →", href: "/u/console/ip_reputation/intro" }, { label: "IP Report →", href: "/u/console/ip_reputation/ip_report" }], + }, + { + badge: "⚙️ Developer / SecOps", icon: "🔌", accent: ORANGE, + title: "Enrich Alerts via API", + desc: "Use the CTI API to add CrowdSec IP context to SIEM alerts, SOAR workflows, TIPs, scripts, and internal tools.", + links: [{ label: "API quickstart →", href: "/u/cti_api/api_introduction" }, { label: "All integrations →", href: "/u/cti_api/api_integration/integration_intro" }], + }, + { + badge: "🎯 Threat hunter", icon: "🚨", accent: PURPLE, + title: "Hunt active threats", + desc: "Advanced Search with live faceted filters — behavior, country, AS, CVE — to find campaigns or build blocklists.", + links: [{ label: "Advanced search →", href: "/u/console/ip_reputation/search_ui_advanced" }, { label: "Live Exploit Tracker →", href: "/u/tracker_api/intro" }], + }, + ].map(({ badge, icon, accent, title, desc, links }) => ( +
+
{badge}
+
{icon}
+
{title}
+
{desc}
+
+ {links.map(({ label, href }) => ( + {label} + ))} +
+
+ ))} +
+
+ +{/* ── Why CrowdSec CTI (informational, de-emphasized) ────────────────── */} + +
+
Why CrowdSec CTI
+

+ Most IP reputation services tell you an IP is "bad." CrowdSec tells you what it was doing — from real deployments, not honeypots. +

+
+ {[ + { icon: "🌍", title: "Real-world attack signals", desc: "CrowdSec intelligence is built from signals shared by real deployments across the Internet." }, + { icon: "🧠", title: "Behavioral, not just reputation", desc: "Brute-force, CVE exploitation, scan, credential stuffing — mapped to MITRE ATT&CK." }, + { icon: "⚡", title: "Real-time, not cached lists", desc: "Continuously updated with time-windowed scores showing if a threat is rising, stable, or decaying." }, + { icon: "🔬", title: "CVE-level exploit tracking", desc: "Live Exploit Tracker shows which CVEs are actively exploited, with momentum, opportunity, and malicious IP context." }, + ].map(({ icon, title, desc }) => ( +
+ {icon} + + {title} — {desc} + +
+ ))} +
+
+ +{/* ── Integrations ────────────────────────────────────────────────────── */} + +
+
Integrations
+
Already using one of these?
+

+ Jump straight to the integration guide — no need to read the full API docs first. +

+
+ {ctiIntegrations.map(({ name, slug, href, plugin, desc, color }) => ( + + ))} +
+ +
+ {[ + { label: "Community Plan Free Key", quota: "40 / month", desc: "Testing integrations, personal servers, ad-hoc lookups", color: GREEN }, + { label: "Premium Plan Free Key", quota: "120 / month", desc: "Regular enrichment, small SOC teams, recurring automation", color: BLUE }, + { label: "Premium Keys Options", quota: "5K · 25K · 100K / month", desc: "Production SIEMs, SOARs, high-volume pipelines — requires Premium", color: PURPLE }, + ].map(({ label, quota, desc, color }) => ( +
+ {label} + {" — "} + {quota} + {" · "} + {desc} +
+ ))} +
+
+ API quotas are separate from Web UI quotas. Unused quota does not roll over. +
+
+ +{/* ── Technical details ───────────────────────────────────────────────── */} + +
+
Technical details
+
+ {[ + { icon: "📊", title: "Data Taxonomy", desc: "CTI Data structure, scores, behaviors and classifications", href: "/u/cti_api/taxonomy/intro" }, + { icon: "📚", title: "API Reference", desc: "Full endpoint reference with request/response schemas.", href: "https://crowdsecurity.github.io/cti-api/", external: true }, + { icon: "❓", title: "FAQ", desc: "Common questions about access, quotas, and data.", href: "/u/cti_api/faq" }, + ].map(({ icon, title, desc, href, external }) => ( + + {icon} +
+
+ {title}{external && } +
+
{desc}
+
+ + ))} +
+
+ +{/* ── Need help ───────────────────────────────────────────────────────── */} + +
+
+
Need help?
+
Get answers in Discord or check the FAQ.
+
+
+ 💬 Join Discord + ❓ View FAQ + 📚 API Reference +
+
diff --git a/crowdsec-docs/unversioned/integrations/intro.mdx b/crowdsec-docs/unversioned/integrations/intro.mdx index 25e8900e5..6a5db6d36 100644 --- a/crowdsec-docs/unversioned/integrations/intro.mdx +++ b/crowdsec-docs/unversioned/integrations/intro.mdx @@ -11,6 +11,7 @@ import Tabs from '@theme/Tabs'; import TabItem from '@theme/TabItem'; import CodeBlock from '@theme/CodeBlock'; import UnderlineTooltip from '@site/src/components/underline-tooltip'; +import IntegrationTile, { firewallIntegrations } from '@site/src/components/integration-tile'; CrowdSec Blocklist Integrations — also known as **Blocklist as a Service** — give you a secure, hosted HTTPS endpoint serving live blocklists that you configure your firewall or security tool to pull from. @@ -41,27 +42,37 @@ Pulling more frequently than the allowed interval for your plan will result in H ## Available integrations + ### Firewall integrations Each vendor page explains how to create the integration in the CrowdSec Console and includes a link to the vendor's own documentation on how to configure ingestion on the firewall side. -| Firewall | Vendor feature name | -|---|---| -| [Checkpoint](integrations/checkpoint.mdx) | Custom Intelligence (IoC) Feeds | -| [Cisco](integrations/cisco.mdx) | Security Intelligence feeds | -| [F5](integrations/f5.mdx) | External IP blocklist / Feed lists | -| [Fortinet](integrations/fortinet.mdx) | IP address Threat Feeds | -| [Juniper](integrations/juniper.mdx) | Security Dynamic Address feeds | -| [Mikrotik](integrations/mikrotik.mdx) | — | -| [OPNsense](integrations/opnsense.mdx) | URL Table (IPs) aliases | -| [Palo Alto](integrations/paloalto.mdx) | External Dynamic Lists (EDL) | -| [pfSense](integrations/pfsense.mdx) | URL Table (IPs) aliases | -| [Sophos](integrations/sophos.mdx) | Third-Party Threat Feeds | +
+ {firewallIntegrations.map(({ name, slug, href, desc, color }) => ( + + ))} +
### Other integrations -- [Raw IP List](integrations/rawiplist.mdx) — generic format, works with any HTTP-capable device -- [Remediation Component](integrations/remediationcomponent.mdx) — for platforms without native IP list ingestion (Cloudflare, AWS WAF, etc.) +
+ + One IP per line — compatible with virtually any firewall, router, or HTTP-capable device + + + Integrate blocklists to platforms without native ingestion (Cloudflare, AWS WAF, …) via Remediation Components + +
## Setup a Blocklist Integration Endpoint