From 457019c7bf70fa127e63b025998287451a0677a7 Mon Sep 17 00:00:00 2001 From: jdv Date: Wed, 22 Apr 2026 20:33:24 +0200 Subject: [PATCH 01/26] home refresh v0.1 --- .gitignore | 3 +- .../src/components/integration-tile.tsx | 101 +++ crowdsec-docs/src/pages/index.tsx | 616 +++++++++++++++--- .../static/img/blaas/logo-checkpoint.png | Bin 0 -> 15620 bytes crowdsec-docs/static/img/blaas/logo-cisco.png | Bin 0 -> 17492 bytes .../static/img/blaas/logo-default.png | Bin 0 -> 20632 bytes crowdsec-docs/static/img/blaas/logo-f5.png | Bin 0 -> 32048 bytes .../static/img/blaas/logo-fortinet.png | Bin 0 -> 6117 bytes .../static/img/blaas/logo-juniper.png | Bin 0 -> 7648 bytes .../static/img/blaas/logo-mikrotik.png | Bin 0 -> 10153 bytes .../static/img/blaas/logo-opnsense.png | Bin 0 -> 16531 bytes .../static/img/blaas/logo-paloalto.png | Bin 0 -> 10676 bytes .../static/img/blaas/logo-pfsense.png | Bin 0 -> 13310 bytes .../static/img/blaas/logo-sophos.png | Bin 0 -> 13001 bytes .../unversioned/integrations/intro.mdx | 39 +- 15 files changed, 638 insertions(+), 121 deletions(-) create mode 100644 crowdsec-docs/src/components/integration-tile.tsx create mode 100644 crowdsec-docs/static/img/blaas/logo-checkpoint.png create mode 100644 crowdsec-docs/static/img/blaas/logo-cisco.png create mode 100644 crowdsec-docs/static/img/blaas/logo-default.png create mode 100644 crowdsec-docs/static/img/blaas/logo-f5.png create mode 100644 crowdsec-docs/static/img/blaas/logo-fortinet.png create mode 100644 crowdsec-docs/static/img/blaas/logo-juniper.png create mode 100644 crowdsec-docs/static/img/blaas/logo-mikrotik.png create mode 100644 crowdsec-docs/static/img/blaas/logo-opnsense.png create mode 100644 crowdsec-docs/static/img/blaas/logo-paloalto.png create mode 100644 crowdsec-docs/static/img/blaas/logo-pfsense.png create mode 100644 crowdsec-docs/static/img/blaas/logo-sophos.png diff --git a/.gitignore b/.gitignore index 62551d255..4c236fefd 100644 --- a/.gitignore +++ b/.gitignore @@ -1,3 +1,4 @@ .vscode node_modules -.history \ No newline at end of file +.history +ai-session \ No newline at end of file diff --git a/crowdsec-docs/src/components/integration-tile.tsx b/crowdsec-docs/src/components/integration-tile.tsx new file mode 100644 index 000000000..388f79dfd --- /dev/null +++ b/crowdsec-docs/src/components/integration-tile.tsx @@ -0,0 +1,101 @@ +import React from 'react'; +import useBaseUrl from '@docusaurus/useBaseUrl'; + +interface IntegrationTileProps { + name: string; + slug: string; + href: string; + desc?: string; + color: string; + children?: React.ReactNode; +} + +export const firewallIntegrations = [ + { name: 'Checkpoint', slug: 'checkpoint', href: '/u/integrations/checkpoint', desc: 'Custom Intelligence (IoC) Feeds', color: '#cc0000' }, + { name: 'Cisco', slug: 'cisco', href: '/u/integrations/cisco', desc: 'Security Intelligence feeds', color: '#1ba0d8' }, + { name: 'F5', slug: 'f5', href: '/u/integrations/f5', desc: 'External IP blocklist / Feed lists', color: '#e4002b' }, + { name: 'Fortinet', slug: 'fortinet', href: '/u/integrations/fortinet', desc: 'IP address Threat Feeds', color: '#ee3124' }, + { name: 'Juniper', slug: 'juniper', href: '/u/integrations/juniper', desc: 'Security Dynamic Address feeds', color: '#84b135' }, + { name: 'Mikrotik', slug: 'mikrotik', href: '/u/integrations/mikrotik', desc: 'IP blocklist ingestion', color: '#9f1d20' }, + { name: 'OPNsense', slug: 'opnsense', href: '/u/integrations/opnsense', desc: 'URL Table (IPs) aliases', color: '#d94f00' }, + { name: 'Palo Alto', slug: 'paloalto', href: '/u/integrations/paloalto', desc: 'External Dynamic Lists (EDL)', color: '#fa582d' }, + { name: 'pfSense', slug: 'pfsense', href: '/u/integrations/pfsense', desc: 'URL Table (IPs) aliases', color: '#212d6e' }, + { name: 'Sophos', slug: 'sophos', href: '/u/integrations/sophos', desc: 'Third-Party Threat Feeds', color: '#1f6bff' }, +]; + +export default function IntegrationTile({ name, slug, href, desc, color, children }: IntegrationTileProps) { + const logoSrc = useBaseUrl(`/img/blaas/logo-${slug}.png`); + const fallbackSrc = useBaseUrl('/img/blaas/logo-default.png'); + + return ( +
{ + (e.currentTarget as HTMLDivElement).style.boxShadow = `0 4px 12px ${color}30`; + (e.currentTarget as HTMLDivElement).style.borderColor = `${color}70`; + }} + onMouseLeave={e => { + (e.currentTarget as HTMLDivElement).style.boxShadow = 'none'; + (e.currentTarget as HTMLDivElement).style.borderColor = 'var(--ifm-color-emphasis-200)'; + }} + > +
+ +
+ {`${name} { + (e.currentTarget as HTMLImageElement).onerror = null; + (e.currentTarget as HTMLImageElement).src = fallbackSrc; + }} + style={{ width: '32px', height: '32px', objectFit: 'contain', pointerEvents: 'none', userSelect: 'none' }} + /> +
+
+ + {name} + + + {children || desc} + +
+ +
+ ); +} diff --git a/crowdsec-docs/src/pages/index.tsx b/crowdsec-docs/src/pages/index.tsx index 0fecb7733..00d94e2f5 100644 --- a/crowdsec-docs/src/pages/index.tsx +++ b/crowdsec-docs/src/pages/index.tsx @@ -1,75 +1,396 @@ import Link from "@docusaurus/Link"; import Layout from "@theme/Layout"; import SearchBar from "@theme/SearchBar"; -import React, { useEffect } from "react"; +import React, { useEffect, useState } from "react"; import { Button } from "../ui/button"; +// ── Intent card ────────────────────────────────────────────────────────────── + +type IntentCardProps = { + icon: string; + title: string; + desc: string; + pill: string; + accent: string; + href: string; +}; + +const IntentCard = ({ icon, title, desc, pill, accent, href }: IntentCardProps) => ( + { + const el = e.currentTarget as HTMLAnchorElement; + el.style.borderColor = accent; + el.style.boxShadow = `0 0 0 1px ${accent}`; + el.style.transform = "translateY(-1px)"; + }} + onMouseLeave={e => { + const el = e.currentTarget as HTMLAnchorElement; + el.style.borderColor = "var(--ifm-color-emphasis-200)"; + el.style.boxShadow = "none"; + el.style.transform = "none"; + }} + > +
+
{icon}
+
+
{title}
+
{desc}
+ → {pill} +
+
→
+
+ +); + +// ── Schema / path block ─────────────────────────────────────────────────────── + +type Step = { + num: number; + icon: string; + title: string; + desc: string; + optional?: boolean; + optionalLabel?: string; + perks?: string[]; +}; + +type SchemaBlockProps = { + id: string; + color: string; + eyebrowIcon: string; + eyebrow: string; + title: string; + ctaLabel: string; + ctaHref: string; + steps: Step[]; + open: boolean; + onToggle: () => void; +}; + +const SchemaBlock = ({ id, color, eyebrowIcon, eyebrow, title, ctaLabel, ctaHref, steps, open, onToggle }: SchemaBlockProps) => ( +
+ {/* left accent strip */} +
+ {/* subtle radial glow */} +
+ + {/* header — always visible, clickable to toggle */} + + + {/* collapsible step flow */} + {open && ( +
+ {steps.map((step, i) => ( +
+ {i > 0 && ( +
→
+ )} + {step.optional && ( +
{step.optionalLabel || "Optional"}
+ )} +
{step.num}
+
{step.icon}
+
{step.title}
+
{step.desc}
+ {step.perks && ( +
    + {step.perks.map((p, j) => ( +
  • + ✓ + {p} +
    • + ))} +
+ )} +
+ ))} +
+ )} +
+); + +// ── Product card ────────────────────────────────────────────────────────────── + type ProductCardProps = { title: string; description: string; icon: React.ReactNode; link: string; features: string[]; - bestFor: string; }; -const ProductCard = ({ title, description, icon, link, features, bestFor }: ProductCardProps): React.JSX.Element => ( +const ProductCard = ({ title, description, icon, link, features }: ProductCardProps): React.JSX.Element => (
-
+
{icon}
-

- {title} -

+

{title}

-

{description}

-

{bestFor}

-
)}
{step.num}
{step.icon}
{step.title}
@@ -259,22 +261,27 @@ const BLUE = "#60a5fa"; const intents: IntentCardProps[] = [ { - icon: "🛡️", accent: ORANGE, + icon: Security Engine, + accent: ORANGE, title: "Detect and block attacks on systems I run", desc: "You operate servers, VMs, or containers and want active threat detection — not just a blocklist.", - pill: "Security Engine", href: "/security-engine", + pill: "Security Engine", + href: "/security-engine", }, { - icon: "🚫", accent: GREEN, + icon: Blocklists, + accent: GREEN, title: "Push a threat feed into my firewall, router, or CDN", desc: "You manage network perimeter devices and want a URL to subscribe to — no agent to install.", - pill: "Blocklist Feed Endpoints", href: "/blocklists", + pill: "Blocklist Feed Endpoints", + href: "/blocklists", }, { - icon: "🔍", accent: BLUE, + icon: CTI, + accent: BLUE, title: "Look up an IP or enrich my security tools", desc: "You're a security analyst or developer who wants IP context — in a browser or via REST API.", - pill: "IP Reputation & CTI", pillColor: BLUE, + pill: "IP Reputation & CTI", href: "/cti", }, ]; @@ -296,17 +303,17 @@ const schemas: Omit[] = [ ], }, { - num: 2, icon: "🛡️", optional: true, + num: 2, icon: "🛡️", hint: "RECOMMENDED", title: "Activate the Web Application Firewall", desc: "Layer in the AppSec component to inspect HTTP traffic and block web exploits before they reach your app.", }, { - num: 3, icon: "📋", optional: true, + num: 3, icon: "📋", hint: "OPTIONAL", title: "Subscribe to additional blocklists", desc: "Add curated threat feeds on top of the community blocklist — by category, use case, or vendor.", }, { - num: 4, icon: "✍️", optional: true, + num: 4, icon: "✍️", hint: "OPTIONAL", title: "Craft your own detection rules", desc: "Write custom scenarios for your stack, then share them back with the community on the Hub.", }, @@ -351,12 +358,12 @@ const schemas: Omit[] = [ desc: "No setup. Search instantly — get reputation score, behaviors, attack history, and CVE links.", }, { - num: 2, icon: "🔑", optional: true, optionalLabel: "For integrations", + num: 2, icon: "🔑", hint: "For integrations", title: "Generate a CTI API key", desc: "Unlock programmatic access to the same data. Free tier included — no credit card needed.", }, { - num: 3, icon: "⚙️", optional: true, optionalLabel: "For integrations", + num: 3, icon: "⚙️", hint: "Enrich", title: "Connect to your SIEM or security tool", desc: "Native integrations for Splunk, Sentinel, QRadar, TheHive, OpenCTI, MISP, and more.", }, @@ -457,11 +464,11 @@ const HomePage = () => { }}>Already running CrowdSec?
{[ - { label: "🖥️ Open the Console", href: "https://app.crowdsec.net" }, + { label: "🖥️ Open the Console", href: "https://app.crowdsec.net", external: true }, { label: "📋 Manage alerts & decisions", href: "/u/console/intro" }, { label: "🔄 Remediation sync", href: "/u/bouncers/intro" }, { label: "❓ Troubleshooting", href: "/docs/next/troubleshooting/security_engine" }, - ].map(({ label, href }) => ( + ].map(({ label, href, external }) => ( { textDecoration: "none", transition: "border-color .15s, color .15s", }} - >{label} + >{label}{external && } ))}
@@ -543,10 +550,14 @@ const HomePage = () => {
- + - +
@@ -566,11 +577,11 @@ const HomePage = () => { { label: "🖥️ Console", href: "/u/console/intro" }, { label: "🛡️ AppSec / WAF", href: "/docs/next/appsec/intro" }, { label: "💻 CLI Reference", href: "/docs/next/cscli/" }, - { label: "📖 Docs AI Assistant", href: "https://chatgpt.com/g/g-682c3a61a78081918417571116c2b563-crowdsec-documentation" }, + { label: "📖 Docs AI Assistant", href: "https://chatgpt.com/g/g-682c3a61a78081918417571116c2b563-crowdsec-documentation", external: true }, { label: "🔑 CTI API Keys", href: "/cti" }, { label: "❓ Troubleshooting", href: "/docs/next/troubleshooting/security_engine" }, - { label: "🌐 About CrowdSec", href: "https://www.crowdsec.net" }, - ].map(({ label, href }) => ( + { label: "🌐 About CrowdSec", href: "https://www.crowdsec.net", external: true }, + ].map(({ label, href, external }) => ( { textDecoration: "none", transition: "color .15s, border-color .15s", }} - >{label} + >{label}{external && } ))}
From 5b4e622eb1a5a7a325a0ccad046862670f318917 Mon Sep 17 00:00:00 2001 From: jdv Date: Wed, 22 Apr 2026 20:46:03 +0200 Subject: [PATCH 03/26] removing by products section --- crowdsec-docs/src/pages/index.tsx | 79 +------------------------------ 1 file changed, 1 insertion(+), 78 deletions(-) diff --git a/crowdsec-docs/src/pages/index.tsx b/crowdsec-docs/src/pages/index.tsx index 4b85c8192..24fd01381 100644 --- a/crowdsec-docs/src/pages/index.tsx +++ b/crowdsec-docs/src/pages/index.tsx @@ -219,40 +219,6 @@ const SchemaBlock = ({ id, color, eyebrowIcon, eyebrow, title, ctaLabel, ctaHref ); -// ── Product card ────────────────────────────────────────────────────────────── - -type ProductCardProps = { - title: string; - description: string; - icon: React.ReactNode; - link: string; - features: string[]; -}; - -const ProductCard = ({ title, description, icon, link, features }: ProductCardProps): React.JSX.Element => ( - -
-
-
- {icon} -
-

{title}

-
-

{description}

-
    - {features.map((f) => ( -
  • - ✓{f} -
    • - ))} -
-
- Explore product → -
-
- -); - // ── Data ────────────────────────────────────────────────────────────────────── const ORANGE = "#f97316"; @@ -371,29 +337,6 @@ const schemas: Omit[] = [ }, ]; -const products: ProductCardProps[] = [ - { - title: "Security Engine", - description: "Analyze your logs to detect attacks, block malicious IPs, and protect web applications.", - icon: Security Engine, - link: "/security-engine", - features: ["Behavior-based detection", "Community threat sharing", "AppSec / WAF for web apps", "Open source"], - }, - { - title: "Blocklists", - description: "Deploy curated threat intel feeds to protect your network without running detection yourself.", - icon: Blocklists, - link: "/blocklists", - features: ["Curated IP lists, auto-updated", "Ready-to-deploy feeds", "Multiple threat categories", "Works standalone or with Engine"], - }, - { - title: "CTI", - description: "Query CrowdSec threat intelligence to enrich investigations, automate lookups, and integrate with tools.", - icon: CTI, - link: "/cti", - features: ["REST API access", "IP reputation scores", "Attack context", "SIEM integrations"], - }, -]; // ── Page ────────────────────────────────────────────────────────────────────── @@ -514,27 +457,7 @@ const HomePage = () => { - {/* Browse by product */} -
-
-
-
- or browse by product -
-
-
- {products.map(p => )} -
-
-
- - {/* Not sure / fallback */} +{/* Not sure / fallback */}
Date: Wed, 22 Apr 2026 20:50:14 +0200 Subject: [PATCH 04/26] biome fix --- .../src/components/integration-tile.tsx | 200 +++--- crowdsec-docs/src/pages/index.tsx | 591 ++++++++++++------ 2 files changed, 509 insertions(+), 282 deletions(-) diff --git a/crowdsec-docs/src/components/integration-tile.tsx b/crowdsec-docs/src/components/integration-tile.tsx index 388f79dfd..7ff35de31 100644 --- a/crowdsec-docs/src/components/integration-tile.tsx +++ b/crowdsec-docs/src/components/integration-tile.tsx @@ -1,101 +1,119 @@ -import React from 'react'; -import useBaseUrl from '@docusaurus/useBaseUrl'; +import useBaseUrl from "@docusaurus/useBaseUrl"; +import React from "react"; interface IntegrationTileProps { - name: string; - slug: string; - href: string; - desc?: string; - color: string; - children?: React.ReactNode; + name: string; + slug: string; + href: string; + desc?: string; + color: string; + children?: React.ReactNode; } export const firewallIntegrations = [ - { name: 'Checkpoint', slug: 'checkpoint', href: '/u/integrations/checkpoint', desc: 'Custom Intelligence (IoC) Feeds', color: '#cc0000' }, - { name: 'Cisco', slug: 'cisco', href: '/u/integrations/cisco', desc: 'Security Intelligence feeds', color: '#1ba0d8' }, - { name: 'F5', slug: 'f5', href: '/u/integrations/f5', desc: 'External IP blocklist / Feed lists', color: '#e4002b' }, - { name: 'Fortinet', slug: 'fortinet', href: '/u/integrations/fortinet', desc: 'IP address Threat Feeds', color: '#ee3124' }, - { name: 'Juniper', slug: 'juniper', href: '/u/integrations/juniper', desc: 'Security Dynamic Address feeds', color: '#84b135' }, - { name: 'Mikrotik', slug: 'mikrotik', href: '/u/integrations/mikrotik', desc: 'IP blocklist ingestion', color: '#9f1d20' }, - { name: 'OPNsense', slug: 'opnsense', href: '/u/integrations/opnsense', desc: 'URL Table (IPs) aliases', color: '#d94f00' }, - { name: 'Palo Alto', slug: 'paloalto', href: '/u/integrations/paloalto', desc: 'External Dynamic Lists (EDL)', color: '#fa582d' }, - { name: 'pfSense', slug: 'pfsense', href: '/u/integrations/pfsense', desc: 'URL Table (IPs) aliases', color: '#212d6e' }, - { name: 'Sophos', slug: 'sophos', href: '/u/integrations/sophos', desc: 'Third-Party Threat Feeds', color: '#1f6bff' }, + { + name: "Checkpoint", + slug: "checkpoint", + href: "/u/integrations/checkpoint", + desc: "Custom Intelligence (IoC) Feeds", + color: "#cc0000", + }, + { name: "Cisco", slug: "cisco", href: "/u/integrations/cisco", desc: "Security Intelligence feeds", color: "#1ba0d8" }, + { name: "F5", slug: "f5", href: "/u/integrations/f5", desc: "External IP blocklist / Feed lists", color: "#e4002b" }, + { name: "Fortinet", slug: "fortinet", href: "/u/integrations/fortinet", desc: "IP address Threat Feeds", color: "#ee3124" }, + { name: "Juniper", slug: "juniper", href: "/u/integrations/juniper", desc: "Security Dynamic Address feeds", color: "#84b135" }, + { name: "Mikrotik", slug: "mikrotik", href: "/u/integrations/mikrotik", desc: "IP blocklist ingestion", color: "#9f1d20" }, + { name: "OPNsense", slug: "opnsense", href: "/u/integrations/opnsense", desc: "URL Table (IPs) aliases", color: "#d94f00" }, + { name: "Palo Alto", slug: "paloalto", href: "/u/integrations/paloalto", desc: "External Dynamic Lists (EDL)", color: "#fa582d" }, + { name: "pfSense", slug: "pfsense", href: "/u/integrations/pfsense", desc: "URL Table (IPs) aliases", color: "#212d6e" }, + { name: "Sophos", slug: "sophos", href: "/u/integrations/sophos", desc: "Third-Party Threat Feeds", color: "#1f6bff" }, ]; export default function IntegrationTile({ name, slug, href, desc, color, children }: IntegrationTileProps) { - const logoSrc = useBaseUrl(`/img/blaas/logo-${slug}.png`); - const fallbackSrc = useBaseUrl('/img/blaas/logo-default.png'); + const logoSrc = useBaseUrl(`/img/blaas/logo-${slug}.png`); + const fallbackSrc = useBaseUrl("/img/blaas/logo-default.png"); - return ( -
{ - (e.currentTarget as HTMLDivElement).style.boxShadow = `0 4px 12px ${color}30`; - (e.currentTarget as HTMLDivElement).style.borderColor = `${color}70`; - }} - onMouseLeave={e => { - (e.currentTarget as HTMLDivElement).style.boxShadow = 'none'; - (e.currentTarget as HTMLDivElement).style.borderColor = 'var(--ifm-color-emphasis-200)'; - }} - > - - ); + return ( +
+ + ); } diff --git a/crowdsec-docs/src/pages/index.tsx b/crowdsec-docs/src/pages/index.tsx index 24fd01381..c12411438 100644 --- a/crowdsec-docs/src/pages/index.tsx +++ b/crowdsec-docs/src/pages/index.tsx @@ -1,9 +1,9 @@ import Link from "@docusaurus/Link"; import Layout from "@theme/Layout"; import SearchBar from "@theme/SearchBar"; +import { ExternalLink } from "lucide-react"; import React, { useEffect, useState } from "react"; import { Button } from "../ui/button"; -import { ExternalLink } from "lucide-react"; // ── Intent card ────────────────────────────────────────────────────────────── @@ -21,47 +21,73 @@ const IntentCard = ({ icon, title, desc, pill, accent, href }: IntentCardProps) href={href} className="hover:no-underline group flex" style={{ textDecoration: "none", color: "inherit" }} - onMouseEnter={e => { + onMouseEnter={(e) => { const el = e.currentTarget as HTMLAnchorElement; el.style.borderColor = accent; el.style.boxShadow = `0 8px 24px ${accent}22, 0 0 0 1px ${accent}`; el.style.transform = "translateY(-2px)"; el.style.borderRadius = "14px"; }} - onMouseLeave={e => { + onMouseLeave={(e) => { const el = e.currentTarget as HTMLAnchorElement; el.style.borderColor = ""; el.style.boxShadow = ""; el.style.transform = ""; }} > -
+
-
{icon}
+
+ {icon} +
{title}
-
{desc}
+
+ {desc} +
- → {pill} + + → {pill} + →
@@ -105,35 +131,61 @@ const SchemaBlock = ({ id, color, eyebrowIcon, eyebrow, title, ctaLabel, ctaHref }} > {/* left accent strip */} -
+
{/* subtle radial glow */} -
+
{/* header — always visible, clickable to toggle */} {/* collapsible step flow */} {open && ( -
+
{steps.map((step, i) => ( -
+
{i > 0 && ( -
→
+
+ → +
)} {step.hint && ( -
{step.hint}
+
+ {step.hint} +
)} -
{step.num}
+
+ {step.num} +
{step.icon}
{step.title}
{step.desc}
{step.perks && ( -
diff --git a/crowdsec-docs/unversioned/console/ip_reputation/intro.mdx b/crowdsec-docs/unversioned/console/ip_reputation/intro.mdx index 0c1c9a4eb..0f0ef16c8 100644 --- a/crowdsec-docs/unversioned/console/ip_reputation/intro.mdx +++ b/crowdsec-docs/unversioned/console/ip_reputation/intro.mdx @@ -56,31 +56,31 @@ export const PURPLE = "#a78bfa"; - {/* Quota sub-tiles */} -
+ {/* Quota rows — plain text, not interactive */} +
{[ - { label: "Community", quota: "40", unit: "/ month", desc: "Ad-hoc lookups, proof of concept", color: GREEN }, - { label: "Premium", quota: "120", unit: "/ month", desc: "Regular enrichment, small integrations", color: BLUE }, - { label: "Premium Options", quota: "5K–100K", unit: "/ month", desc: "Production SIEMs, SOARs, high-volume pipelines", color: PURPLE }, - ].map(({ label, quota, unit, desc, color }) => ( -
-
{label}
-
- {quota} {unit} -
-
{desc}
+ { label: "Community", quota: "40 / month", desc: "ad-hoc lookups, proof of concept", color: GREEN }, + { label: "Premium", quota: "120 / month", desc: "regular enrichment, small integrations", color: BLUE }, + { label: "Premium Options", quota: "5K–100K / month", desc: "production SIEMs, SOARs, high-volume pipelines", color: PURPLE }, + ].map(({ label, quota, desc, color }) => ( +
+ {label} + {" — "} + {quota} + {" · "} + {desc}
))}
-
- API quotas are separate from Web UI quotas. Web UI searches consume their own quota: 100 searches/week when not logged in (1 quota per results page or report viewed); 40/month for logged-in Community accounts, 100/month for Premium. API key usage does not count against Web UI quotas, and vice versa. +
+ API quotas are separate from Web UI quotas. Web UI searches consume their own quota: 100/week unauthenticated (1 quota per results page or report); 40/month for Community, 100/month for Premium accounts.
-
- Create an API key → - Data Taxonomy → - API Reference +
+ Create an API key → + Data Taxonomy → + API Reference
From f824508e45e4a1c4e272b2026c418e06a8dd8ed8 Mon Sep 17 00:00:00 2001 From: jdv Date: Tue, 28 Apr 2026 11:45:31 +0200 Subject: [PATCH 13/26] homepage text changes --- crowdsec-docs/src/pages/index.tsx | 49 +++++-------------------------- 1 file changed, 7 insertions(+), 42 deletions(-) diff --git a/crowdsec-docs/src/pages/index.tsx b/crowdsec-docs/src/pages/index.tsx index 2a38f14a8..806ebafe7 100644 --- a/crowdsec-docs/src/pages/index.tsx +++ b/crowdsec-docs/src/pages/index.tsx @@ -101,7 +101,6 @@ type Step = { title: string; desc: string; hint?: string; - perks?: string[]; }; type SchemaBlockProps = { @@ -300,35 +299,6 @@ const SchemaBlock = ({ id, color, eyebrowIcon, eyebrow, title, ctaLabel, ctaHref
{step.icon}
{step.title}
{step.desc}
- {step.perks && ( -
    - {step.perks.map((p) => ( -
  • - ✓ - {p} -
    • - ))} -
- )}
))}
@@ -383,11 +353,7 @@ const schemas: Omit[] = [ num: 1, icon: "⚡", title: "Install the Security Engine", - desc: "Runs on your server, detects attack patterns in real time.", - perks: [ - "Immediately protected from incoming attacks", - "Automatically receives global threat intel from the CrowdSec network", - ], + desc: "Runs on your server, detects attack patterns in real time — immediately protected, and continuously updated with CrowdSec Community Blocklist.", }, { num: 2, @@ -425,7 +391,7 @@ const schemas: Omit[] = [ num: 1, icon: "🔌", title: "Create a blocklist integration endpoint", - desc: "Generate a dedicated URL in the Console — one per target device or environment.", + desc: "Generates a dedicated URL and credentials to serve blocklists to your perimeter devices.", }, { num: 2, @@ -437,8 +403,7 @@ const schemas: Omit[] = [ num: 3, icon: "🔗", title: "Plug it in as an external threat feed", - desc: "Point your firewall, CDN, or WAF at the endpoint. It auto-refreshes — no further maintenance needed.", - perks: ["Works with pfSense, OPNsense, Cloudflare, nginx, HAProxy, and more", "No agent to install or maintain"], + desc: "Point your firewall, CDN, or WAF at the endpoint. Use the feed to protect your infrastructure.", }, ], }, @@ -455,20 +420,20 @@ const schemas: Omit[] = [ num: 1, icon: "🖥️", title: "Look up any IP in the Console", - desc: "No setup. Search instantly — get reputation score, behaviors, attack history, and CVE links.", + desc: "Search instantly from our Web UI— get reputation score, behaviors, attack history, and CVE links.", }, { num: 2, icon: "🔑", - hint: "For integrations", + hint: "Integrate", title: "Generate a CTI API key", - desc: "Unlock programmatic access to the same data. Free tier included — no credit card needed.", + desc: "Unlock programmatic access to 30+ data points on IPs detected by CrowdSec Network.", }, { num: 3, icon: "⚙️", hint: "Enrich", - title: "Connect to your SIEM or security tool", + title: "Connect to your SIEM/SOAR/TIP", desc: "Native integrations for Splunk, Sentinel, QRadar, TheHive, OpenCTI, MISP, and more.", }, ], From 0e52cca445fdc029bfee9db04bec5c137670c099 Mon Sep 17 00:00:00 2001 From: jdv Date: Tue, 28 Apr 2026 14:22:32 +0200 Subject: [PATCH 14/26] text update in all pages --- crowdsec-docs/sidebarsUnversioned.ts | 5 ++ crowdsec-docs/src/pages/index.tsx | 10 +-- .../ip_reputation/api_keys_premium.mdx | 75 ++++++++++++++++ .../console/ip_reputation/intro.mdx | 85 ++++++++----------- .../unversioned/console/stackhealth.mdx | 3 +- crowdsec-docs/unversioned/cti_api/intro.mdx | 10 +-- 6 files changed, 129 insertions(+), 59 deletions(-) create mode 100644 crowdsec-docs/unversioned/console/ip_reputation/api_keys_premium.mdx diff --git a/crowdsec-docs/sidebarsUnversioned.ts b/crowdsec-docs/sidebarsUnversioned.ts index 888033d5b..7c1926d14 100644 --- a/crowdsec-docs/sidebarsUnversioned.ts +++ b/crowdsec-docs/sidebarsUnversioned.ts @@ -420,6 +420,11 @@ const sidebarsUnversionedConfig: SidebarConfig = { label: "Advanced Search", id: "console/ip_reputation/search_ui_advanced", }, + { + type: "doc", + label: "IP Reputation Report", + id: "console/ip_reputation/ip_report", + }, { type: "link", label: "Search Queries Syntax", diff --git a/crowdsec-docs/src/pages/index.tsx b/crowdsec-docs/src/pages/index.tsx index 806ebafe7..17ae4039d 100644 --- a/crowdsec-docs/src/pages/index.tsx +++ b/crowdsec-docs/src/pages/index.tsx @@ -531,7 +531,7 @@ const HomePage = () => { {
{[ { label: "🖥️ Open the Console", href: "https://app.crowdsec.net", external: true }, - { label: "📋 Manage alerts & decisions", href: "/u/console/intro" }, - { label: "🔄 Remediation sync", href: "/u/bouncers/intro" }, - { label: "❓ Troubleshooting", href: "/docs/next/troubleshooting/security_engine" }, + { label: "🛡️ Activate the WAF", href: "/docs/next/appsec/intro" }, + { label: "📊 Measure what is being Blocked", href: "/u/console/remediation_metrics" }, + { label: "🩺 Check my Stack Health", href: "/u/console/stackhealth" }, ].map(({ label, href, external }) => ( { gap: "6px", padding: "5px 12px", borderRadius: "7px", - fontSize: "12.5px", + fontSize: "11px", color: "var(--ifm-color-emphasis-700)", border: "1px solid var(--ifm-color-emphasis-200)", background: "var(--ifm-background-color)", diff --git a/crowdsec-docs/unversioned/console/ip_reputation/api_keys_premium.mdx b/crowdsec-docs/unversioned/console/ip_reputation/api_keys_premium.mdx new file mode 100644 index 000000000..7abd7788b --- /dev/null +++ b/crowdsec-docs/unversioned/console/ip_reputation/api_keys_premium.mdx @@ -0,0 +1,75 @@ +--- +id: api_keys_premium +title: CTI API Access & Quotas +sidebar_position: 2 +--- + +import Link from "@docusaurus/Link"; + +export const GREEN = "#22d3a0"; +export const BLUE = "#60a5fa"; +export const PURPLE = "#a78bfa"; + +Every CrowdSec account — free or Premium — includes a complimentary CTI API key. The right tier depends on what you're doing with the data. + +{/* ── Tier cards ─────────────────────────────────────────────────────────── */} + +
+ + {/* Community */} +
+
+ Community Plan + Free · 40 queries / month +
+
+ Included with every account at no cost. Suited for testing a CTI integration end-to-end, enriching alerts on personal homelab or hobby servers, or doing occasional ad-hoc IP lookups during an investigation. Not designed for production pipelines that query continuously. +
+
Free key · no credit card needed · resets monthly
+
+ + {/* Premium */} +
+
+ Premium Plan + 120 queries / month +
+
+ For practitioners with growing CTI enrichment needs — small SOC teams, security engineers running regular automation, or analysts who enrich SIEM alerts on a recurring basis. The 3× quota increase over Community covers light-to-moderate production use without committing to a paid quota add-on. +
+
Included with Premium Plan · resets monthly
+
+ + {/* Extended */} +
+
+ Extended Quota Options + 5K · 25K · 100K queries / month +
+
+ Purchasable add-ons available to Premium organizations. Designed for production SIEMs, SOARs, and high-volume enrichment pipelines — cases where every incoming alert or event triggers an IP lookup. Available in three sizes to match your actual throughput rather than forcing an all-or-nothing commitment. +
+
Requires Premium Plan · pricing shown in Console under Settings → CTI API Keys
+
+ +
+ +{/* ── Quota note ─────────────────────────────────────────────────────────── */} + +
+ API quotas are separate from Web UI quotas. Searching IPs through the Console web interface consumes its own quota and does not count against your API key. Unused API quota does not roll over to the next month. +
+ +## Purchasing a high-quota key + +Extended quota keys are available in the Console under **Settings → CTI API Keys → + New Key**. All available options and their costs are shown there. + +## Lucene search via API + +The [Advanced Search](/u/console/ip_reputation/search_ui_advanced) Lucene query interface available in the Console is a **Web UI feature only** — it is not accessible through self-service API keys. If you need programmatic access to Lucene-style bulk querying or advanced filtering at scale, this requires an Advanced CTI plan. [Contact our team](https://www.crowdsec.net/contact-crowdsec?message=Advanced%20CTI%20plan%20discussion) to discuss your use case. + +:::warning CTI API Keys and trials +- Purchasing a CTI API Key does **not** grant access to a Premium Plan trial. +- Purchasing a CTI API Key while a trial is active will **immediately end the trial**. +- Cancelled CTI API Keys are **non-refundable** and will not be prorated — the full price remains due regardless of when the cancellation occurs. +::: diff --git a/crowdsec-docs/unversioned/console/ip_reputation/intro.mdx b/crowdsec-docs/unversioned/console/ip_reputation/intro.mdx index 0f0ef16c8..b72baa76f 100644 --- a/crowdsec-docs/unversioned/console/ip_reputation/intro.mdx +++ b/crowdsec-docs/unversioned/console/ip_reputation/intro.mdx @@ -15,73 +15,62 @@ export const PURPLE = "#a78bfa"; Query behavioral intelligence on any IP — reputation scores, attack patterns, linked CVEs, and activity history — sourced from hundreds of thousands of real CrowdSec deployments worldwide.

-{/* ── Row 1: Search + IP Report ───────────────────────────────────────── */} +{/* ── Row 1: two cards side by side ──────────────────────────────────── */} -
+
+ {/* Card 1: Web UI exploration (merged Search + IP Report) */}
🔍
-
Explore IP Reputation
+
Explore in the Web UI
- Search any IP or run Lucene queries with live faceted filters — reputation, country, AS, behaviors, classifications. The homepage also surfaces a Top 10 Most Aggressive IPs leaderboard updated every 24h. + No setup needed. Search any IP directly from your browser — run Lucene queries with live faceted filters (reputation, country, AS, behaviors, classifications) and open any result to see its full report: threat score, behaviors mapped to MITRE ATT&CK, linked CVEs, and time-windowed activity. The homepage also surfaces a Top 10 Most Aggressive IPs leaderboard updated every 24h.
-
+
IP Search → Advanced Search → - Query Reference → + IP Report → + Lucene Query Reference →
+ {/* Card 2: Enrich your Alerts (API Key) */}
-
📋
-
Understand an IP Report
-
- Click any IP to open its full report: threat reputation score, observed attack behaviors mapped to MITRE ATT&CK, linked CVEs, classifications, and time-windowed activity details showing whether the threat is rising, stable, or decaying. +
🔑
+
Enrich your Alerts
+
+ Unlock programmatic access to 30+ enrichment fields per IP — reputation, behaviors, CVEs, attack context, MITRE mappings, and more. Use it to enrich SIEM alerts, automate lookups, or feed threat intel platforms. Free tier included, no credit card needed.
- IP Report → -
- -
-{/* ── Row 2: API Key ──────────────────────────────────────────────────── */} - -
-
-
🔑
-
-
Create an API Key
-
- Unlock programmatic access to 30+ enrichment fields per IP — reputation, behaviors, CVEs, attack context, MITRE mappings, and more. Use it to enrich SIEM alerts, automate lookups, or feed threat intel platforms. Free tier included, no credit card needed. -
+ {/* Quota rows */} +
+ {[ + { label: "Community", quota: "40 / month", desc: "ad-hoc lookups, proof of concept", color: GREEN }, + { label: "Premium", quota: "120 / month", desc: "regular enrichment, small integrations", color: BLUE }, + { label: "Premium Options", quota: "5K–100K / month", desc: "production SIEMs, SOARs, high-volume pipelines", color: PURPLE }, + ].map(({ label, quota, desc, color }) => ( +
+ {label} + {" — "} + {quota} + {" · "} + {desc} +
+ ))}
-
- {/* Quota rows — plain text, not interactive */} -
- {[ - { label: "Community", quota: "40 / month", desc: "ad-hoc lookups, proof of concept", color: GREEN }, - { label: "Premium", quota: "120 / month", desc: "regular enrichment, small integrations", color: BLUE }, - { label: "Premium Options", quota: "5K–100K / month", desc: "production SIEMs, SOARs, high-volume pipelines", color: PURPLE }, - ].map(({ label, quota, desc, color }) => ( -
- {label} - {" — "} - {quota} - {" · "} - {desc} -
- ))} -
+
+ API quotas are separate from Web UI quotas. Unused quota does not roll over. +
-
- API quotas are separate from Web UI quotas. Web UI searches consume their own quota: 100/week unauthenticated (1 quota per results page or report); 40/month for Community, 100/month for Premium accounts. +
+ Create an API key → + Quotas & plans → + Data Taxonomy → + API Reference +
-
- Create an API key → - Data Taxonomy → - API Reference -
{/* ── You might also be interested in: LET ───────────────────────────── */} diff --git a/crowdsec-docs/unversioned/console/stackhealth.mdx b/crowdsec-docs/unversioned/console/stackhealth.mdx index 3410b8ed4..a79276f24 100644 --- a/crowdsec-docs/unversioned/console/stackhealth.mdx +++ b/crowdsec-docs/unversioned/console/stackhealth.mdx @@ -4,7 +4,8 @@ title: Stack Health --- The **Stack Health** Feature is a monitoring tool within the CrowdSec Console helping you keep your infrastructure operational and properly configured. -Its primary goal is to identify configuration issues, connectivity problems, or potential misconfigurations that could impact your detection capabilities. +Its primary goal is to identify configuration issues, connectivity problems, or potential misconfigurations that could impact your detection capabilities. +*You can also do a manual health check of your stack by following this post installation [Health-Check guide](/u/getting_started/health_check).* --- diff --git a/crowdsec-docs/unversioned/cti_api/intro.mdx b/crowdsec-docs/unversioned/cti_api/intro.mdx index b15b43a3b..d2989506e 100644 --- a/crowdsec-docs/unversioned/cti_api/intro.mdx +++ b/crowdsec-docs/unversioned/cti_api/intro.mdx @@ -15,7 +15,7 @@ export const PURPLE = "#a78bfa"; {/* ── Hero ─────────────────────────────────────────────────────────────── */}

- Know who's attacking you — and why. + Understand the IPs behind attacks

CrowdSec tracks malicious IPs across hundreds of thousands of real deployments worldwide. @@ -41,19 +41,19 @@ export const PURPLE = "#a78bfa"; {[ { badge: "🔍 No setup needed", icon: "🖥️", accent: BLUE, - title: "Investigate in the Console", + title: "Web UI investigation - in the Console", desc: "Search any IP instantly. Explore threat history and the top aggressive IPs in the last 24h — no API key needed.", links: [{ label: "Web UI guide →", href: "/u/console/ip_reputation/intro" }, { label: "IP Report →", href: "/u/console/ip_reputation/ip_report" }], }, { badge: "⚙️ Developer / SecOps", icon: "🔌", accent: ORANGE, - title: "Integrate via API", - desc: "Enrich SIEM alerts, build enrichment pipelines, or plug into Splunk, Sentinel, QRadar, TheHive, and more.", + title: "Enrich Alerts via API", + desc: "Use the CTI API to add CrowdSec IP context to SIEM alerts, SOAR workflows, TIPs, scripts, and internal tools.", links: [{ label: "API quickstart →", href: "/u/cti_api/api_introduction" }, { label: "All integrations →", href: "/u/cti_api/api_integration/integration_intro" }], }, { badge: "🎯 Threat hunter", icon: "🚨", accent: PURPLE, - title: "Hunt for threat patterns", + title: "Hunt active threats", desc: "Advanced Search with live faceted filters — behavior, country, AS, CVE — to find campaigns or build blocklists.", links: [{ label: "Advanced search →", href: "/u/console/ip_reputation/search_ui_advanced" }, { label: "Live Exploit Tracker →", href: "/u/tracker_api/intro" }], }, From f4051c22f488c77441c04879894d00ffb37eb0d2 Mon Sep 17 00:00:00 2001 From: jdv Date: Tue, 28 Apr 2026 14:23:07 +0200 Subject: [PATCH 15/26] biome fix --- crowdsec-docs/src/pages/index.tsx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/crowdsec-docs/src/pages/index.tsx b/crowdsec-docs/src/pages/index.tsx index 17ae4039d..9b8c5a2c3 100644 --- a/crowdsec-docs/src/pages/index.tsx +++ b/crowdsec-docs/src/pages/index.tsx @@ -471,7 +471,7 @@ const HomePage = () => { />

- Find the right + Find the right
CrowdSec tool for you

From 51827158f0f2d91e510db53015d71cd215fde773 Mon Sep 17 00:00:00 2001 From: jdv Date: Tue, 28 Apr 2026 15:09:18 +0200 Subject: [PATCH 16/26] mention lucene queries not available via api --- crowdsec-docs/unversioned/cti_api/intro.mdx | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/crowdsec-docs/unversioned/cti_api/intro.mdx b/crowdsec-docs/unversioned/cti_api/intro.mdx index d2989506e..a51919f31 100644 --- a/crowdsec-docs/unversioned/cti_api/intro.mdx +++ b/crowdsec-docs/unversioned/cti_api/intro.mdx @@ -82,10 +82,10 @@ export const PURPLE = "#a78bfa";

{[ - { icon: "🌍", title: "Crowdsourced from live attacks", desc: "Signals from active CrowdSec installs globally. When an IP appears here, hundreds of machines saw it in action." }, + { icon: "🌍", title: "Real-world attack signals", desc: "CrowdSec intelligence is built from signals shared by real deployments across the Internet." }, { icon: "🧠", title: "Behavioral, not just reputation", desc: "Brute-force, CVE exploitation, scan, credential stuffing — mapped to MITRE ATT&CK." }, { icon: "⚡", title: "Real-time, not cached lists", desc: "Continuously updated with time-windowed scores showing if a threat is rising, stable, or decaying." }, - { icon: "🔬", title: "CVE-level exploit tracking", desc: "The Live Exploit Tracker shows which CVEs are actively exploited, with momentum and opportunity scores." }, + { icon: "🔬", title: "CVE-level exploit tracking", desc: "Live Exploit Tracker shows which CVEs are actively exploited, with momentum, opportunity, and malicious IP context." }, ].map(({ icon, title, desc }) => (
{icon} From bfcc764988403ff0ec515b53e6c3a74d585ebc22 Mon Sep 17 00:00:00 2001 From: jdv Date: Tue, 28 Apr 2026 15:23:01 +0200 Subject: [PATCH 17/26] adding Aka tags on home --- crowdsec-docs/src/pages/index.tsx | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-) diff --git a/crowdsec-docs/src/pages/index.tsx b/crowdsec-docs/src/pages/index.tsx index 9b8c5a2c3..6b58306ee 100644 --- a/crowdsec-docs/src/pages/index.tsx +++ b/crowdsec-docs/src/pages/index.tsx @@ -14,9 +14,10 @@ type IntentCardProps = { pill: string; accent: string; href: string; + aka?: string[]; }; -const IntentCard = ({ icon, title, desc, pill, accent, href }: IntentCardProps) => ( +const IntentCard = ({ icon, title, desc, pill, accent, href, aka }: IntentCardProps) => (
+ {aka && aka.length > 0 && ( +
+ aka + {aka.map((tag) => ( + {tag} + ))} +
+ )}
); @@ -320,6 +329,7 @@ const intents: IntentCardProps[] = [ desc: "Locally identify and ban bad behaving IPs observed in your logs and requests with CrowdSec Detection Scenarios, and Virtual-Patching Collections.", pill: "Security Engine", href: "/security-engine", + aka: ["IDPS", "WAF", "CrowdSec FOSS"], }, { icon: Blocklists, @@ -328,6 +338,7 @@ const intents: IntentCardProps[] = [ desc: "You manage network perimeter devices and want a URL to subscribe to — no agent to install.", pill: "Blocklist Integration Endpoint", href: "/blocklists", + aka: ["Threat Feeds", "IOC Streams", "Deny-list"], }, { icon: CTI, @@ -336,6 +347,7 @@ const intents: IntentCardProps[] = [ desc: "You're a security analyst or developer who wants IP context — in a browser or via REST API.", pill: "IP Reputation & CTI", href: "/u/cti_api/intro", + aka: ["IoC Lookup", "Threat Intel"], }, ]; @@ -669,7 +681,7 @@ const HomePage = () => { external: true, }, { label: "🔑 CTI API Keys", href: "/cti" }, - { label: "❓ Troubleshooting", href: "/docs/next/troubleshooting/security_engine" }, + { label: "❓ Troubleshooting", href: "/u/troubleshooting/intro" }, { label: "🌐 About CrowdSec", href: "https://www.crowdsec.net", external: true }, ].map(({ label, href, external }) => ( Date: Tue, 28 Apr 2026 18:00:41 +0200 Subject: [PATCH 18/26] biome fix --- crowdsec-docs/src/pages/index.tsx | 28 ++++++++++++++++++++++++++-- 1 file changed, 26 insertions(+), 2 deletions(-) diff --git a/crowdsec-docs/src/pages/index.tsx b/crowdsec-docs/src/pages/index.tsx index 6b58306ee..3d21dc0a1 100644 --- a/crowdsec-docs/src/pages/index.tsx +++ b/crowdsec-docs/src/pages/index.tsx @@ -92,9 +92,33 @@ const IntentCard = ({ icon, title, desc, pill, accent, href, aka }: IntentCardPr
{aka && aka.length > 0 && (
- aka + + aka + {aka.map((tag) => ( - {tag} + + {tag} + ))}
)} From 5ae86fdcb73f1429b7142046c2db5e0a608a42a8 Mon Sep 17 00:00:00 2001 From: jdv Date: Wed, 29 Apr 2026 15:12:16 +0200 Subject: [PATCH 19/26] merging premium key in api key page + smaller format quota section --- .../ip_reputation/api_keys_premium.mdx | 75 ------------------- .../console/ip_reputation/intro.mdx | 22 ------ crowdsec-docs/unversioned/cti_api/intro.md | 69 ----------------- crowdsec-docs/unversioned/cti_api/intro.mdx | 39 +++++----- 4 files changed, 18 insertions(+), 187 deletions(-) delete mode 100644 crowdsec-docs/unversioned/console/ip_reputation/api_keys_premium.mdx delete mode 100644 crowdsec-docs/unversioned/cti_api/intro.md diff --git a/crowdsec-docs/unversioned/console/ip_reputation/api_keys_premium.mdx b/crowdsec-docs/unversioned/console/ip_reputation/api_keys_premium.mdx deleted file mode 100644 index 7abd7788b..000000000 --- a/crowdsec-docs/unversioned/console/ip_reputation/api_keys_premium.mdx +++ /dev/null @@ -1,75 +0,0 @@ ---- -id: api_keys_premium -title: CTI API Access & Quotas -sidebar_position: 2 ---- - -import Link from "@docusaurus/Link"; - -export const GREEN = "#22d3a0"; -export const BLUE = "#60a5fa"; -export const PURPLE = "#a78bfa"; - -Every CrowdSec account — free or Premium — includes a complimentary CTI API key. The right tier depends on what you're doing with the data. - -{/* ── Tier cards ─────────────────────────────────────────────────────────── */} - -
- - {/* Community */} -
-
- Community Plan - Free · 40 queries / month -
-
- Included with every account at no cost. Suited for testing a CTI integration end-to-end, enriching alerts on personal homelab or hobby servers, or doing occasional ad-hoc IP lookups during an investigation. Not designed for production pipelines that query continuously. -
-
Free key · no credit card needed · resets monthly
-
- - {/* Premium */} -
-
- Premium Plan - 120 queries / month -
-
- For practitioners with growing CTI enrichment needs — small SOC teams, security engineers running regular automation, or analysts who enrich SIEM alerts on a recurring basis. The 3× quota increase over Community covers light-to-moderate production use without committing to a paid quota add-on. -
-
Included with Premium Plan · resets monthly
-
- - {/* Extended */} -
-
- Extended Quota Options - 5K · 25K · 100K queries / month -
-
- Purchasable add-ons available to Premium organizations. Designed for production SIEMs, SOARs, and high-volume enrichment pipelines — cases where every incoming alert or event triggers an IP lookup. Available in three sizes to match your actual throughput rather than forcing an all-or-nothing commitment. -
-
Requires Premium Plan · pricing shown in Console under Settings → CTI API Keys
-
- -
- -{/* ── Quota note ─────────────────────────────────────────────────────────── */} - -
- API quotas are separate from Web UI quotas. Searching IPs through the Console web interface consumes its own quota and does not count against your API key. Unused API quota does not roll over to the next month. -
- -## Purchasing a high-quota key - -Extended quota keys are available in the Console under **Settings → CTI API Keys → + New Key**. All available options and their costs are shown there. - -## Lucene search via API - -The [Advanced Search](/u/console/ip_reputation/search_ui_advanced) Lucene query interface available in the Console is a **Web UI feature only** — it is not accessible through self-service API keys. If you need programmatic access to Lucene-style bulk querying or advanced filtering at scale, this requires an Advanced CTI plan. [Contact our team](https://www.crowdsec.net/contact-crowdsec?message=Advanced%20CTI%20plan%20discussion) to discuss your use case. - -:::warning CTI API Keys and trials -- Purchasing a CTI API Key does **not** grant access to a Premium Plan trial. -- Purchasing a CTI API Key while a trial is active will **immediately end the trial**. -- Cancelled CTI API Keys are **non-refundable** and will not be prorated — the full price remains due regardless of when the cancellation occurs. -::: diff --git a/crowdsec-docs/unversioned/console/ip_reputation/intro.mdx b/crowdsec-docs/unversioned/console/ip_reputation/intro.mdx index b72baa76f..ec889d7a6 100644 --- a/crowdsec-docs/unversioned/console/ip_reputation/intro.mdx +++ b/crowdsec-docs/unversioned/console/ip_reputation/intro.mdx @@ -42,30 +42,8 @@ export const PURPLE = "#a78bfa"; Unlock programmatic access to 30+ enrichment fields per IP — reputation, behaviors, CVEs, attack context, MITRE mappings, and more. Use it to enrich SIEM alerts, automate lookups, or feed threat intel platforms. Free tier included, no credit card needed.
- {/* Quota rows */} -
- {[ - { label: "Community", quota: "40 / month", desc: "ad-hoc lookups, proof of concept", color: GREEN }, - { label: "Premium", quota: "120 / month", desc: "regular enrichment, small integrations", color: BLUE }, - { label: "Premium Options", quota: "5K–100K / month", desc: "production SIEMs, SOARs, high-volume pipelines", color: PURPLE }, - ].map(({ label, quota, desc, color }) => ( -
- {label} - {" — "} - {quota} - {" · "} - {desc} -
- ))} -
- -
- API quotas are separate from Web UI quotas. Unused quota does not roll over. -
-
Create an API key → - Quotas & plans → Data Taxonomy → API Reference
diff --git a/crowdsec-docs/unversioned/cti_api/intro.md b/crowdsec-docs/unversioned/cti_api/intro.md deleted file mode 100644 index 7754f9391..000000000 --- a/crowdsec-docs/unversioned/cti_api/intro.md +++ /dev/null @@ -1,69 +0,0 @@ ---- -id: intro_old -title: CrowdSec CTI - Cyber Threat Intelligence -sidebar_position: 1 ---- - -CrowdSec's **Cyber Threat Intelligence (CTI)** exposes the threat data collected by the global CrowdSec network — millions of IPs enriched with behaviors, classifications, scores, MITRE techniques, and CVE associations — through a REST API designed for programmatic integration. - -This section covers the **API** side of CTI: authentication, datasets, data format, taxonomy, and integrations with third-party security platforms. - -:::tip Prefer a visual interface? -The [IP Reputation section of the Console](/u/console/ip_reputation/intro) presents exploration via the Console UI to: get details about a specific IP, run advanced queries, and manage your CTI API Key(s) -::: - ---- - -## What the API Gives You - -For any queried IP, the CTI API returns: - -| Field | Description | -| --- | --- | -| **Reputation** | Malicious, Suspicious, Known, Benign, Safe, or Unknown | -| **Behaviors** | Attack types observed (SSH Bruteforce, HTTP Scan, CVE exploitation, etc.) | -| **Classifications** | TOR exit node, VPN/Proxy, CDN, scanner, false positive, and more | -| **Scores** | Aggressiveness, threat, trust, and anomaly — computed over 1d / 7d / 30d windows | -| **MITRE ATT&CK** | Techniques mapped to the IP's observed behaviors | -| **CVEs** | Vulnerabilities the IP has been actively exploiting | -| **History** | First seen / last seen, activity age | -| **Target countries** | Geographic distribution of attacks from this IP | - -Full field-level documentation: [CTI Object format](/u/cti_api/taxonomy/cti_object). - ---- - -## Taxonomy - -Understanding the CTI data model is key to making good use of the API. The [Taxonomy section](/u/cti_api/taxonomy/intro) documents: - -- [**CTI Format**](/u/cti_api/taxonomy/cti_object) — complete response structure and field reference -- [**Scores**](/u/cti_api/taxonomy/scores) — how aggressiveness, threat, trust, and anomaly are computed -- [**Behaviors**](/u/cti_api/taxonomy/behaviors) — defined attack behaviors and their labels -- [**Classifications**](/u/cti_api/taxonomy/classifications) — IP category tags (VPN, TOR, CDN, scanner, etc.) -- [**False Positives**](/u/cti_api/taxonomy/false_positives) — categories excluded from malicious verdicts -- [**Scenarios**](/u/cti_api/taxonomy/scenarios) — the detection scenarios that triggered reports for an IP - ---- - -## Getting Started - -1. **Get an API key** — create one in the [Console](https://app.crowdsec.net/settings/cti-api-keys). A free key is available to all registered users. See [API Keys](/u/console/ip_reputation/api_keys). -2. **Make your first request** — see [API Introduction](/u/cti_api/api_introduction) for the base URL, authentication header, and an example response. -3. **Integrate** — connect CrowdSec CTI to your SIEM, SOAR, or TIP using one of the [supported integrations](/u/cti_api/api_integration/integration_intro). - ---- - -## Integrations - -CrowdSec CTI has native integrations with major security platforms: - -| Category | Platforms | -| --- | --- | -| **SIEM** | Splunk Enterprise Security, QRadar, Microsoft Sentinel | -| **SOAR** | Splunk SOAR, Palo Alto XSOAR, TheHive | -| **TIP** | MISP, OpenCTI, Sekoia XDR | -| **Investigation** | Maltego, MSTICpy, IntelOwl | -| **Other** | Chrome extension, Gigasheet | - -[See all integrations →](/u/cti_api/api_integration/integration_intro) diff --git a/crowdsec-docs/unversioned/cti_api/intro.mdx b/crowdsec-docs/unversioned/cti_api/intro.mdx index a51919f31..e835bdfb3 100644 --- a/crowdsec-docs/unversioned/cti_api/intro.mdx +++ b/crowdsec-docs/unversioned/cti_api/intro.mdx @@ -11,6 +11,7 @@ import CtiIntegrationTile, { ctiIntegrations } from '@site/src/components/cti-in export const BLUE = "#60a5fa"; export const ORANGE = "#f97316"; export const PURPLE = "#a78bfa"; +export const GREEN = "#22d3a0"; {/* ── Hero ─────────────────────────────────────────────────────────────── */} @@ -111,28 +112,24 @@ export const PURPLE = "#a78bfa"; ))}
-
-
API access & quotas
-
- {[ - { label: "Community Plan Free Key", quota: "40 / month", desc: "Ad-hoc lookups, proof of concept", color: "#22d3a0" }, - { label: "Premium Plan Free Key", quota: "120 / month", desc: "Regular enrichment, small integrations", color: BLUE }, - { label: "Premium Options", quota: "5K–100K / month", desc: "Production SIEMs, SOARs, high-volume pipelines", color: PURPLE }, - ].map(({ label, quota, desc, color }) => ( -
-
- {label} - {quota} -
-
{desc}
-
- ))} -
-
- Web UI lookups do not consume API quota. Free tier resets monthly — unused queries don't roll over. +
+ {[ + { label: "Community Plan Free Key", quota: "40 / month", desc: "Testing integrations, personal servers, ad-hoc lookups", color: GREEN }, + { label: "Premium Plan Free Key", quota: "120 / month", desc: "Regular enrichment, small SOC teams, recurring automation", color: BLUE }, + { label: "Premium Keys Options", quota: "5K · 25K · 100K / month", desc: "Production SIEMs, SOARs, high-volume pipelines — requires Premium", color: PURPLE }, + ].map(({ label, quota, desc, color }) => ( +
+ {label} + {" — "} + {quota} + {" · "} + {desc}
- Get your first API key → -
+ ))} +
+
+ API quotas are separate from Web UI quotas. Unused quota does not roll over. +
{/* ── Technical details ───────────────────────────────────────────────── */} From bab54de13c2c2cb587a2f5bf48796fa93eada6d6 Mon Sep 17 00:00:00 2001 From: jdv Date: Wed, 29 Apr 2026 16:15:25 +0200 Subject: [PATCH 20/26] adding redirect for old premium key page --- crowdsec-docs/docusaurus.config.ts | 1 + 1 file changed, 1 insertion(+) diff --git a/crowdsec-docs/docusaurus.config.ts b/crowdsec-docs/docusaurus.config.ts index cc343e081..fdd185d17 100644 --- a/crowdsec-docs/docusaurus.config.ts +++ b/crowdsec-docs/docusaurus.config.ts @@ -210,6 +210,7 @@ const redirects = [ // other CTI pages redirect / fixes { from: "/next/cti_api/intro", to: "/u/console/ip_reputation/api_keys" }, { from: "/next/cti_api/getting_started", to: "/u/console/ip_reputation/api_keys" }, + { from: "/u/console/ip_reputation/api_keys_premium", to: "/u/console/ip_reputation/api_keys" }, ]; function redirectsGlobalDataPlugin() { From 31fc66c992db33a80fdd8c12671ada2b3c5296ef Mon Sep 17 00:00:00 2001 From: jdv Date: Mon, 4 May 2026 09:22:07 +0200 Subject: [PATCH 21/26] mini textual changes --- crowdsec-docs/src/pages/index.tsx | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-) diff --git a/crowdsec-docs/src/pages/index.tsx b/crowdsec-docs/src/pages/index.tsx index 3d21dc0a1..716d7e511 100644 --- a/crowdsec-docs/src/pages/index.tsx +++ b/crowdsec-docs/src/pages/index.tsx @@ -367,8 +367,8 @@ const intents: IntentCardProps[] = [ { icon: CTI, accent: BLUE, - title: "Investigate IPs or enrich alerts", - desc: "You're a security analyst or developer who wants IP context — in a browser or via REST API.", + title: "Investigate IPs Behaviors and Enrich Alerts", + desc: "You're a security analyst or developer who wants IP context, behaviors, CVEs, Aggressivity... In a browser or via REST API.", pill: "IP Reputation & CTI", href: "/u/cti_api/intro", aka: ["IoC Lookup", "Threat Intel"], @@ -626,8 +626,7 @@ const HomePage = () => { marginBottom: "20px", }} > -
- how each path works +
💡 how each path works
@@ -699,14 +698,14 @@ const HomePage = () => { { label: "🖥️ Console", href: "/u/console/intro" }, { label: "🛡️ AppSec / WAF", href: "/docs/next/appsec/intro" }, { label: "💻 CLI Reference", href: "/docs/next/cscli/" }, + { label: "🔑 CTI API Keys", href: "/cti" }, + { label: "❓ Troubleshooting", href: "/u/troubleshooting/intro" }, { label: "📖 Docs AI Assistant", href: "https://chatgpt.com/g/g-682c3a61a78081918417571116c2b563-crowdsec-documentation", external: true, }, - { label: "🔑 CTI API Keys", href: "/cti" }, - { label: "❓ Troubleshooting", href: "/u/troubleshooting/intro" }, - { label: "🌐 About CrowdSec", href: "https://www.crowdsec.net", external: true }, + { label: "🌐 WWW - CrowdSec", href: "https://www.crowdsec.net", external: true }, ].map(({ label, href, external }) => ( Date: Tue, 5 May 2026 09:37:24 +0200 Subject: [PATCH 22/26] slight color adjustement to make light mode mode readeable --- crowdsec-docs/sidebarsUnversioned.ts | 6 +++--- .../src/components/cti-integration-tile.tsx | 2 +- crowdsec-docs/src/css/custom.css | 6 +++--- crowdsec-docs/src/pages/cti.tsx | 6 +++--- crowdsec-docs/src/pages/index.tsx | 18 +++++++++--------- .../console/ip_reputation/api_keys.mdx | 4 ++-- crowdsec-docs/unversioned/cti_api/intro.mdx | 6 +++--- 7 files changed, 24 insertions(+), 24 deletions(-) diff --git a/crowdsec-docs/sidebarsUnversioned.ts b/crowdsec-docs/sidebarsUnversioned.ts index 7c1926d14..0150a8bca 100644 --- a/crowdsec-docs/sidebarsUnversioned.ts +++ b/crowdsec-docs/sidebarsUnversioned.ts @@ -14,7 +14,7 @@ const sidebarsUnversionedConfig: SidebarConfig = { // ── EXPLORE ────────────────────────────────────────────────────────── { type: "html", - value: "Explore", + value: "Explore", defaultStyle: false, }, { @@ -36,7 +36,7 @@ const sidebarsUnversionedConfig: SidebarConfig = { // ── API ────────────────────────────────────────────────────────────── { type: "html", - value: "
API", + value: "
API", defaultStyle: false, }, { @@ -73,7 +73,7 @@ const sidebarsUnversionedConfig: SidebarConfig = { // ── TECHNICAL DOC ───────────────────────────────────────────────────── { type: "html", - value: "
Technical Doc", + value: "
Technical Doc", defaultStyle: false, }, { diff --git a/crowdsec-docs/src/components/cti-integration-tile.tsx b/crowdsec-docs/src/components/cti-integration-tile.tsx index 5db9aa54b..6b336a18f 100644 --- a/crowdsec-docs/src/components/cti-integration-tile.tsx +++ b/crowdsec-docs/src/components/cti-integration-tile.tsx @@ -99,7 +99,7 @@ export default function CtiIntegrationTile({ name, slug, href, plugin, desc, col ( fontSize: "9.5px", letterSpacing: "1.2px", textTransform: "uppercase" as const, - color: "var(--ifm-color-emphasis-400)", + color: "var(--ifm-color-emphasis-600)", }} > Quick access @@ -294,7 +294,7 @@ export const CTIContent = () => ( fontSize: "10.5px", letterSpacing: "1.5px", textTransform: "uppercase" as const, - color: "var(--ifm-color-emphasis-500)", + color: "var(--ifm-color-emphasis-600)", marginBottom: "12px", }} > @@ -316,7 +316,7 @@ export const CTIContent = () => ( display: "flex", alignItems: "center", gap: "16px", - color: "var(--ifm-color-emphasis-400)", + color: "var(--ifm-color-emphasis-600)", fontSize: "11px", fontFamily: "var(--ifm-font-family-monospace)", letterSpacing: "1px", diff --git a/crowdsec-docs/src/pages/index.tsx b/crowdsec-docs/src/pages/index.tsx index 716d7e511..3f8ff46f3 100644 --- a/crowdsec-docs/src/pages/index.tsx +++ b/crowdsec-docs/src/pages/index.tsx @@ -98,7 +98,7 @@ const IntentCard = ({ icon, title, desc, pill, accent, href, aka }: IntentCardPr fontSize: "8px", letterSpacing: "0.8px", textTransform: "uppercase", - color: "var(--ifm-color-emphasis-400)", + color: "var(--ifm-color-emphasis-600)", flexShrink: 0, }} > @@ -110,7 +110,7 @@ const IntentCard = ({ icon, title, desc, pill, accent, href, aka }: IntentCardPr style={{ fontFamily: "var(--ifm-font-family-monospace)", fontSize: "8px", - color: "var(--ifm-color-emphasis-400)", + color: "var(--ifm-color-emphasis-600)", padding: "1px 7px", borderRadius: "4px", border: "1px solid var(--ifm-color-emphasis-200)", @@ -244,7 +244,7 @@ const SchemaBlock = ({ id, color, eyebrowIcon, eyebrow, title, ctaLabel, ctaHref @@ -302,7 +302,7 @@ const SchemaBlock = ({ id, color, eyebrowIcon, eyebrow, title, ctaLabel, ctaHref fontSize: "9px", letterSpacing: "0.8px", textTransform: "uppercase", - color: "var(--ifm-color-emphasis-400)", + color: "var(--ifm-color-emphasis-600)", marginBottom: "4px", }} > @@ -538,7 +538,7 @@ const HomePage = () => { fontSize: "10.5px", letterSpacing: "1.5px", textTransform: "uppercase", - color: "var(--ifm-color-emphasis-500)", + color: "var(--ifm-color-emphasis-600)", marginBottom: "12px", }} > @@ -570,7 +570,7 @@ const HomePage = () => { fontSize: "10px", letterSpacing: "0.8px", textTransform: "uppercase", - color: "var(--ifm-color-emphasis-500)", + color: "var(--ifm-color-emphasis-600)", whiteSpace: "nowrap", flexShrink: 0, }} @@ -618,7 +618,7 @@ const HomePage = () => { display: "flex", alignItems: "center", gap: "16px", - color: "var(--ifm-color-emphasis-400)", + color: "var(--ifm-color-emphasis-600)", fontSize: "11px", fontFamily: "var(--ifm-font-family-monospace)", letterSpacing: "1px", @@ -687,7 +687,7 @@ const HomePage = () => { fontSize: "10.5px", letterSpacing: "1.5px", textTransform: "uppercase", - color: "var(--ifm-color-emphasis-500)", + color: "var(--ifm-color-emphasis-600)", marginBottom: "12px", }} > diff --git a/crowdsec-docs/unversioned/console/ip_reputation/api_keys.mdx b/crowdsec-docs/unversioned/console/ip_reputation/api_keys.mdx index a131e0a41..d4b4389f8 100644 --- a/crowdsec-docs/unversioned/console/ip_reputation/api_keys.mdx +++ b/crowdsec-docs/unversioned/console/ip_reputation/api_keys.mdx @@ -31,12 +31,12 @@ export const PremiumBadge = () => ( {" — "} {quota} {" · "} - {desc} + {desc} {label.includes("Premium") && }
))}
-
+
API quotas are separate from Web UI quotas. Unused quota does not roll over.
diff --git a/crowdsec-docs/unversioned/cti_api/intro.mdx b/crowdsec-docs/unversioned/cti_api/intro.mdx index e835bdfb3..0fad953ea 100644 --- a/crowdsec-docs/unversioned/cti_api/intro.mdx +++ b/crowdsec-docs/unversioned/cti_api/intro.mdx @@ -78,7 +78,7 @@ export const GREEN = "#22d3a0";
Why CrowdSec CTI
-

+

Most IP reputation services tell you an IP is "bad." CrowdSec tells you what it was doing — from real deployments, not honeypots.

@@ -123,11 +123,11 @@ export const GREEN = "#22d3a0"; {" — "} {quota} {" · "} - {desc} + {desc}
))}
-
+
API quotas are separate from Web UI quotas. Unused quota does not roll over.
From 8ac010d096b7ff8052ae1d4bd4b2304dc9b2ac42 Mon Sep 17 00:00:00 2001 From: jdv Date: Tue, 5 May 2026 11:22:45 +0200 Subject: [PATCH 23/26] console menu improve & unify --- crowdsec-docs/sidebarsUnversioned.ts | 168 +++++++++--------- .../theme/DocSidebarItem/Category/index.tsx | 2 +- 2 files changed, 82 insertions(+), 88 deletions(-) diff --git a/crowdsec-docs/sidebarsUnversioned.ts b/crowdsec-docs/sidebarsUnversioned.ts index 0150a8bca..a1d8fcebf 100644 --- a/crowdsec-docs/sidebarsUnversioned.ts +++ b/crowdsec-docs/sidebarsUnversioned.ts @@ -226,6 +226,12 @@ const sidebarsUnversionedConfig: SidebarConfig = { value: "
", defaultStyle: false, }, + // ── Security Stack ────────────────────────────────────────────────────────── + { + type: "html", + value: "Security Stack", + defaultStyle: false, + }, { type: "category", label: "Security Engine", @@ -373,10 +379,19 @@ const sidebarsUnversionedConfig: SidebarConfig = { value: "
", defaultStyle: false, }, + // ── Blocklist & Allowlists ────────────────────────────────────────────────────────── + { + type: "html", + value: "Blocklist & Allowlists", + defaultStyle: false, + }, { label: "Blocklists", type: "doc", id: "blocklists/intro", + customProps: { + tag: "otherSection", + }, }, { id: "console/allowlists", @@ -399,72 +414,73 @@ const sidebarsUnversionedConfig: SidebarConfig = { value: "
", defaultStyle: false, }, + // ── IP Reputation / CTI ────────────────────────────────────────────────────────── + { + type: "html", + value: "IP Reputation / CTI", + defaultStyle: false, + }, + { + id: "console/ip_reputation/intro", + type: "doc", + label: "Web UI Overview", + }, { type: "category", - label: "IP Reputation / CTI", + label: "Search UI", link: { type: "doc", - id: "console/ip_reputation/intro", + id: "console/ip_reputation/search_ui", }, items: [ { - type: "category", - label: "Search UI", - link: { - type: "doc", - id: "console/ip_reputation/search_ui", + type: "doc", + label: "Advanced Search", + id: "console/ip_reputation/search_ui_advanced", + }, + { + type: "doc", + label: "IP Reputation Report", + id: "console/ip_reputation/ip_report", + }, + { + type: "link", + label: "Search Queries Syntax", + href: "/u/cti_api/search_queries", + customProps: { + tag: "otherSection", }, - items: [ - { - type: "doc", - label: "Advanced Search", - id: "console/ip_reputation/search_ui_advanced", - }, - { - type: "doc", - label: "IP Reputation Report", - id: "console/ip_reputation/ip_report", - }, - { - type: "link", - label: "Search Queries Syntax", - href: "/u/cti_api/search_queries", - customProps: { - tag: "otherSection", - }, - }, - { - type: "doc", - label: "IP Reputation Report", - id: "console/ip_reputation/ip_report", - }, - ], }, { - type: "category", - label: "API Keys", - link: { - type: "doc", - id: "console/ip_reputation/api_keys", + type: "doc", + label: "IP Reputation Report", + id: "console/ip_reputation/ip_report", + }, + ], + }, + { + type: "category", + label: "API Keys", + link: { + type: "doc", + id: "console/ip_reputation/api_keys", + }, + items: [ + { + type: "link", + label: "CTI API Integrations", + href: "/u/cti_api/api_integration/integration_intro", + customProps: { + tag: "otherSection", + }, + }, + { + type: "link", + label: "Enrichment Fields Ref", + href: "/u/cti_api/taxonomy/intro", + customProps: { + tag: "otherSection", }, - items: [ - { - type: "link", - label: "CTI API Integrations", - href: "/u/cti_api/api_integration/integration_intro", - customProps: { - tag: "otherSection", - }, - }, - { - type: "link", - label: "Enrichment Fields Ref", - href: "/u/cti_api/taxonomy/intro", - customProps: { - tag: "otherSection", - }, - }, - ], }, ], }, @@ -473,28 +489,22 @@ const sidebarsUnversionedConfig: SidebarConfig = { value: "
", defaultStyle: false, }, + // ── Other ────────────────────────────────────────────────────────── { type: "category", - label: "Notification integrations", + label: "Notifications", + link: { + type: "doc", + id: "console/notification_integrations/overview", + }, customProps: { tag: "premium", }, items: [ - { - type: "doc", - label: "Overview", - id: "console/notification_integrations/overview", - customProps: { - tag: "premium", - }, - }, { type: "doc", label: "Notification Rule", id: "console/notification_integrations/rule", - customProps: { - tag: "premium", - }, }, { type: "doc", @@ -517,24 +527,17 @@ const sidebarsUnversionedConfig: SidebarConfig = { { type: "category", label: "Service API", + link: { + type: "doc", + id: "console/service_api/getting_started", + }, customProps: { tag: "premium", }, items: [ - { - type: "doc", - id: "console/service_api/getting_started", - label: "Getting Started", - customProps: { - tag: "premium", - }, - }, { type: "category", label: "Quickstart", - customProps: { - tag: "premium", - }, items: [ "console/service_api/quickstart/authentication", "console/service_api/quickstart/blocklists", @@ -556,17 +559,11 @@ const sidebarsUnversionedConfig: SidebarConfig = { { type: "category", label: "SDKs", - customProps: { - tag: "premium", - }, items: [ { type: "doc", label: "Python", id: "console/service_api/sdks/python", - customProps: { - tag: "premium", - }, }, ], }, @@ -584,9 +581,6 @@ const sidebarsUnversionedConfig: SidebarConfig = { type: "doc", id: "console/service_api/faq", label: "FAQ", - customProps: { - tag: "premium", - }, }, ], }, diff --git a/crowdsec-docs/src/theme/DocSidebarItem/Category/index.tsx b/crowdsec-docs/src/theme/DocSidebarItem/Category/index.tsx index 5ad37769c..42f6e7de1 100644 --- a/crowdsec-docs/src/theme/DocSidebarItem/Category/index.tsx +++ b/crowdsec-docs/src/theme/DocSidebarItem/Category/index.tsx @@ -195,7 +195,7 @@ export default function DocSidebarItemCategory({ {...props} > {label} - {!collapsible && isPremium && ( + {isPremium && ( Premium From e3f5a115106cae7d6da24d03439239738cb0981d Mon Sep 17 00:00:00 2001 From: jdv Date: Tue, 5 May 2026 14:13:34 +0200 Subject: [PATCH 24/26] fixing dead links --- CURRENT_HIERARCHY.json | 810 ------------------ crowdsec-docs/src/pages/index.tsx | 4 +- .../unversioned/integrations/intro.mdx | 6 +- 3 files changed, 5 insertions(+), 815 deletions(-) delete mode 100644 CURRENT_HIERARCHY.json diff --git a/CURRENT_HIERARCHY.json b/CURRENT_HIERARCHY.json deleted file mode 100644 index 6ae7e82c5..000000000 --- a/CURRENT_HIERARCHY.json +++ /dev/null @@ -1,810 +0,0 @@ -{ - "name": "CrowdSec Documentation", - "type": "Root", - "short_description": "CrowdSec documentation site root — multi-product security platform docs", - "children": [ - { - "name": "Homepage", - "type": "presentation", - "path": "/", - "file_path": "crowdsec-docs/src/pages/index.tsx", - "short_description": "Documentation homepage with 3 product cards: Security Engine, Blocklists, CTI", - "children": [] - }, - { - "name": "Security Engine", - "type": "presentation", - "path": "/security-engine", - "file_path": "crowdsec-docs/src/pages/security-engine.tsx", - "short_description": "Product landing page — detect and block malicious behavior, analyzes logs, shares intelligence, powers AppSec protection", - "children": [] - }, - { - "name": "Blocklists", - "type": "presentation", - "path": "/blocklists", - "file_path": "crowdsec-docs/src/pages/blocklists.tsx", - "short_description": "Product landing page — subscribe to curated threat intelligence feeds, deploy in minutes to firewalls", - "children": [] - }, - { - "name": "CTI", - "type": "presentation", - "path": "/cti", - "file_path": "crowdsec-docs/src/pages/cti.tsx", - "short_description": "Product landing page — query CrowdSec threat intelligence to enrich investigations, get IP reputation data", - "children": [] - }, - { - "name": "Security Stack", - "type": "NavBarItem", - "short_description": "Navbar dropdown grouping all technical stack components", - "children": [ - { - "name": "Security Engine", - "type": "NavBarItem", - "links_to": "/docs/next/intro", - "short_description": "Entry point into the versioned Security Engine technical docs", - "children": [ - { - "name": "Introduction", - "type": "presentation", - "path": "/docs/next/intro", - "file_path": "crowdsec-docs/docs/intro.md", - "short_description": "What is the CrowdSec Security Engine — open-source lightweight security engine overview", - "children": [] - }, - { - "name": "Concepts", - "type": "presentation", - "path": "/docs/next/concepts", - "file_path": "crowdsec-docs/docs/concepts.md", - "short_description": "Core CrowdSec concepts and how components interact", - "children": [] - }, - { - "name": "Log Processor", - "type": "NavBarItem", - "short_description": "Core component that reads logs and detects attacks", - "children": [ - { - "name": "Introduction", - "type": "presentation", - "path": "/docs/next/log_processor/intro", - "file_path": "crowdsec-docs/docs/log_processor/intro.md", - "short_description": "Introduction to the Log Processor component", - "children": [] - }, - { - "name": "Data Sources", - "type": "NavBarItem", - "short_description": "Log acquisition datasources supported by the Security Engine", - "children": [ - { - "name": "Introduction", - "type": "presentation", - "path": "/docs/next/log_processor/data_sources/intro", - "file_path": "crowdsec-docs/docs/log_processor/data_sources/intro.md", - "short_description": "Overview of acquisition datasources", - "children": [] - }, - { "name": "AppSec", "type": "technical doc", "path": "/docs/next/log_processor/data_sources/appsec", "file_path": "crowdsec-docs/docs/log_processor/data_sources/appsec.md", "short_description": "Application Security Component data source", "children": [] }, - { "name": "AWS CloudWatch", "type": "technical doc", "path": "/docs/next/log_processor/data_sources/cloudwatch", "file_path": "crowdsec-docs/docs/log_processor/data_sources/cloudwatch.md", "short_description": "AWS CloudWatch log acquisition", "children": [] }, - { "name": "AWS Kinesis", "type": "technical doc", "path": "/docs/next/log_processor/data_sources/kinesis", "file_path": "crowdsec-docs/docs/log_processor/data_sources/kinesis.md", "short_description": "AWS Kinesis stream log acquisition", "children": [] }, - { "name": "AWS S3", "type": "technical doc", "path": "/docs/next/log_processor/data_sources/s3", "file_path": "crowdsec-docs/docs/log_processor/data_sources/s3.md", "short_description": "S3 bucket log acquisition", "children": [] }, - { "name": "Docker", "type": "technical doc", "path": "/docs/next/log_processor/data_sources/docker", "file_path": "crowdsec-docs/docs/log_processor/data_sources/docker.md", "short_description": "Docker container log acquisition", "children": [] }, - { "name": "File(s)", "type": "technical doc", "path": "/docs/next/log_processor/data_sources/file", "file_path": "crowdsec-docs/docs/log_processor/data_sources/file.md", "short_description": "Text and GZ file log acquisition", "children": [] }, - { "name": "HTTP", "type": "technical doc", "path": "/docs/next/log_processor/data_sources/http", "file_path": "crowdsec-docs/docs/log_processor/data_sources/http.md", "short_description": "HTTP endpoint log acquisition", "children": [] }, - { "name": "Journald", "type": "technical doc", "path": "/docs/next/log_processor/data_sources/journald", "file_path": "crowdsec-docs/docs/log_processor/data_sources/journald.md", "short_description": "Journalctl log acquisition", "children": [] }, - { "name": "Kafka", "type": "technical doc", "path": "/docs/next/log_processor/data_sources/kafka", "file_path": "crowdsec-docs/docs/log_processor/data_sources/kafka.md", "short_description": "Kafka topic log acquisition", "children": [] }, - { "name": "Kubernetes Audit", "type": "technical doc", "path": "/docs/next/log_processor/data_sources/kubernetes_audit", "file_path": "crowdsec-docs/docs/log_processor/data_sources/kubernetes_audit.md", "short_description": "Kubernetes audit log acquisition", "children": [] }, - { "name": "Loki", "type": "technical doc", "path": "/docs/next/log_processor/data_sources/loki", "file_path": "crowdsec-docs/docs/log_processor/data_sources/loki.md", "short_description": "Loki query log acquisition", "children": [] }, - { "name": "VictoriaLogs", "type": "technical doc", "path": "/docs/next/log_processor/data_sources/victorialogs", "file_path": "crowdsec-docs/docs/log_processor/data_sources/victorialogs.md", "short_description": "VictoriaLogs query acquisition", "children": [] }, - { "name": "Syslog", "type": "technical doc", "path": "/docs/next/log_processor/data_sources/syslog", "file_path": "crowdsec-docs/docs/log_processor/data_sources/syslog.md", "short_description": "Syslog server log acquisition", "children": [] }, - { "name": "Windows Event Log", "type": "technical doc", "path": "/docs/next/log_processor/data_sources/windows_evt_log", "file_path": "crowdsec-docs/docs/log_processor/data_sources/windows_evt_log.md", "short_description": "Windows Event Log acquisition", "children": [] }, - { "name": "Monitoring", "type": "technical doc", "path": "/docs/next/log_processor/data_sources/troubleshoot", "file_path": "crowdsec-docs/docs/log_processor/data_sources/troubleshoot.md", "short_description": "Prometheus metrics for acquisition monitoring", "children": [] } - ] - }, - { - "name": "Parsers", - "type": "NavBarItem", - "short_description": "YAML-based log parsing configurations", - "children": [ - { "name": "Introduction", "type": "presentation", "path": "/docs/next/log_processor/parsers/intro", "file_path": "crowdsec-docs/docs/log_processor/parsers/intro.md", "short_description": "What a parser is and how it works", "children": [] }, - { "name": "Format", "type": "technical doc", "path": "/docs/next/log_processor/parsers/format", "file_path": "crowdsec-docs/docs/log_processor/parsers/format.md", "short_description": "Parser configuration file format reference", "children": [] }, - { "name": "Creating Parsers", "type": "guide", "path": "/docs/next/log_processor/parsers/create", "file_path": "crowdsec-docs/docs/log_processor/parsers/create.md", "short_description": "Step-by-step guide to writing a custom parser", "children": [] }, - { "name": "Enrichers", "type": "technical doc", "path": "/docs/next/log_processor/parsers/enricher", "file_path": "crowdsec-docs/docs/log_processor/parsers/enricher.md", "short_description": "Parsers that rely on external methods for extra context", "children": [] }, - { "name": "Default Patterns", "type": "reference", "path": "/docs/next/log_processor/parsers/patterns", "file_path": "crowdsec-docs/docs/log_processor/parsers/patterns.md", "short_description": "Auto-generated documentation of all default patterns", "children": [] } - ] - }, - { - "name": "Scenarios", - "type": "NavBarItem", - "short_description": "YAML files that detect specific attack behaviors", - "children": [ - { "name": "Introduction", "type": "presentation", "path": "/docs/next/log_processor/scenarios/intro", "file_path": "crowdsec-docs/docs/log_processor/scenarios/intro.md", "short_description": "What a scenario is and how it detects behaviors", "children": [] }, - { "name": "Format", "type": "technical doc", "path": "/docs/next/log_processor/scenarios/format", "file_path": "crowdsec-docs/docs/log_processor/scenarios/format.md", "short_description": "Scenario configuration file format reference", "children": [] }, - { "name": "Simulation", "type": "guide", "path": "/docs/next/log_processor/scenarios/simulation", "file_path": "crowdsec-docs/docs/log_processor/scenarios/simulation.md", "short_description": "Test scenarios in simulation mode without triggering real bans", "children": [] }, - { "name": "Creating Scenarios", "type": "guide", "path": "/docs/next/log_processor/scenarios/create", "file_path": "crowdsec-docs/docs/log_processor/scenarios/create.md", "short_description": "Step-by-step guide to writing a custom scenario", "children": [] }, - { "name": "Deploy", "type": "guide", "path": "/docs/next/log_processor/scenarios/deploy", "file_path": "crowdsec-docs/docs/log_processor/scenarios/deploy.md", "short_description": "Deploying custom scenarios to the engine", "children": [] } - ] - }, - { - "name": "Collections", - "type": "NavBarItem", - "short_description": "Bundles of detection content installed together", - "children": [ - { "name": "Introduction", "type": "presentation", "path": "/docs/next/log_processor/collections/intro", "file_path": "crowdsec-docs/docs/log_processor/collections/intro.md", "short_description": "What collections are and how to use them", "children": [] }, - { "name": "Format", "type": "technical doc", "path": "/docs/next/log_processor/collections/format", "file_path": "crowdsec-docs/docs/log_processor/collections/format.md", "short_description": "Collection configuration file format", "children": [] } - ] - }, - { - "name": "Whitelists", - "type": "NavBarItem", - "short_description": "Rules to exclude trusted IPs or events from detection", - "children": [ - { "name": "Introduction", "type": "presentation", "path": "/docs/next/log_processor/whitelist/intro", "file_path": "crowdsec-docs/docs/log_processor/whitelist/intro.md", "short_description": "Overview of whitelist types and usage", "children": [] }, - { "name": "Format", "type": "technical doc", "path": "/docs/next/log_processor/whitelist/format", "file_path": "crowdsec-docs/docs/log_processor/whitelist/format.md", "short_description": "Whitelist configuration format", "children": [] }, - { "name": "IP / CIDR Whitelist", "type": "guide", "path": "/docs/next/log_processor/whitelist/create_ip", "file_path": "crowdsec-docs/docs/log_processor/whitelist/create_ip.md", "short_description": "Creating IP or CIDR-based whitelists", "children": [] }, - { "name": "Expression Whitelist", "type": "guide", "path": "/docs/next/log_processor/whitelist/create_expr", "file_path": "crowdsec-docs/docs/log_processor/whitelist/create_expr.md", "short_description": "Creating expression-based whitelists", "children": [] }, - { "name": "Postoverflow Whitelist", "type": "guide", "path": "/docs/next/log_processor/whitelist/create_postoverflow", "file_path": "crowdsec-docs/docs/log_processor/whitelist/create_postoverflow.md", "short_description": "Whitelisting at postoverflow stage", "children": [] }, - { "name": "FQDN Whitelist", "type": "guide", "path": "/docs/next/log_processor/whitelist/create_fqdn", "file_path": "crowdsec-docs/docs/log_processor/whitelist/create_fqdn.md", "short_description": "Whitelisting by fully qualified domain name", "children": [] }, - { "name": "CAPI Whitelist (deprecated)", "type": "guide", "path": "/docs/next/log_processor/whitelist/create_capi", "file_path": "crowdsec-docs/docs/log_processor/whitelist/create_capi.md", "short_description": "Deprecated CAPI-based whitelist", "children": [] } - ] - }, - { - "name": "Service Discovery", - "type": "NavBarItem", - "short_description": "Auto-detect running services and configure acquisitions", - "children": [ - { "name": "Introduction", "type": "presentation", "path": "/docs/next/log_processor/service-discovery-setup/intro", "file_path": "crowdsec-docs/docs/log_processor/service-discovery-setup/intro.md", "short_description": "Overview of automatic service discovery setup", "children": [] }, - { "name": "Detect YAML Syntax", "type": "technical doc", "path": "/docs/next/log_processor/service-discovery-setup/detect-yaml", "file_path": "crowdsec-docs/docs/log_processor/service-discovery-setup/detect-yaml.md", "short_description": "YAML syntax for service discovery definitions", "children": [] }, - { "name": "Expr Helpers", "type": "technical doc", "path": "/docs/next/log_processor/service-discovery-setup/setup-expr-helpers", "file_path": "crowdsec-docs/docs/log_processor/service-discovery-setup/setup-expr-helpers.md", "short_description": "Expr helpers available during service discovery", "children": [] } - ] - }, - { - "name": "Alert Context", - "type": "guide", - "path": "/docs/next/log_processor/alert_context/intro", - "file_path": "crowdsec-docs/docs/log_processor/alert_context/intro.md", - "short_description": "Attach contextual data to alerts during log processing", - "children": [] - } - ] - }, - { - "name": "Local API", - "type": "NavBarItem", - "short_description": "Core component connecting the engine to bouncers and the Central API", - "children": [ - { - "name": "Introduction", - "type": "presentation", - "path": "/docs/next/local_api/intro", - "file_path": "crowdsec-docs/docs/local_api/intro.md", - "short_description": "Role of the Local API in the CrowdSec architecture", - "children": [] - }, - { - "name": "Profiles", - "type": "NavBarItem", - "short_description": "Define which remediation decisions to apply when a scenario fires", - "children": [ - { "name": "Introduction", "type": "presentation", "path": "/docs/next/local_api/profiles/intro", "file_path": "crowdsec-docs/docs/local_api/profiles/intro.md", "short_description": "Overview of profiles and their role in remediation decisions", "children": [] }, - { "name": "Format", "type": "technical doc", "path": "/docs/next/local_api/profiles/format", "file_path": "crowdsec-docs/docs/local_api/profiles/format.md", "short_description": "Profile YAML configuration format", "children": [] }, - { "name": "CTI Profile Example", "type": "guide", "path": "/docs/next/local_api/profiles/cti_profile", "file_path": "crowdsec-docs/docs/local_api/profiles/cti_profile.md", "short_description": "Profile that uses CTI data to make remediation decisions", "children": [] }, - { "name": "Captcha Profile Example", "type": "guide", "path": "/docs/next/local_api/profiles/captcha_profile", "file_path": "crowdsec-docs/docs/local_api/profiles/captcha_profile.md", "short_description": "Profile that serves a captcha challenge", "children": [] }, - { "name": "PID Profile Example", "type": "guide", "path": "/docs/next/local_api/profiles/pid_profile", "file_path": "crowdsec-docs/docs/local_api/profiles/pid_profile.md", "short_description": "Profile using PID-based decision logic", "children": [] } - ] - }, - { - "name": "Notification Plugins", - "type": "NavBarItem", - "short_description": "Push alerts to third-party services via notification plugins", - "children": [ - { "name": "Introduction", "type": "presentation", "path": "/docs/next/local_api/notification_plugins/intro", "file_path": "crowdsec-docs/docs/local_api/notification_plugins/intro.md", "short_description": "Overview of notification plugins and how they work", "children": [] }, - { "name": "HTTP Plugin", "type": "feature page", "path": "/docs/next/local_api/notification_plugins/http", "file_path": "crowdsec-docs/docs/local_api/notification_plugins/http.md", "short_description": "HTTP-based notification plugin", "children": [] }, - { "name": "Email Plugin", "type": "feature page", "path": "/docs/next/local_api/notification_plugins/email", "file_path": "crowdsec-docs/docs/local_api/notification_plugins/email.md", "short_description": "Send alerts via email", "children": [] }, - { "name": "Slack Plugin", "type": "feature page", "path": "/docs/next/local_api/notification_plugins/slack", "file_path": "crowdsec-docs/docs/local_api/notification_plugins/slack.md", "short_description": "Send alerts to Slack", "children": [] }, - { "name": "Splunk Plugin", "type": "feature page", "path": "/docs/next/local_api/notification_plugins/splunk", "file_path": "crowdsec-docs/docs/local_api/notification_plugins/splunk.md", "short_description": "Send alerts to Splunk", "children": [] }, - { "name": "File Plugin", "type": "feature page", "path": "/docs/next/local_api/notification_plugins/file", "file_path": "crowdsec-docs/docs/local_api/notification_plugins/file.md", "short_description": "Write alerts to an external file", "children": [] }, - { "name": "Sentinel Plugin", "type": "feature page", "path": "/docs/next/local_api/notification_plugins/sentinel", "file_path": "crowdsec-docs/docs/local_api/notification_plugins/sentinel.md", "short_description": "Send alerts to Microsoft Sentinel", "children": [] }, - { "name": "Microsoft Teams", "type": "feature page", "path": "/docs/next/local_api/notification_plugins/teams", "file_path": "crowdsec-docs/docs/local_api/notification_plugins/teams.md", "short_description": "Send alerts to Microsoft Teams via HTTP plugin", "children": [] }, - { "name": "Elasticsearch Plugin", "type": "feature page", "path": "/docs/next/local_api/notification_plugins/elastic", "file_path": "crowdsec-docs/docs/local_api/notification_plugins/elastic.md", "short_description": "Send alerts to Elasticsearch", "children": [] }, - { "name": "Telegram Plugin", "type": "feature page", "path": "/docs/next/local_api/notification_plugins/telegram", "file_path": "crowdsec-docs/docs/local_api/notification_plugins/telegram.md", "short_description": "Send alerts to Telegram", "children": [] }, - { "name": "Gotify Plugin", "type": "feature page", "path": "/docs/next/local_api/notification_plugins/gotify", "file_path": "crowdsec-docs/docs/local_api/notification_plugins/gotify.md", "short_description": "Send alerts to Gotify", "children": [] }, - { "name": "Template Helpers", "type": "technical doc", "path": "/docs/next/local_api/notification_plugins/template_helpers", "file_path": "crowdsec-docs/docs/local_api/notification_plugins/template_helpers.md", "short_description": "Custom helpers for notification templates", "children": [] }, - { "name": "Writing Your Own Plugin (Go)", "type": "guide", "path": "/docs/next/local_api/notification_plugins/writing_your_own_plugin", "file_path": "crowdsec-docs/docs/local_api/notification_plugins/writing_your_own_plugin.md", "short_description": "Implement a custom notification plugin in Go", "children": [] }, - { "name": "Testing Notification Plugins", "type": "guide", "path": "/docs/next/local_api/notification_plugins/testing", "file_path": "crowdsec-docs/docs/local_api/notification_plugins/testing.md", "short_description": "Validate notification plugins from config to end-to-end delivery", "children": [] } - ] - }, - { "name": "Databases", "type": "technical doc", "path": "/docs/next/local_api/database", "file_path": "crowdsec-docs/docs/local_api/database.md", "short_description": "Backend database support (SQLite default)", "children": [] }, - { "name": "For Remediation Components", "type": "technical doc", "path": "/docs/next/local_api/bouncers", "file_path": "crowdsec-docs/docs/local_api/bouncers.md", "short_description": "How bouncers interact with the Local API", "children": [] }, - { "name": "Configuration", "type": "technical doc", "path": "/docs/next/local_api/configuration", "file_path": "crowdsec-docs/docs/local_api/configuration.md", "short_description": "LAPI configuration options", "children": [] }, - { "name": "Authentication", "type": "technical doc", "path": "/docs/next/local_api/authentication", "file_path": "crowdsec-docs/docs/local_api/authentication.md", "short_description": "Three authentication modes for the Local API", "children": [] }, - { "name": "TLS Authentication", "type": "technical doc", "path": "/docs/next/local_api/tls_auth", "file_path": "crowdsec-docs/docs/local_api/tls_auth.md", "short_description": "TLS client authentication for the LAPI", "children": [] }, - { "name": "Centralized Allowlists", "type": "feature page", "path": "/docs/next/local_api/centralized_allowlists", "file_path": "crowdsec-docs/docs/local_api/centralized_allowlists.md", "short_description": "Manage IP-based allowlists at the LAPI level", "children": [] } - ] - }, - { - "name": "Central API", - "type": "NavBarItem", - "short_description": "CrowdSec's cloud-based community intelligence sharing layer", - "children": [ - { "name": "Introduction", "type": "presentation", "path": "/docs/next/central_api/intro", "file_path": "crowdsec-docs/docs/central_api/intro.md", "short_description": "Overview of the Central API and its role", "children": [] }, - { "name": "Community Blocklist", "type": "feature page", "path": "/docs/next/central_api/community_blocklist", "file_path": "crowdsec-docs/docs/central_api/community_blocklist.md", "short_description": "Curated list of IPs identified as malicious by the CrowdSec community", "children": [] } - ] - }, - { - "name": "Configuration", - "type": "NavBarItem", - "short_description": "Global configuration options for CrowdSec", - "children": [ - { "name": "CrowdSec Configuration", "type": "technical doc", "path": "/docs/next/configuration/crowdsec_configuration", "file_path": "crowdsec-docs/docs/configuration/crowdsec_configuration.md", "short_description": "Main YAML config file reference (/etc/crowdsec/config.yaml)", "children": [] }, - { "name": "Feature Flags", "type": "technical doc", "path": "/docs/next/configuration/feature_flags", "file_path": "crowdsec-docs/docs/configuration/feature_flags.md", "short_description": "Experimental feature flags for testing new capabilities", "children": [] }, - { "name": "Network Management", "type": "technical doc", "path": "/docs/next/configuration/network_management", "file_path": "crowdsec-docs/docs/configuration/network_management.md", "short_description": "TCP/8080 REST API networking configuration", "children": [] }, - { "name": "Helm Parameters", "type": "technical doc", "path": "/docs/next/configuration/values_parameters", "file_path": "crowdsec-docs/docs/configuration/values_parameters.md", "short_description": "Helm chart values parameters reference", "children": [] } - ] - }, - { - "name": "Observability", - "type": "NavBarItem", - "short_description": "Monitoring and metrics for the Security Engine", - "children": [ - { "name": "Introduction", "type": "presentation", "path": "/docs/next/observability/intro", "file_path": "crowdsec-docs/docs/observability/intro.md", "short_description": "Why observability matters in security software", "children": [] }, - { "name": "cscli Metrics", "type": "guide", "path": "/docs/next/observability/cscli", "file_path": "crowdsec-docs/docs/observability/cscli.md", "short_description": "View Prometheus metrics via cscli commands", "children": [] }, - { "name": "Prometheus", "type": "technical doc", "path": "/docs/next/observability/prometheus", "file_path": "crowdsec-docs/docs/observability/prometheus.md", "short_description": "Prometheus scrape endpoint for metrics collection", "children": [] }, - { "name": "Usage Metrics", "type": "technical doc", "path": "/docs/next/observability/usage_metrics", "file_path": "crowdsec-docs/docs/observability/usage_metrics.md", "short_description": "Usage metrics collection (requires CrowdSec v1.6.3+)", "children": [] }, - { "name": "Pprof", "type": "technical doc", "path": "/docs/next/observability/pprof", "file_path": "crowdsec-docs/docs/observability/pprof.md", "short_description": "Go profiling endpoint for debugging performance", "children": [] } - ] - }, - { - "name": "Expr (Expression Engine)", - "type": "NavBarItem", - "short_description": "Expression language used in parsers, scenarios, and profiles", - "children": [ - { "name": "Introduction", "type": "presentation", "path": "/docs/next/expr/intro", "file_path": "crowdsec-docs/docs/expr/intro.md", "short_description": "Overview of the Go expression evaluation engine", "children": [] }, - { "name": "Strings Helpers", "type": "reference", "path": "/docs/next/expr/strings_helpers", "file_path": "crowdsec-docs/docs/expr/strings_helpers.md", "short_description": "String manipulation helper functions", "children": [] }, - { "name": "File Helpers", "type": "reference", "path": "/docs/next/expr/file_helpers", "file_path": "crowdsec-docs/docs/expr/file_helpers.md", "short_description": "File I/O helpers (cached on startup)", "children": [] }, - { "name": "IP Helpers", "type": "reference", "path": "/docs/next/expr/ip_helpers", "file_path": "crowdsec-docs/docs/expr/ip_helpers.md", "short_description": "IP/CIDR helper functions", "children": [] }, - { "name": "JSON/XML/KV Helpers", "type": "reference", "path": "/docs/next/expr/json_helpers", "file_path": "crowdsec-docs/docs/expr/json_helpers.md", "short_description": "JSON/XML/key-value parsing helpers", "children": [] }, - { "name": "CTI Helpers", "type": "reference", "path": "/docs/next/expr/cti_helpers", "file_path": "crowdsec-docs/docs/expr/cti_helpers.md", "short_description": "Query the CTI API from inside expressions", "children": [] }, - { "name": "LibInjection Helpers", "type": "reference", "path": "/docs/next/expr/libinjection_helpers", "file_path": "crowdsec-docs/docs/expr/libinjection_helpers.md", "short_description": "SQL injection detection helpers", "children": [] }, - { "name": "Other Helpers", "type": "reference", "path": "/docs/next/expr/other_helpers", "file_path": "crowdsec-docs/docs/expr/other_helpers.md", "short_description": "Time formatting and miscellaneous helpers", "children": [] }, - { "name": "Alert Object", "type": "reference", "path": "/docs/next/expr/alert", "file_path": "crowdsec-docs/docs/expr/alert.md", "short_description": "Runtime representation of a bucket overflow (alert)", "children": [] }, - { "name": "Decision Object", "type": "reference", "path": "/docs/next/expr/decision", "file_path": "crowdsec-docs/docs/expr/decision.md", "short_description": "Runtime representation of a remediation decision", "children": [] }, - { "name": "Event Object", "type": "reference", "path": "/docs/next/expr/event", "file_path": "crowdsec-docs/docs/expr/event.md", "short_description": "Runtime representation of a processed log event", "children": [] } - ] - }, - { - "name": "Contributing", - "type": "NavBarItem", - "short_description": "Guides for contributing to CrowdSec ecosystem", - "children": [ - { "name": "Getting Started", "type": "guide", "path": "/docs/next/contributing/getting_started", "file_path": "crowdsec-docs/docs/contributing/getting_started.md", "short_description": "How to start contributing to CrowdSec", "children": [] }, - { "name": "Documentation", "type": "guide", "path": "/docs/next/contributing/contributing_doc", "file_path": "crowdsec-docs/docs/contributing/contributing_doc.md", "short_description": "How to write docs in Markdown with Docusaurus", "children": [] }, - { "name": "Hub (Parsers/Scenarios/Rules)", "type": "guide", "path": "/docs/next/contributing/contributing_hub", "file_path": "crowdsec-docs/docs/contributing/contributing_hub.md", "short_description": "Contributing parsers, scenarios, collections, and WAF rules to the Hub", "children": [] }, - { "name": "Remediation Components", "type": "guide", "path": "/docs/next/contributing/contributing_bouncers", "file_path": "crowdsec-docs/docs/contributing/contributing_bouncers.md", "short_description": "Publishing a new remediation component", "children": [] }, - { "name": "Bouncer & AppSec Specs", "type": "technical doc", "path": "/docs/next/contributing/specs/bouncer_appsec_specs", "file_path": "crowdsec-docs/docs/contributing/specs/bouncer_appsec_specs.md", "short_description": "Specification for remediation component and AppSec capabilities", "children": [] }, - { "name": "Remediation Metrics Specs", "type": "technical doc", "path": "/docs/next/contributing/specs/bouncer_metrics_specs", "file_path": "crowdsec-docs/docs/contributing/specs/bouncer_metrics_specs.md", "short_description": "Specification for implementing remediation metrics", "children": [] }, - { "name": "Test Environment", "type": "guide", "path": "/docs/next/contributing/contributing_test_env", "file_path": "crowdsec-docs/docs/contributing/contributing_test_env.md", "short_description": "Create a test environment for Linux development", "children": [] }, - { "name": "CrowdSec Core", "type": "guide", "path": "/docs/next/contributing/contributing_crowdsec", "file_path": "crowdsec-docs/docs/contributing/contributing_crowdsec.md", "short_description": "Report bugs or contribute to the core CrowdSec engine", "children": [] } - ] - }, - { - "name": "Contact the Team", - "type": "presentation", - "path": "/docs/next/contact_team", - "file_path": "crowdsec-docs/docs/contact_team.md", - "short_description": "Contact and support information", - "children": [] - } - ] - }, - { - "name": "Remediation Components", - "type": "NavBarItem", - "links_to": "/u/bouncers/intro", - "short_description": "Bouncers that enforce Security Engine decisions", - "children": [ - { - "name": "Introduction", - "type": "presentation", - "path": "/u/bouncers/intro", - "file_path": "crowdsec-docs/unversioned/bouncers/intro.md", - "short_description": "General presentation of what a remediation component (bouncer) is and how it connects to the Security Engine", - "children": [] - }, - { "name": "AWS WAF", "type": "feature page", "path": "/u/bouncers/aws_waf", "file_path": "crowdsec-docs/unversioned/bouncers/aws_waf.md", "short_description": "AWS WAF remediation component", "children": [] }, - { "name": "Apache", "type": "feature page", "path": "/u/bouncers/apache_bouncer", "file_path": "crowdsec-docs/unversioned/bouncers/apache_bouncer.md", "short_description": "Apache HTTP server remediation component", "children": [] }, - { "name": "Blocklist Mirror", "type": "feature page", "path": "/u/bouncers/blocklist-mirror", "file_path": "crowdsec-docs/unversioned/bouncers/blocklist-mirror.md", "short_description": "Expose decisions as a blocklist for external consumption", "children": [] }, - { "name": "Cloudflare", "type": "feature page", "path": "/u/bouncers/cloudflare", "file_path": "crowdsec-docs/unversioned/bouncers/cloudflare.md", "short_description": "Cloudflare firewall rules remediation component", "children": [] }, - { "name": "Cloudflare Workers", "type": "feature page", "path": "/u/bouncers/cloudflare-workers", "file_path": "crowdsec-docs/unversioned/bouncers/cloudflare-workers.md", "short_description": "Cloudflare Workers-based remediation", "children": [] }, - { "name": "Custom", "type": "feature page", "path": "/u/bouncers/custom", "file_path": "crowdsec-docs/unversioned/bouncers/custom.md", "short_description": "Custom remediation component for arbitrary use cases", "children": [] }, - { "name": "Envoy (Kubernetes)", "type": "feature page", "path": "/u/bouncers/envoy", "file_path": "crowdsec-docs/unversioned/bouncers/envoy.md", "short_description": "Envoy Gateway Kubernetes remediation component", "children": [] }, - { "name": "Fastly", "type": "feature page", "path": "/u/bouncers/fastly", "file_path": "crowdsec-docs/unversioned/bouncers/fastly.md", "short_description": "Fastly CDN remediation component", "children": [] }, - { "name": "Firewall", "type": "feature page", "path": "/u/bouncers/firewall", "file_path": "crowdsec-docs/unversioned/bouncers/firewall.md", "short_description": "OS-level firewall remediation (iptables/nftables/pf)", "children": [] }, - { "name": "HAProxy", "type": "feature page", "path": "/u/bouncers/haproxy", "file_path": "crowdsec-docs/unversioned/bouncers/haproxy.md", "short_description": "HAProxy load balancer remediation component", "children": [] }, - { "name": "HAProxy SPOA", "type": "feature page", "path": "/u/bouncers/haproxy_spoa", "file_path": "crowdsec-docs/unversioned/bouncers/haproxy_spoa.md", "short_description": "HAProxy SPOA (Stream Processing Offload Agent) integration", "children": [] }, - { "name": "Ingress Nginx", "type": "feature page", "path": "/u/bouncers/ingress-nginx", "file_path": "crowdsec-docs/unversioned/bouncers/ingress-nginx.md", "short_description": "Kubernetes NGINX Ingress remediation component", "children": [] }, - { "name": "Magento 2", "type": "feature page", "path": "/u/bouncers/magento", "file_path": "crowdsec-docs/unversioned/bouncers/magento.md", "short_description": "Magento 2 e-commerce platform remediation component", "children": [] }, - { "name": "MISP Feed Generator", "type": "feature page", "path": "/u/bouncers/misp-feed-generator", "file_path": "crowdsec-docs/unversioned/bouncers/misp-feed-generator.md", "short_description": "Generate MISP threat intel feeds from CrowdSec decisions", "children": [] }, - { "name": "Nginx", "type": "feature page", "path": "/u/bouncers/nginx", "file_path": "crowdsec-docs/unversioned/bouncers/nginx.md", "short_description": "Nginx web server remediation component", "children": [] }, - { "name": "OpenResty", "type": "feature page", "path": "/u/bouncers/openresty", "file_path": "crowdsec-docs/unversioned/bouncers/openresty.md", "short_description": "OpenResty (Nginx+Lua) remediation component", "children": [] }, - { "name": "PHP Standalone", "type": "feature page", "path": "/u/bouncers/php", "file_path": "crowdsec-docs/unversioned/bouncers/php.md", "short_description": "PHP standalone remediation component", "children": [] }, - { "name": "PHP Library", "type": "feature page", "path": "/u/bouncers/php-lib", "file_path": "crowdsec-docs/unversioned/bouncers/php-lib.md", "short_description": "PHP remediation library for custom integrations", "children": [] }, - { "name": "Windows Firewall", "type": "feature page", "path": "/u/bouncers/windows_firewall", "file_path": "crowdsec-docs/unversioned/bouncers/windows_firewall.md", "short_description": "Windows Firewall remediation component", "children": [] }, - { "name": "WordPress Plugin", "type": "feature page", "path": "/u/bouncers/wordpress", "file_path": "crowdsec-docs/unversioned/bouncers/wordpress.md", "short_description": "WordPress plugin for CrowdSec remediation", "children": [] }, - { "name": "Traefik (Kubernetes)", "type": "feature page", "path": "/u/bouncers/traefik", "file_path": "crowdsec-docs/unversioned/bouncers/traefik.md", "short_description": "Traefik Kubernetes reverse proxy remediation component", "children": [] }, - { "name": "Third Party", "type": "reference", "path": "https://hub.crowdsec.net/", "file_path": null, "short_description": "External link to the CrowdSec Hub for community-contributed bouncers", "children": [] } - ] - }, - { - "name": "Web Application Firewall (AppSec)", - "type": "NavBarItem", - "links_to": "/docs/next/appsec/intro", - "short_description": "CrowdSec WAF component documentation", - "children": [ - { "name": "Introduction", "type": "presentation", "path": "/docs/next/appsec/intro", "file_path": "crowdsec-docs/docs/appsec/intro.md", "short_description": "Overview of CrowdSec WAF (AppSec component)", "children": [] }, - { - "name": "Quickstarts", - "type": "NavBarItem", - "short_description": "Platform-specific WAF setup guides", - "children": [ - { "name": "General Setup", "type": "guide", "path": "/docs/next/appsec/quickstart/general_setup", "file_path": "crowdsec-docs/docs/appsec/quickstart/general_setup.md", "short_description": "Core AppSec setup applicable to all web servers", "children": [] }, - { "name": "NGINX Ingress (Helm)", "type": "guide", "path": "/docs/next/appsec/quickstart/nginx-ingress", "file_path": "crowdsec-docs/docs/appsec/quickstart/nginx-ingress.md", "short_description": "Kubernetes NGINX Ingress AppSec quickstart", "children": [] }, - { "name": "Envoy Gateway (Kubernetes)", "type": "guide", "path": "/docs/next/appsec/quickstart/envoy-gateway", "file_path": "crowdsec-docs/docs/appsec/quickstart/envoy-gateway.md", "short_description": "Kubernetes Envoy Gateway AppSec quickstart", "children": [] }, - { "name": "Nginx / OpenResty", "type": "guide", "path": "/docs/next/appsec/quickstart/nginxopenresty", "file_path": "crowdsec-docs/docs/appsec/quickstart/nginxopenresty.md", "short_description": "Nginx/OpenResty AppSec quickstart", "children": [] }, - { "name": "HAProxy SPOA", "type": "guide", "path": "/docs/next/appsec/quickstart/haproxy_spoa", "file_path": "crowdsec-docs/docs/appsec/quickstart/haproxy_spoa.md", "short_description": "HAProxy SPOA AppSec quickstart", "children": [] }, - { "name": "NPMplus", "type": "guide", "path": "/docs/next/appsec/quickstart/npmplus", "file_path": "crowdsec-docs/docs/appsec/quickstart/npmplus.md", "short_description": "NPMplus AppSec quickstart", "children": [] }, - { "name": "Traefik", "type": "guide", "path": "/docs/next/appsec/quickstart/traefik", "file_path": "crowdsec-docs/docs/appsec/quickstart/traefik.md", "short_description": "Traefik AppSec quickstart", "children": [] }, - { "name": "WordPress", "type": "guide", "path": "/docs/next/appsec/quickstart/wordpress", "file_path": "crowdsec-docs/docs/appsec/quickstart/wordpress.md", "short_description": "WordPress AppSec quickstart", "children": [] } - ] - }, - { - "name": "Configuration", - "type": "NavBarItem", - "short_description": "AppSec component configuration", - "children": [ - { "name": "Syntax", "type": "technical doc", "path": "/docs/next/appsec/configuration", "file_path": "crowdsec-docs/docs/appsec/configuration.md", "short_description": "AppSec configuration file syntax", "children": [] }, - { "name": "Creation & Testing", "type": "guide", "path": "/docs/next/appsec/configuration_creation_testing", "file_path": "crowdsec-docs/docs/appsec/configuration_creation_testing.md", "short_description": "Create and test AppSec configurations", "children": [] }, - { "name": "Allowlisting and Rule Overrides", "type": "guide", "path": "/docs/next/appsec/configuration_rule_management", "file_path": "crowdsec-docs/docs/appsec/configuration_rule_management.md", "short_description": "Disable or override rules at runtime", "children": [] }, - { "name": "Hooks", "type": "technical doc", "path": "/docs/next/appsec/hooks", "file_path": "crowdsec-docs/docs/appsec/hooks.md", "short_description": "Hook into AppSec processing stages to change behavior", "children": [] } - ] - }, - { - "name": "Rules", - "type": "NavBarItem", - "short_description": "AppSec WAF rules management", - "children": [ - { "name": "Syntax", "type": "technical doc", "path": "/docs/next/appsec/rules_syntax", "file_path": "crowdsec-docs/docs/appsec/rules_syntax.md", "short_description": "AppSec rules syntax reference", "children": [] }, - { "name": "Creation & Testing", "type": "guide", "path": "/docs/next/appsec/create_rules", "file_path": "crowdsec-docs/docs/appsec/create_rules.md", "short_description": "Create WAF rules for Hub submission", "children": [] }, - { "name": "Deployment", "type": "guide", "path": "/docs/next/appsec/rules_deploy", "file_path": "crowdsec-docs/docs/appsec/rules_deploy.md", "short_description": "Deploy custom WAF rules to the engine", "children": [] }, - { "name": "Examples", "type": "guide", "path": "/docs/next/appsec/rules_examples", "file_path": "crowdsec-docs/docs/appsec/rules_examples.md", "short_description": "WAF rule examples from the CrowdSec Hub", "children": [] } - ] - }, - { - "name": "OWASP CRS", - "type": "NavBarItem", - "short_description": "OWASP Core Rule Set integration", - "children": [ - { "name": "Introduction", "type": "presentation", "path": "/docs/next/appsec/crs/intro", "file_path": "crowdsec-docs/docs/appsec/crs/intro.md", "short_description": "CrowdSec WAF compatibility with OWASP CRS", "children": [] }, - { "name": "Installation", "type": "guide", "path": "/docs/next/appsec/crs/installation", "file_path": "crowdsec-docs/docs/appsec/crs/installation.md", "short_description": "Installing CRS rules", "children": [] }, - { "name": "Plugin Support", "type": "technical doc", "path": "/docs/next/appsec/crs/plugin_support", "file_path": "crowdsec-docs/docs/appsec/crs/plugin_support.md", "short_description": "CRS plugin mechanism to extend behavior", "children": [] }, - { "name": "Customization", "type": "guide", "path": "/docs/next/appsec/crs/crs_config", "file_path": "crowdsec-docs/docs/appsec/crs/crs_config.md", "short_description": "Customize CRS to avoid false positives", "children": [] } - ] - }, - { "name": "Alerts & Scenarios", "type": "technical doc", "path": "/docs/next/appsec/alerts_and_scenarios", "file_path": "crowdsec-docs/docs/appsec/alerts_and_scenarios.md", "short_description": "WAF behavior analysis and scenario integration", "children": [] }, - { "name": "Advanced Deployments", "type": "guide", "path": "/docs/next/appsec/advanced_deployments", "file_path": "crowdsec-docs/docs/appsec/advanced_deployments.md", "short_description": "Advanced WAF deployment strategies for gradual rollout", "children": [] }, - { "name": "Request Lifecycle", "type": "technical doc", "path": "/docs/next/appsec/request_lifecycle", "file_path": "crowdsec-docs/docs/appsec/request_lifecycle.md", "short_description": "AppSec stateless inspection and request flow", "children": [] }, - { "name": "Benchmark", "type": "technical doc", "path": "/docs/next/appsec/benchmark", "file_path": "crowdsec-docs/docs/appsec/benchmark.md", "short_description": "WAF component performance benchmark results", "children": [] }, - { "name": "Bouncer/AppSec Protocol", "type": "technical doc", "path": "/docs/next/appsec/protocol", "file_path": "crowdsec-docs/docs/appsec/protocol.md", "short_description": "WAF/bouncer communication protocol spec for custom integrations", "children": [] }, - { "name": "Troubleshooting", "type": "faq", "path": "/docs/next/appsec/troubleshooting", "file_path": "crowdsec-docs/docs/appsec/troubleshooting.md", "short_description": "WAF troubleshooting via cscli", "children": [] } - ] - }, - { - "name": "Cscli", - "type": "NavBarItem", - "links_to": "/docs/next/cscli/cscli", - "short_description": "CrowdSec command-line interface full reference", - "children": [ - { "name": "Introduction", "type": "presentation", "path": "/docs/next/cscli/cscli", "file_path": "crowdsec-docs/docs/cscli/cscli.md", "short_description": "cscli overview — manage CrowdSec from the command line", "children": [] }, - { "name": "cscli alerts", "type": "reference", "path": "/docs/next/cscli/cscli_alerts", "file_path": "crowdsec-docs/docs/cscli/cscli_alerts.md", "short_description": "List, delete, and inspect alerts", "children": [] }, - { "name": "cscli allowlists", "type": "reference", "path": "/docs/next/cscli/cscli_allowlists", "file_path": "crowdsec-docs/docs/cscli/cscli_allowlists.md", "short_description": "Manage centralized allowlists", "children": [] }, - { "name": "cscli appsec-configs", "type": "reference", "path": "/docs/next/cscli/cscli_appsec-configs", "file_path": "crowdsec-docs/docs/cscli/cscli_appsec-configs.md", "short_description": "Manage AppSec configurations from Hub", "children": [] }, - { "name": "cscli appsec-rules", "type": "reference", "path": "/docs/next/cscli/cscli_appsec-rules", "file_path": "crowdsec-docs/docs/cscli/cscli_appsec-rules.md", "short_description": "Manage AppSec/WAF rules from Hub", "children": [] }, - { "name": "cscli bouncers", "type": "reference", "path": "/docs/next/cscli/cscli_bouncers", "file_path": "crowdsec-docs/docs/cscli/cscli_bouncers.md", "short_description": "Manage registered bouncers (requires local API)", "children": [] }, - { "name": "cscli capi", "type": "reference", "path": "/docs/next/cscli/cscli_capi", "file_path": "crowdsec-docs/docs/cscli/cscli_capi.md", "short_description": "Manage Central API interactions", "children": [] }, - { "name": "cscli collections", "type": "reference", "path": "/docs/next/cscli/cscli_collections", "file_path": "crowdsec-docs/docs/cscli/cscli_collections.md", "short_description": "Install, update, remove Hub collections", "children": [] }, - { "name": "cscli completion", "type": "reference", "path": "/docs/next/cscli/cscli_completion", "file_path": "crowdsec-docs/docs/cscli/cscli_completion.md", "short_description": "Generate shell completion scripts", "children": [] }, - { "name": "cscli config", "type": "reference", "path": "/docs/next/cscli/cscli_config", "file_path": "crowdsec-docs/docs/cscli/cscli_config.md", "short_description": "View and modify CrowdSec configuration", "children": [] }, - { "name": "cscli console", "type": "reference", "path": "/docs/next/cscli/cscli_console", "file_path": "crowdsec-docs/docs/cscli/cscli_console.md", "short_description": "Manage CrowdSec Console interactions", "children": [] }, - { "name": "cscli contexts", "type": "reference", "path": "/docs/next/cscli/cscli_contexts", "file_path": "crowdsec-docs/docs/cscli/cscli_contexts.md", "short_description": "Manage alert context configurations", "children": [] }, - { "name": "cscli decisions", "type": "reference", "path": "/docs/next/cscli/cscli_decisions", "file_path": "crowdsec-docs/docs/cscli/cscli_decisions.md", "short_description": "Add/List/Delete/Import decisions from LAPI", "children": [] }, - { "name": "cscli explain", "type": "reference", "path": "/docs/next/cscli/cscli_explain", "file_path": "crowdsec-docs/docs/cscli/cscli_explain.md", "short_description": "Explain log pipeline step by step", "children": [] }, - { "name": "cscli hub", "type": "reference", "path": "/docs/next/cscli/cscli_hub", "file_path": "crowdsec-docs/docs/cscli/cscli_hub.md", "short_description": "List/update hub content (parsers, scenarios, etc.)", "children": [] }, - { "name": "cscli hubtest", "type": "reference", "path": "/docs/next/cscli/cscli_hubtest", "file_path": "crowdsec-docs/docs/cscli/cscli_hubtest.md", "short_description": "Run functional tests on Hub configurations", "children": [] }, - { "name": "cscli lapi", "type": "reference", "path": "/docs/next/cscli/cscli_lapi", "file_path": "crowdsec-docs/docs/cscli/cscli_lapi.md", "short_description": "Manage Local API interactions", "children": [] }, - { "name": "cscli machines", "type": "reference", "path": "/docs/next/cscli/cscli_machines", "file_path": "crowdsec-docs/docs/cscli/cscli_machines.md", "short_description": "Manage local API machines", "children": [] }, - { "name": "cscli metrics", "type": "reference", "path": "/docs/next/cscli/cscli_metrics", "file_path": "crowdsec-docs/docs/cscli/cscli_metrics.md", "short_description": "Display CrowdSec Prometheus metrics", "children": [] }, - { "name": "cscli notifications", "type": "reference", "path": "/docs/next/cscli/cscli_notifications", "file_path": "crowdsec-docs/docs/cscli/cscli_notifications.md", "short_description": "Helper for notification plugin configuration", "children": [] }, - { "name": "cscli papi", "type": "reference", "path": "/docs/next/cscli/cscli_papi", "file_path": "crowdsec-docs/docs/cscli/cscli_papi.md", "short_description": "Manage Polling API (PAPI) interactions", "children": [] }, - { "name": "cscli parsers", "type": "reference", "path": "/docs/next/cscli/cscli_parsers", "file_path": "crowdsec-docs/docs/cscli/cscli_parsers.md", "short_description": "Manage Hub parsers", "children": [] }, - { "name": "cscli postoverflows", "type": "reference", "path": "/docs/next/cscli/cscli_postoverflows", "file_path": "crowdsec-docs/docs/cscli/cscli_postoverflows.md", "short_description": "Manage Hub postoverflows", "children": [] }, - { "name": "cscli scenarios", "type": "reference", "path": "/docs/next/cscli/cscli_scenarios", "file_path": "crowdsec-docs/docs/cscli/cscli_scenarios.md", "short_description": "Manage Hub scenarios", "children": [] }, - { "name": "cscli setup", "type": "reference", "path": "/docs/next/cscli/cscli_setup", "file_path": "crowdsec-docs/docs/cscli/cscli_setup.md", "short_description": "Tools to configure CrowdSec", "children": [] }, - { "name": "cscli simulation", "type": "reference", "path": "/docs/next/cscli/cscli_simulation", "file_path": "crowdsec-docs/docs/cscli/cscli_simulation.md", "short_description": "Manage simulation status of scenarios", "children": [] }, - { "name": "cscli support", "type": "reference", "path": "/docs/next/cscli/cscli_support", "file_path": "crowdsec-docs/docs/cscli/cscli_support.md", "short_description": "Commands for support and diagnostics", "children": [] }, - { "name": "cscli version", "type": "reference", "path": "/docs/next/cscli/cscli_version", "file_path": "crowdsec-docs/docs/cscli/cscli_version.md", "short_description": "Display CrowdSec version information", "children": [] } - ] - }, - { - "name": "Guides", - "type": "NavBarItem", - "links_to": "/u/user_guides/intro", - "short_description": "Practical how-to guides for managing CrowdSec", - "children": [ - { "name": "Introduction", "type": "presentation", "path": "/u/user_guides/intro", "file_path": "crowdsec-docs/unversioned/user_guides/intro.md", "short_description": "Overview of available user guides", "children": [] }, - { "name": "Hub Management", "type": "guide", "path": "/u/user_guides/hub_mgmt", "file_path": "crowdsec-docs/unversioned/user_guides/hub_mgmt.md", "short_description": "Install, upgrade, remove and view hub content via cscli", "children": [] }, - { "name": "Decisions Management", "type": "guide", "path": "/u/user_guides/decisions_mgmt", "file_path": "crowdsec-docs/unversioned/user_guides/decisions_mgmt.md", "short_description": "Manage ban/captcha decisions from cscli", "children": [] }, - { "name": "Bouncers Configuration", "type": "guide", "path": "/u/user_guides/bouncers_configuration", "file_path": "crowdsec-docs/unversioned/user_guides/bouncers_configuration.md", "short_description": "Configure bouncers communicating via LAPI", "children": [] }, - { "name": "Machines Management", "type": "guide", "path": "/u/user_guides/machines_mgmt", "file_path": "crowdsec-docs/unversioned/user_guides/machines_mgmt.md", "short_description": "Register and manage CrowdSec machines", "children": [] }, - { "name": "Local API Management", "type": "guide", "path": "/u/user_guides/lapi_mgmt", "file_path": "crowdsec-docs/unversioned/user_guides/lapi_mgmt.md", "short_description": "Manage the LAPI core component", "children": [] }, - { "name": "Manual Installation", "type": "guide", "path": "/u/user_guides/building", "file_path": "crowdsec-docs/unversioned/user_guides/building.md", "short_description": "Manually install CrowdSec from Debian package", "children": [] }, - { "name": "Replay Mode", "type": "guide", "path": "/u/user_guides/replay_mode", "file_path": "crowdsec-docs/unversioned/user_guides/replay_mode.md", "short_description": "Replay old log files in forensic mode", "children": [] }, - { "name": "Understand Log Processing (cscli explain)", "type": "guide", "path": "/u/user_guides/cscli_explain", "file_path": "crowdsec-docs/unversioned/user_guides/cscli_explain.md", "short_description": "Use cscli explain to understand how logs are parsed", "children": [] }, - { "name": "Run cscli on macOS", "type": "guide", "path": "/u/user_guides/cscli_macos", "file_path": "crowdsec-docs/unversioned/user_guides/cscli_macos.md", "short_description": "How to run cscli on a macOS machine", "children": [] }, - { "name": "Multi-Server Setup", "type": "guide", "path": "/u/user_guides/multiserver_setup", "file_path": "crowdsec-docs/unversioned/user_guides/multiserver_setup.md", "short_description": "Deploy CrowdSec across multiple servers", "children": [] }, - { "name": "Consuming Fastly Logs", "type": "guide", "path": "/u/user_guides/consuming_fastly_logs", "file_path": "crowdsec-docs/unversioned/user_guides/consuming_fastly_logs.md", "short_description": "Ingest and process Fastly CDN log data", "children": [] }, - { "name": "Contextualize Alerts", "type": "guide", "path": "/u/user_guides/alert_context", "file_path": "crowdsec-docs/unversioned/user_guides/alert_context.md", "short_description": "Send extra context data within alerts without storing raw logs", "children": [] }, - { "name": "Log Centralization", "type": "guide", "path": "/u/user_guides/log_centralization", "file_path": "crowdsec-docs/unversioned/user_guides/log_centralization.md", "short_description": "Centralize logs from multiple servers into one CrowdSec instance", "children": [] }, - { "name": "WAF Reverse Proxy Setup", "type": "guide", "path": "/u/user_guides/waf_rp_howto", "file_path": "crowdsec-docs/unversioned/user_guides/waf_rp_howto.md", "short_description": "Deploy CrowdSec WAF with Nginx as reverse proxy for fleet protection", "children": [] } - ] - }, - { - "name": "SDK", - "type": "NavBarItem", - "links_to": "/docs/next/getting_started/sdk_intro", - "short_description": "CrowdSec SDKs for signal sharing partners", - "children": [ - { "name": "Introduction", "type": "presentation", "path": "/docs/next/getting_started/sdk_intro", "file_path": "crowdsec-docs/docs/getting_started/sdk_intro.md", "short_description": "Overview of Python and PHP SDKs for signal sharing", "children": [] }, - { "name": "Python SDK", "type": "guide", "path": "/docs/next/getting_started/install_pyagent", "file_path": "crowdsec-docs/docs/getting_started/install_pyagent.md", "short_description": "Python soft agent for signal sharing partners", "children": [] }, - { "name": "PHP SDK", "type": "guide", "path": "/docs/next/getting_started/install_php_softagent", "file_path": "crowdsec-docs/docs/getting_started/install_php_softagent.md", "short_description": "PHP soft agent for signal sharing", "children": [] }, - { "name": "Drupal Plugin", "type": "feature page", "path": "/docs/next/getting_started/install_drupal_plugin", "file_path": "crowdsec-docs/docs/getting_started/install_drupal_plugin.md", "short_description": "CrowdSec Drupal plugin for real-time site protection", "children": [] } - ] - } - ] - }, - { - "name": "Blocklists", - "type": "NavBarItem", - "links_to": "/u/blocklists/getting_started", - "short_description": "Curated threat intelligence blocklist subscription and integration", - "children": [ - { "name": "Introduction", "type": "presentation", "path": "/u/blocklists/intro", "file_path": "crowdsec-docs/unversioned/blocklists/intro.md", "short_description": "Welcome and overview of the blocklists product", "children": [] }, - { "name": "Getting Started", "type": "guide", "path": "/u/blocklists/getting_started", "file_path": "crowdsec-docs/unversioned/blocklists/getting_started.md", "short_description": "First steps to subscribe and use blocklists", "children": [] }, - { "name": "Featured Blocklists", "type": "feature page", "path": "/u/console/blocklists/featured", "file_path": "crowdsec-docs/unversioned/console/blocklists/featured.md", "short_description": "Top recommended blocklists in the CrowdSec catalog", "children": [] }, - { "name": "Blocklists Catalog", "type": "feature page", "path": "/u/console/blocklists/catalog", "file_path": "crowdsec-docs/unversioned/console/blocklists/catalog.md", "short_description": "Full catalog covering various threat types and sources", "children": [] }, - { "name": "Blocklist Details", "type": "feature page", "path": "/u/console/blocklists/details", "file_path": "crowdsec-docs/unversioned/console/blocklists/details.md", "short_description": "Statistics and benefit analysis for a specific blocklist", "children": [] }, - { "name": "Subscription", "type": "guide", "path": "/u/console/blocklists/subscription", "file_path": "crowdsec-docs/unversioned/console/blocklists/subscription.md", "short_description": "How to subscribe to a blocklist via the Console", "children": [] }, - { "name": "Security Engine Integration", "type": "guide", "path": "/u/blocklists/security_engine", "file_path": "crowdsec-docs/unversioned/blocklists/security_engine.md", "short_description": "Use blocklists with the Security Engine", "children": [] }, - { - "name": "Integrations", - "type": "NavBarItem", - "short_description": "Integrate blocklists with external firewalls and security tools", - "children": [ - { "name": "Introduction", "type": "presentation", "path": "/u/integrations/intro", "file_path": "crowdsec-docs/unversioned/integrations/intro.md", "short_description": "Overview of blocklist integration options", "children": [] }, - { "name": "Raw IP List", "type": "guide", "path": "/u/integrations/rawiplist", "file_path": "crowdsec-docs/unversioned/integrations/rawiplist.md", "short_description": "Consume blocklist as a raw IP text feed", "children": [] }, - { "name": "Remediation Component", "type": "guide", "path": "/u/integrations/remediationcomponent", "file_path": "crowdsec-docs/unversioned/integrations/remediationcomponent.md", "short_description": "Use blocklists with a remediation component", "children": [] }, - { "name": "Checkpoint", "type": "guide", "path": "/u/integrations/checkpoint", "file_path": "crowdsec-docs/unversioned/integrations/checkpoint.md", "short_description": "Checkpoint firewall blocklist integration", "children": [] }, - { "name": "Cisco", "type": "guide", "path": "/u/integrations/cisco", "file_path": "crowdsec-docs/unversioned/integrations/cisco.md", "short_description": "Cisco firewall blocklist integration", "children": [] }, - { "name": "F5", "type": "guide", "path": "/u/integrations/f5", "file_path": "crowdsec-docs/unversioned/integrations/f5.md", "short_description": "F5 firewall blocklist integration", "children": [] }, - { "name": "Fortinet", "type": "guide", "path": "/u/integrations/fortinet", "file_path": "crowdsec-docs/unversioned/integrations/fortinet.md", "short_description": "Fortinet firewall blocklist integration", "children": [] }, - { "name": "Juniper", "type": "guide", "path": "/u/integrations/juniper", "file_path": "crowdsec-docs/unversioned/integrations/juniper.md", "short_description": "Juniper firewall blocklist integration", "children": [] }, - { "name": "Mikrotik", "type": "guide", "path": "/u/integrations/mikrotik", "file_path": "crowdsec-docs/unversioned/integrations/mikrotik.md", "short_description": "Mikrotik router blocklist integration", "children": [] }, - { "name": "OPNsense", "type": "guide", "path": "/u/integrations/opnsense", "file_path": "crowdsec-docs/unversioned/integrations/opnsense.md", "short_description": "OPNsense firewall blocklist integration", "children": [] }, - { "name": "Palo Alto", "type": "guide", "path": "/u/integrations/paloalto", "file_path": "crowdsec-docs/unversioned/integrations/paloalto.md", "short_description": "Palo Alto Networks firewall blocklist integration", "children": [] }, - { "name": "pfSense", "type": "guide", "path": "/u/integrations/pfsense", "file_path": "crowdsec-docs/unversioned/integrations/pfsense.md", "short_description": "pfSense firewall blocklist integration", "children": [] }, - { "name": "Sophos", "type": "guide", "path": "/u/integrations/sophos", "file_path": "crowdsec-docs/unversioned/integrations/sophos.md", "short_description": "Sophos firewall blocklist integration", "children": [] } - ] - } - ] - }, - { - "name": "CTI", - "type": "NavBarItem", - "links_to": "/u/cti_api/intro", - "short_description": "Cyber Threat Intelligence platform documentation", - "children": [ - { "name": "Introduction", "type": "presentation", "path": "/u/cti_api/intro", "file_path": "crowdsec-docs/unversioned/cti_api/intro.md", "short_description": "Welcome to CrowdSec CTI — real-time threat intelligence from the global sensor network", "children": [] }, - { - "name": "Web UI", - "type": "NavBarItem", - "short_description": "CrowdSec CTI web interface guides", - "children": [ - { "name": "Getting Started", "type": "guide", "path": "/u/cti_api/getting_started", "file_path": "crowdsec-docs/unversioned/cti_api/getting_started.md", "short_description": "First steps in the CTI web platform", "children": [] }, - { "name": "IP Report", "type": "feature page", "path": "/u/cti_api/ip_report", "file_path": "crowdsec-docs/unversioned/cti_api/ip_report.md", "short_description": "How to investigate an IP address in the CTI platform", "children": [] }, - { "name": "Advanced Search", "type": "feature page", "path": "/u/cti_api/advanced_search", "file_path": "crowdsec-docs/unversioned/cti_api/advanced_search.md", "short_description": "Advanced search features in the CTI platform", "children": [] }, - { "name": "Search Queries", "type": "technical doc", "path": "/u/cti_api/search_queries", "file_path": "crowdsec-docs/unversioned/cti_api/search_queries.md", "short_description": "Lucene-based search query syntax for the CTI", "children": [] }, - { "name": "CVE Explorer", "type": "feature page", "path": "/u/cti_api/cve_explorer", "file_path": "crowdsec-docs/unversioned/cti_api/cve_explorer.md", "short_description": "Threat intelligence dashboard combining CVE metadata with detection data", "children": [] } - ] - }, - { - "name": "API", - "type": "NavBarItem", - "short_description": "CTI API access and integration", - "children": [ - { "name": "API Getting Started", "type": "guide", "path": "/u/cti_api/api_getting_started", "file_path": "crowdsec-docs/unversioned/cti_api/api_getting_started.md", "short_description": "Get started querying the CTI API directly", "children": [] }, - { "name": "Swagger", "type": "reference", "path": "https://crowdsecurity.github.io/cti-api/", "file_path": null, "short_description": "Interactive CTI API specification (external)", "children": [] } - ] - }, - { - "name": "Taxonomy", - "type": "NavBarItem", - "short_description": "Definitions of CTI data objects, scores, and classifications", - "children": [ - { "name": "Introduction", "type": "presentation", "path": "/u/cti_api/taxonomy/intro", "file_path": "crowdsec-docs/unversioned/cti_api/taxonomy/intro.md", "short_description": "Overview of CrowdSec CTI taxonomy", "children": [] }, - { "name": "CTI Object Format", "type": "reference", "path": "/u/cti_api/taxonomy/cti_object", "file_path": "crowdsec-docs/unversioned/cti_api/taxonomy/cti_object.md", "short_description": "The structure of a CTI data object", "children": [] }, - { "name": "Scores", "type": "reference", "path": "/u/cti_api/taxonomy/scores", "file_path": "crowdsec-docs/unversioned/cti_api/taxonomy/scores.md", "short_description": "Understanding CTI confidence and aggressiveness scores", "children": [] }, - { "name": "Scenarios", "type": "reference", "path": "/u/cti_api/taxonomy/scenarios", "file_path": "crowdsec-docs/unversioned/cti_api/taxonomy/scenarios.md", "short_description": "CTI scenario taxonomy definitions", "children": [] }, - { "name": "Behaviors", "type": "reference", "path": "/u/cti_api/taxonomy/behaviors", "file_path": "crowdsec-docs/unversioned/cti_api/taxonomy/behaviors.md", "short_description": "CTI behavior taxonomy definitions", "children": [] }, - { "name": "Classifications", "type": "reference", "path": "/u/cti_api/taxonomy/classifications", "file_path": "crowdsec-docs/unversioned/cti_api/taxonomy/classifications.md", "short_description": "CTI classification labels", "children": [] }, - { "name": "Safe Classifications", "type": "reference", "path": "/u/cti_api/taxonomy/false_positives", "file_path": "crowdsec-docs/unversioned/cti_api/taxonomy/false_positives.md", "short_description": "Classifications for safe/false-positive IPs", "children": [] }, - { "name": "Benign Classifications", "type": "reference", "path": "/u/cti_api/taxonomy/benign", "file_path": "crowdsec-docs/unversioned/cti_api/taxonomy/benign.md", "short_description": "Benign IP classification definitions", "children": [] } - ] - }, - { - "name": "Integrations", - "type": "NavBarItem", - "short_description": "Connect the CTI API to SIEM, SOAR, and security tools", - "children": [ - { "name": "Overview", "type": "presentation", "path": "/u/cti_api/api_integration/integration_intro", "file_path": "crowdsec-docs/unversioned/cti_api/api_integration/integration_intro.md", "short_description": "Overview of all CTI API integration options", "children": [] }, - { "name": "IPDEX", "type": "feature page", "path": "/u/cti_api/api_integration/integration_ipdex", "file_path": "crowdsec-docs/unversioned/cti_api/api_integration/integration_ipdex.md", "short_description": "CLI tool to query CrowdSec CTI", "children": [] }, - { "name": "Chrome Extension", "type": "feature page", "path": "/u/cti_api/api_integration/integration_chrome", "file_path": "crowdsec-docs/unversioned/cti_api/api_integration/integration_chrome.md", "short_description": "Browser extension for quick CTI IP lookups", "children": [] }, - { "name": "Gigasheet", "type": "feature page", "path": "/u/cti_api/api_integration/integration_gigasheet", "file_path": "crowdsec-docs/unversioned/cti_api/api_integration/integration_gigasheet.md", "short_description": "CTI integration with Gigasheet spreadsheet tool", "children": [] }, - { "name": "IntelOwl", "type": "feature page", "path": "/u/cti_api/api_integration/integration_intelowl", "file_path": "crowdsec-docs/unversioned/cti_api/api_integration/integration_intelowl.md", "short_description": "CrowdSec analyzer plugin for IntelOwl", "children": [] }, - { "name": "Maltego", "type": "feature page", "path": "/u/cti_api/api_integration/integration_maltego", "file_path": "crowdsec-docs/unversioned/cti_api/api_integration/integration_maltego.md", "short_description": "Maltego transforms for IP enrichment via CTI", "children": [] }, - { "name": "MISP", "type": "feature page", "path": "/u/cti_api/api_integration/integration_misp", "file_path": "crowdsec-docs/unversioned/cti_api/api_integration/integration_misp.md", "short_description": "MISP plugin for IP attribute enrichment with CTI", "children": [] }, - { "name": "Microsoft Sentinel", "type": "feature page", "path": "/u/cti_api/api_integration/integration_ms_sentinel", "file_path": "crowdsec-docs/unversioned/cti_api/api_integration/integration_ms_sentinel.md", "short_description": "Sentinel Playbook for CTI enrichment", "children": [] }, - { "name": "MSTICpy", "type": "feature page", "path": "/u/cti_api/api_integration/integration_msticpy", "file_path": "crowdsec-docs/unversioned/cti_api/api_integration/integration_msticpy.md", "short_description": "MSTICpy CrowdSec Threat Intelligence Provider", "children": [] }, - { "name": "OpenCTI", "type": "feature page", "path": "/u/cti_api/api_integration/integration_opencti", "file_path": "crowdsec-docs/unversioned/cti_api/api_integration/integration_opencti.md", "short_description": "OpenCTI internal enrichment connector for IP observables", "children": [] }, - { "name": "Palo Alto XSOAR", "type": "feature page", "path": "/u/cti_api/api_integration/integration_paloalto_xsoar", "file_path": "crowdsec-docs/unversioned/cti_api/api_integration/integration_paloalto_xsoar.md", "short_description": "Palo Alto Cortex XSOAR CTI plugin", "children": [] }, - { "name": "QRadar", "type": "feature page", "path": "/u/cti_api/api_integration/integration_qradar", "file_path": "crowdsec-docs/unversioned/cti_api/api_integration/integration_qradar.md", "short_description": "QRadar app using CrowdSec CTI smoke endpoint", "children": [] }, - { "name": "Microsoft Security Copilot", "type": "feature page", "path": "/u/cti_api/api_integration/integration_securitycopilot", "file_path": "crowdsec-docs/unversioned/cti_api/api_integration/integration_securitycopilot.md", "short_description": "CrowdSec intelligence plugin for Security Copilot", "children": [] }, - { "name": "Sekoia XDR", "type": "feature page", "path": "/u/cti_api/api_integration/integration_sekoia_xdr", "file_path": "crowdsec-docs/unversioned/cti_api/api_integration/integration_sekoia_xdr.md", "short_description": "CTI API in Sekoia XDR playbooks", "children": [] }, - { "name": "Splunk SIEM", "type": "feature page", "path": "/u/cti_api/api_integration/integration_splunk_siem", "file_path": "crowdsec-docs/unversioned/cti_api/api_integration/integration_splunk_siem.md", "short_description": "Splunk SIEM app with CrowdSec CTI IP lookup command", "children": [] }, - { "name": "Splunk SOAR", "type": "feature page", "path": "/u/cti_api/api_integration/integration_splunk_soar", "file_path": "crowdsec-docs/unversioned/cti_api/api_integration/integration_splunk_soar.md", "short_description": "Splunk SOAR app for CrowdSec IP enrichment", "children": [] }, - { "name": "TheHive/Cortex", "type": "feature page", "path": "/u/cti_api/api_integration/integration_thehive", "file_path": "crowdsec-docs/unversioned/cti_api/api_integration/integration_thehive.md", "short_description": "Cortex analyzer for CrowdSec CTI smoke database report", "children": [] } - ] - }, - { "name": "FAQ", "type": "faq", "path": "/u/cti_api/faq", "file_path": "crowdsec-docs/unversioned/cti_api/faq.md", "short_description": "Frequently asked questions about CrowdSec CTI", "children": [] } - ] - }, - { - "name": "Console", - "type": "NavBarItem", - "links_to": "/u/console/intro", - "short_description": "CrowdSec Console web platform documentation", - "children": [ - { "name": "Introduction", "type": "presentation", "path": "/u/console/intro", "file_path": "crowdsec-docs/unversioned/console/intro.md", "short_description": "What the CrowdSec Console is and what it provides", "children": [] }, - { "name": "Getting Started", "type": "guide", "path": "/u/console/getting_started", "file_path": "crowdsec-docs/unversioned/console/getting_started.md", "short_description": "First steps to set up and use the CrowdSec Console", "children": [] }, - { - "name": "Security Engines", - "type": "NavBarItem", - "short_description": "Manage registered Security Engines in the Console", - "children": [ - { "name": "Dashboard", "type": "feature page", "path": "/u/console/security_engines/dashboard", "file_path": "crowdsec-docs/unversioned/console/security_engines/dashboard.md", "short_description": "Security Engines overview dashboard", "children": [] }, - { "name": "Filter and Sort", "type": "feature page", "path": "/u/console/security_engines/filter_and_sort", "file_path": "crowdsec-docs/unversioned/console/security_engines/filter_and_sort.md", "short_description": "Filter and sort Security Engines in the dashboard", "children": [] }, - { "name": "Pending Security Engines", "type": "guide", "path": "/u/console/security_engines/pending_security_engines", "file_path": "crowdsec-docs/unversioned/console/security_engines/pending_security_engines.md", "short_description": "Accept or decline engines waiting for enrollment", "children": [] }, - { "name": "Name and Tags", "type": "guide", "path": "/u/console/security_engines/name_and_tags", "file_path": "crowdsec-docs/unversioned/console/security_engines/name_and_tags.md", "short_description": "Edit Security Engine name and tags", "children": [] }, - { "name": "Transfer Engine", "type": "guide", "path": "/u/console/security_engines/transfer_engine", "file_path": "crowdsec-docs/unversioned/console/security_engines/transfer_engine.md", "short_description": "Transfer a Security Engine to another organization", "children": [] }, - { "name": "Archive Engine", "type": "guide", "path": "/u/console/security_engines/archive_engine", "file_path": "crowdsec-docs/unversioned/console/security_engines/archive_engine.md", "short_description": "Archive a Security Engine from the organization", "children": [] }, - { "name": "Remove Engine", "type": "guide", "path": "/u/console/security_engines/remove_engine", "file_path": "crowdsec-docs/unversioned/console/security_engines/remove_engine.md", "short_description": "Remove a Security Engine from an organization", "children": [] }, - { "name": "Troubleshooting", "type": "faq", "path": "/u/console/security_engines/troubleshooting", "file_path": "crowdsec-docs/unversioned/console/security_engines/troubleshooting.md", "short_description": "Troubleshooting hints for Security Engines in the Console", "children": [] }, - { "name": "Am I Under Attack (Premium)", "type": "feature page", "path": "/u/console/security_engines/am_i_under_attack", "file_path": "crowdsec-docs/unversioned/console/security_engines/am_i_under_attack.md", "short_description": "Premium alerting for abnormal attack surge detection", "children": [] }, - { "name": "Multi-Organization Selection", "type": "feature page", "path": "/u/console/security_engines/select_multiple_organizations", "file_path": "crowdsec-docs/unversioned/console/security_engines/select_multiple_organizations.md", "short_description": "Manage engines across multiple organizations", "children": [] }, - { "name": "Details Page", "type": "feature page", "path": "/u/console/security_engines/details_page", "file_path": "crowdsec-docs/unversioned/console/security_engines/details_page.md", "short_description": "View detailed information for a specific Security Engine", "children": [] } - ] - }, - { - "name": "Blocklists (Console)", - "type": "NavBarItem", - "short_description": "Blocklist management within the Console", - "children": [ - { "name": "Featured Blocklists", "type": "feature page", "path": "/u/console/blocklists/featured", "file_path": "crowdsec-docs/unversioned/console/blocklists/featured.md", "short_description": "Highlighted top blocklists in the catalog", "children": [] }, - { "name": "Catalog", "type": "feature page", "path": "/u/console/blocklists/catalog", "file_path": "crowdsec-docs/unversioned/console/blocklists/catalog.md", "short_description": "Wide catalog covering various threat types and sources", "children": [] }, - { "name": "Details", "type": "feature page", "path": "/u/console/blocklists/details", "file_path": "crowdsec-docs/unversioned/console/blocklists/details.md", "short_description": "Detailed statistics and benefit analysis for a blocklist", "children": [] }, - { "name": "Subscription", "type": "guide", "path": "/u/console/blocklists/subscription", "file_path": "crowdsec-docs/unversioned/console/blocklists/subscription.md", "short_description": "How to subscribe to a blocklist from the Console", "children": [] } - ] - }, - { - "name": "Alerts", - "type": "NavBarItem", - "short_description": "Alert visualization, analysis, and management", - "children": [ - { "name": "Introduction", "type": "presentation", "path": "/u/console/alerts/intro", "file_path": "crowdsec-docs/unversioned/console/alerts/intro.md", "short_description": "Introduction to the Alerts section", "children": [] }, - { "name": "Visualizer", "type": "feature page", "path": "/u/console/alerts/visualizer", "file_path": "crowdsec-docs/unversioned/console/alerts/visualizer.md", "short_description": "Visual alert timeline and maps", "children": [] }, - { "name": "Alerts Analysis", "type": "feature page", "path": "/u/console/alerts/alerts_analysis", "file_path": "crowdsec-docs/unversioned/console/alerts/alerts_analysis.md", "short_description": "Analyzing and understanding alert patterns", "children": [] }, - { "name": "Alerts Context", "type": "feature page", "path": "/u/console/alerts/alerts_contexts", "file_path": "crowdsec-docs/unversioned/console/alerts/alerts_contexts.md", "short_description": "Understanding context attached to alerts", "children": [] }, - { "name": "Background Noise Filtering (Premium)", "type": "feature page", "path": "/u/console/alerts/background_noise", "file_path": "crowdsec-docs/unversioned/console/alerts/background_noise.md", "short_description": "Premium filtering to focus on alerts that matter", "children": [] }, - { "name": "Quotas", "type": "technical doc", "path": "/u/console/alerts/quotas", "file_path": "crowdsec-docs/unversioned/console/alerts/quotas.md", "short_description": "Alert storage quotas and limits", "children": [] } - ] - }, - { "name": "Remediation Sync (Premium)", "type": "feature page", "path": "/u/console/remediation_sync", "file_path": "crowdsec-docs/unversioned/console/remediation_sync.md", "short_description": "Sync remediation decisions across Security Engines (Premium)", "children": [] }, - { "name": "Remediation Metrics", "type": "feature page", "path": "/u/console/remediation_metrics", "file_path": "crowdsec-docs/unversioned/console/remediation_metrics.md", "short_description": "View bouncer enforcement metrics in the Console", "children": [] }, - { - "name": "Decisions", - "type": "NavBarItem", - "short_description": "View and manage ban/remediation decisions", - "children": [ - { "name": "Introduction", "type": "presentation", "path": "/u/console/decisions/decisions_intro", "file_path": "crowdsec-docs/unversioned/console/decisions/decisions_intro.md", "short_description": "Introduction to decisions in the Console", "children": [] }, - { "name": "Decisions Management (Premium)", "type": "feature page", "path": "/u/console/decisions/decisions_management", "file_path": "crowdsec-docs/unversioned/console/decisions/decisions_management.md", "short_description": "Manage and override decisions from the Console (Premium)", "children": [] } - ] - }, - { "name": "Centralized Allowlists (Premium)", "type": "feature page", "path": "/u/console/allowlists", "file_path": "crowdsec-docs/unversioned/console/allowlists.md", "short_description": "Manage allowlists centrally across all Security Engines (Premium)", "children": [] }, - { - "name": "Enterprise Plan", - "type": "NavBarItem", - "short_description": "Enterprise support and billing features", - "children": [ - { "name": "Enterprise Support", "type": "feature page", "path": "/u/console/enterprise_plan/enterprise_support", "file_path": "crowdsec-docs/unversioned/console/enterprise_plan/enterprise_support.md", "short_description": "Enterprise-tier support features and SLAs", "children": [] }, - { "name": "Invoices", "type": "feature page", "path": "/u/console/enterprise_plan/enterprise_invoices", "file_path": "crowdsec-docs/unversioned/console/enterprise_plan/enterprise_invoices.md", "short_description": "Invoice management for Enterprise plan", "children": [] } - ] - }, - { "name": "Threat Forecast (Premium)", "type": "feature page", "path": "/u/console/threat_forecast", "file_path": "crowdsec-docs/unversioned/console/threat_forecast.md", "short_description": "Predictive threat forecasting based on global intelligence (Premium)", "children": [] }, - { - "name": "Service API", - "type": "NavBarItem", - "short_description": "Programmatic access to Console features via REST API", - "children": [ - { "name": "Getting Started", "type": "guide", "path": "/u/console/service_api/getting_started", "file_path": "crowdsec-docs/unversioned/console/service_api/getting_started.md", "short_description": "Get started with the Console Service API", "children": [] }, - { "name": "Authentication Quickstart", "type": "guide", "path": "/u/console/service_api/quickstart/authentication", "file_path": "crowdsec-docs/unversioned/console/service_api/quickstart/authentication.md", "short_description": "Authenticate with the Service API", "children": [] }, - { "name": "Blocklists Quickstart", "type": "guide", "path": "/u/console/service_api/quickstart/blocklists", "file_path": "crowdsec-docs/unversioned/console/service_api/quickstart/blocklists.md", "short_description": "Manage blocklists via the Service API", "children": [] }, - { "name": "Integrations Quickstart", "type": "guide", "path": "/u/console/service_api/quickstart/integrations", "file_path": "crowdsec-docs/unversioned/console/service_api/quickstart/integrations.md", "short_description": "Set up integrations via the Service API", "children": [] }, - { "name": "Blocklists Reference", "type": "technical doc", "path": "/u/console/service_api/blocklists", "file_path": "crowdsec-docs/unversioned/console/service_api/blocklists.md", "short_description": "Full blocklists API reference — create, populate, subscribe, share", "children": [] }, - { "name": "Integrations Reference", "type": "technical doc", "path": "/u/console/service_api/integrations", "file_path": "crowdsec-docs/unversioned/console/service_api/integrations.md", "short_description": "Supported integration formats reference", "children": [] }, - { "name": "Python SDK", "type": "guide", "path": "/u/console/service_api/sdks/python", "file_path": "crowdsec-docs/unversioned/console/service_api/sdks/python.md", "short_description": "Python SDK for the Console Service API", "children": [] }, - { "name": "FAQ", "type": "faq", "path": "/u/console/service_api/faq", "file_path": "crowdsec-docs/unversioned/console/service_api/faq.md", "short_description": "Service API frequently asked questions", "children": [] } - ] - }, - { - "name": "Notification Integrations (Premium)", - "type": "NavBarItem", - "short_description": "Push Console alerts to external communication tools", - "children": [ - { "name": "Overview", "type": "presentation", "path": "/u/console/notification_integrations/overview", "file_path": "crowdsec-docs/unversioned/console/notification_integrations/overview.md", "short_description": "Overview of notification integrations for the Console", "children": [] }, - { "name": "Notification Rule", "type": "technical doc", "path": "/u/console/notification_integrations/rule", "file_path": "crowdsec-docs/unversioned/console/notification_integrations/rule.md", "short_description": "Configure notification trigger rules", "children": [] }, - { "name": "Discord", "type": "feature page", "path": "/u/console/notification_integrations/discord", "file_path": "crowdsec-docs/unversioned/console/notification_integrations/discord.md", "short_description": "Send Console alerts to Discord", "children": [] }, - { "name": "Slack", "type": "feature page", "path": "/u/console/notification_integrations/slack", "file_path": "crowdsec-docs/unversioned/console/notification_integrations/slack.md", "short_description": "Send Console alerts to Slack", "children": [] }, - { "name": "Webhook", "type": "feature page", "path": "/u/console/notification_integrations/webhook", "file_path": "crowdsec-docs/unversioned/console/notification_integrations/webhook.md", "short_description": "Send Console alerts to a custom webhook", "children": [] } - ] - }, - { "name": "Stack Health", "type": "feature page", "path": "/u/console/stackhealth", "file_path": "crowdsec-docs/unversioned/console/stackhealth.md", "short_description": "Monitor infrastructure health and CrowdSec configuration status", "children": [] }, - { - "name": "Premium Upgrade", - "type": "NavBarItem", - "short_description": "Information about upgrading to CrowdSec Premium", - "children": [ - { "name": "Premium Upgrade", "type": "presentation", "path": "/u/console/premium_upgrade", "file_path": "crowdsec-docs/unversioned/console/premium_upgrade/index.md", "short_description": "Premium features for DevOps, SecOps, and MSP roles", "children": [] }, - { "name": "Optimal Premium Setup", "type": "guide", "path": "/u/console/premium_upgrade/optimal_setup", "file_path": "crowdsec-docs/unversioned/console/premium_upgrade/optimal_setup.md", "short_description": "Best practices for setting up your Premium upgrade", "children": [] }, - { "name": "Test Premium Value", "type": "guide", "path": "/u/console/premium_upgrade/testing_premium", "file_path": "crowdsec-docs/unversioned/console/premium_upgrade/testing_premium.md", "short_description": "Practical ways to measure Premium value during a trial", "children": [] }, - { "name": "Features Overview", "type": "feature page", "path": "/u/console/premium_upgrade/features_overview", "file_path": "crowdsec-docs/unversioned/console/premium_upgrade/features_overview.md", "short_description": "Comprehensive overview of all Premium features", "children": [] } - ] - } - ] - }, - { - "name": "Resources", - "type": "NavBarItem", - "short_description": "Dropdown with links to guides and external Academy", - "children": [ - { - "name": "Guides", - "type": "NavBarItem", - "links_to": "/u/user_guides/intro", - "short_description": "Duplicate link to the Guides section (also under Security Stack)", - "children": [] - }, - { - "name": "Academy", - "type": "reference", - "path": "https://academy.crowdsec.net/courses", - "file_path": null, - "short_description": "External CrowdSec Academy for video courses", - "children": [] - } - ] - }, - { - "name": "FAQ / Troubleshooting", - "type": "NavBarItem", - "links_to": "/u/troubleshooting/intro", - "short_description": "Centralized troubleshooting and FAQ section", - "children": [ - { "name": "Introduction", "type": "presentation", "path": "/u/troubleshooting/intro", "file_path": "crowdsec-docs/unversioned/troubleshooting/intro.md", "short_description": "Entry point for all troubleshooting documentation", "children": [] }, - { "name": "Use Cases and Quick Solutions", "type": "faq", "path": "/u/troubleshooting/usecases", "file_path": "crowdsec-docs/unversioned/troubleshooting/usecases.md", "short_description": "Common use cases with quick solution paths", "children": [] }, - { "name": "Security Engine", "type": "faq", "path": "/u/troubleshooting/security_engine", "file_path": "crowdsec-docs/unversioned/troubleshooting/security_engine.md", "short_description": "Troubleshooting the Security Engine", "children": [] }, - { "name": "Remediation Components", "type": "faq", "path": "/u/troubleshooting/remediation_components", "file_path": "crowdsec-docs/unversioned/troubleshooting/remediation_components.md", "short_description": "Troubleshooting remediation components/bouncers", "children": [] }, - { "name": "CTI", "type": "faq", "path": "/u/troubleshooting/cti", "file_path": "crowdsec-docs/unversioned/troubleshooting/cti.md", "short_description": "Troubleshooting CTI API access and behavior", "children": [] }, - { - "name": "Issue Pages (linked from Stack Health)", - "type": "NavBarItem", - "short_description": "Specific issue resolution pages for automated health check findings", - "children": [ - { "name": "Log Processor Offline", "type": "faq", "path": "/u/troubleshooting/issue_lp_offline", "file_path": "crowdsec-docs/unversioned/troubleshooting/issue_lp_offline.md", "short_description": "Resolve a Log Processor showing as offline", "children": [] }, - { "name": "No Logs Parsed", "type": "faq", "path": "/u/troubleshooting/issue_lp_no_logs_parsed", "file_path": "crowdsec-docs/unversioned/troubleshooting/issue_lp_no_logs_parsed.md", "short_description": "Logs read but not parsed correctly", "children": [] }, - { "name": "No Logs Read", "type": "faq", "path": "/u/troubleshooting/issue_lp_no_logs_read", "file_path": "crowdsec-docs/unversioned/troubleshooting/issue_lp_no_logs_read.md", "short_description": "Log Processor not acquiring any log lines in 24h", "children": [] }, - { "name": "No Alerts Generated", "type": "faq", "path": "/u/troubleshooting/issue_lp_no_alerts", "file_path": "crowdsec-docs/unversioned/troubleshooting/issue_lp_no_alerts.md", "short_description": "Log Processor running but not generating alerts", "children": [] }, - { "name": "Security Engine Offline", "type": "faq", "path": "/u/troubleshooting/issue_se_offline", "file_path": "crowdsec-docs/unversioned/troubleshooting/issue_se_offline.md", "short_description": "Security Engine not reported to CAPI for 48+ hours", "children": [] }, - { "name": "Security Engine No Alerts", "type": "faq", "path": "/u/troubleshooting/issue_se_no_alerts", "file_path": "crowdsec-docs/unversioned/troubleshooting/issue_se_no_alerts.md", "short_description": "Security Engine not forwarding alerts to CAPI in 48h", "children": [] }, - { "name": "No Remediation Component", "type": "faq", "path": "/u/troubleshooting/issue_se_no_rc", "file_path": "crowdsec-docs/unversioned/troubleshooting/issue_se_no_rc.md", "short_description": "No remediation component registered to the engine", "children": [] }, - { "name": "No Active Remediation Component", "type": "faq", "path": "/u/troubleshooting/issue_se_no_active_rc", "file_path": "crowdsec-docs/unversioned/troubleshooting/issue_se_no_active_rc.md", "short_description": "No active remediation components connected", "children": [] }, - { "name": "Too Many Alerts", "type": "faq", "path": "/u/troubleshooting/issue_se_too_many_alerts", "file_path": "crowdsec-docs/unversioned/troubleshooting/issue_se_too_many_alerts.md", "short_description": "Abnormally high alert volume indicating misconfiguration", "children": [] }, - { "name": "Mismatching Collections", "type": "faq", "path": "/u/troubleshooting/issue_mismatch_collections", "file_path": "crowdsec-docs/unversioned/troubleshooting/issue_mismatch_collections.md", "short_description": "Collection installed but related log files not being read", "children": [] }, - { "name": "CAPI 403 Forbidden", "type": "faq", "path": "/u/troubleshooting/issue_capi_403", "file_path": "crowdsec-docs/unversioned/troubleshooting/issue_capi_403.md", "short_description": "Getting a 403 from the CrowdSec Central API", "children": [] }, - { "name": "Firewall Integration Offline", "type": "faq", "path": "/u/troubleshooting/issue_integration_fw_offline", "file_path": "crowdsec-docs/unversioned/troubleshooting/issue_integration_fw_offline.md", "short_description": "Firewall pulling from Blocklist-as-a-Service is offline", "children": [] }, - { "name": "Firewall Integration Zero IPs", "type": "faq", "path": "/u/troubleshooting/issue_integration_fw_zero_ips", "file_path": "crowdsec-docs/unversioned/troubleshooting/issue_integration_fw_zero_ips.md", "short_description": "Firewall integration pulling zero IPs from subscribed blocklists", "children": [] }, - { "name": "Remediation Component Integration Offline", "type": "faq", "path": "/u/troubleshooting/issue_integration_rc_offline", "file_path": "crowdsec-docs/unversioned/troubleshooting/issue_integration_rc_offline.md", "short_description": "Remediation component blocklist integration is offline", "children": [] }, - { "name": "Console Issues", "type": "faq", "path": "/u/troubleshooting/console_issues", "file_path": "crowdsec-docs/unversioned/troubleshooting/console_issues.md", "short_description": "Console health check issues and resolutions", "children": [] } - ] - } - ] - }, - { - "name": "Getting Started", - "type": "NavBarItem", - "links_to": "/u/getting_started/intro", - "short_description": "Installation and onboarding for the Security Engine (sidebar-only, not in top navbar)", - "children": [ - { "name": "Introduction", "type": "presentation", "path": "/u/getting_started/intro", "file_path": "crowdsec-docs/unversioned/getting_started/intro.md", "short_description": "What is CrowdSec Security Engine — lightweight collaborative IDS overview", "children": [] }, - { - "name": "Installation", - "type": "NavBarItem", - "short_description": "Platform-specific installation guides", - "children": [ - { "name": "Linux", "type": "guide", "path": "/u/getting_started/installation/linux", "file_path": "crowdsec-docs/unversioned/getting_started/installation/linux.md", "short_description": "Install the Security Engine on Linux", "children": [] }, - { "name": "FreeBSD", "type": "guide", "path": "/u/getting_started/installation/freebsd", "file_path": "crowdsec-docs/unversioned/getting_started/installation/freebsd.md", "short_description": "Install the Security Engine on FreeBSD", "children": [] }, - { "name": "Windows", "type": "guide", "path": "/u/getting_started/installation/windows", "file_path": "crowdsec-docs/unversioned/getting_started/installation/windows.md", "short_description": "Install the Security Engine on Windows", "children": [] }, - { "name": "macOS", "type": "guide", "path": "/u/getting_started/installation/macos", "file_path": "crowdsec-docs/unversioned/getting_started/installation/macos.md", "short_description": "Run CrowdSec on macOS via Docker (no native binary)", "children": [] }, - { "name": "Docker", "type": "guide", "path": "/u/getting_started/installation/docker", "file_path": "crowdsec-docs/unversioned/getting_started/installation/docker.md", "short_description": "Run the Security Engine in a Docker container", "children": [] }, - { "name": "Kubernetes", "type": "guide", "path": "/u/getting_started/installation/kubernetes", "file_path": "crowdsec-docs/unversioned/getting_started/installation/kubernetes.md", "short_description": "Deploy the Security Engine on Kubernetes", "children": [] }, - { "name": "pfSense", "type": "guide", "path": "/u/getting_started/installation/pfsense", "file_path": "crowdsec-docs/unversioned/getting_started/installation/pfsense.md", "short_description": "Install CrowdSec on pfSense firewall", "children": [] }, - { "name": "OPNsense", "type": "guide", "path": "/u/getting_started/installation/opnsense", "file_path": "crowdsec-docs/unversioned/getting_started/installation/opnsense.md", "short_description": "Install CrowdSec on OPNsense firewall", "children": [] }, - { "name": "WHM Plugin", "type": "guide", "path": "/u/getting_started/installation/whm", "file_path": "crowdsec-docs/unversioned/getting_started/installation/whm.md", "short_description": "WHM plugin to control CrowdSec from the WHM dashboard", "children": [] } - ] - }, - { "name": "Stack Health-Check", "type": "guide", "path": "/u/getting_started/health_check", "file_path": "crowdsec-docs/unversioned/getting_started/health_check.md", "short_description": "Verify your CrowdSec setup is working correctly after install", "children": [] }, - { - "name": "Post Installation Steps", - "type": "NavBarItem", - "short_description": "Actions to take after a successful install", - "children": [ - { "name": "Console Enrollment", "type": "guide", "path": "/u/getting_started/post_installation/console", "file_path": "crowdsec-docs/unversioned/getting_started/post_installation/console.md", "short_description": "Enroll your Security Engine with the CrowdSec Console", "children": [] }, - { "name": "Blocklists Setup", "type": "guide", "path": "/u/getting_started/post_installation/console_blocklists", "file_path": "crowdsec-docs/unversioned/getting_started/post_installation/console_blocklists.md", "short_description": "Set up blocklists from the Console post-install", "children": [] }, - { "name": "Hub Setup", "type": "guide", "path": "/u/getting_started/post_installation/console_hub", "file_path": "crowdsec-docs/unversioned/getting_started/post_installation/console_hub.md", "short_description": "Configure hub content via the Console post-install", "children": [] }, - { "name": "Whitelists", "type": "guide", "path": "/u/getting_started/post_installation/whitelists", "file_path": "crowdsec-docs/unversioned/getting_started/post_installation/whitelists.md", "short_description": "Set up whitelists to ignore trusted IPs", "children": [] }, - { "name": "Acquisition Setup", "type": "guide", "path": "/u/getting_started/post_installation/acquisition", "file_path": "crowdsec-docs/unversioned/getting_started/post_installation/acquisition.md", "short_description": "Auto-detect and configure log sources (CrowdSec >= 1.7.0)", "children": [] }, - { "name": "Add New Log Sources", "type": "guide", "path": "/u/getting_started/post_installation/acquisition_new", "file_path": "crowdsec-docs/unversioned/getting_started/post_installation/acquisition_new.md", "short_description": "Add file-based log acquisitions manually", "children": [] }, - { "name": "Troubleshoot Acquisition", "type": "faq", "path": "/u/getting_started/post_installation/acquisition_troubleshoot", "file_path": "crowdsec-docs/unversioned/getting_started/post_installation/acquisition_troubleshoot.md", "short_description": "Fix issues with log acquisition configuration", "children": [] }, - { "name": "Profiles", "type": "guide", "path": "/u/getting_started/post_installation/profiles", "file_path": "crowdsec-docs/unversioned/getting_started/post_installation/profiles.md", "short_description": "Configure remediation profiles post-install", "children": [] }, - { "name": "Metrics", "type": "guide", "path": "/u/getting_started/post_installation/metrics", "file_path": "crowdsec-docs/unversioned/getting_started/post_installation/metrics.md", "short_description": "Set up Prometheus metrics for your Security Engine", "children": [] }, - { "name": "General Troubleshoot", "type": "faq", "path": "/u/getting_started/post_installation/troubleshoot", "file_path": "crowdsec-docs/unversioned/getting_started/post_installation/troubleshoot.md", "short_description": "General post-install troubleshooting guide", "children": [] } - ] - } - ] - }, - { - "name": "Tracker API", - "type": "NavBarItem", - "links_to": "/u/tracker_api/getting_started", - "short_description": "Live Exploit Tracker API — not in main navbar but has its own sidebar", - "children": [ - { "name": "Introduction", "type": "presentation", "path": "/u/tracker_api/getting_started", "file_path": "crowdsec-docs/unversioned/tracker_api/getting_started.md", "short_description": "Introduction to the Live Exploit Tracker API", "children": [] }, - { "name": "Prioritize", "type": "guide", "path": "/u/tracker_api/prioritize", "file_path": "crowdsec-docs/unversioned/tracker_api/prioritize.md", "short_description": "How to prioritize vulnerabilities using the tracker API", "children": [] }, - { "name": "Mitigate", "type": "guide", "path": "/u/tracker_api/mitigate", "file_path": "crowdsec-docs/unversioned/tracker_api/mitigate.md", "short_description": "How to mitigate vulnerabilities using the tracker API", "children": [] }, - { "name": "API Reference", "type": "reference", "path": "/u/tracker_api/api_reference", "file_path": "crowdsec-docs/unversioned/tracker_api/api_reference.md", "short_description": "Swagger-based API reference for the tracker", "children": [] }, - { "name": "Web Interface", "type": "feature page", "path": "/u/tracker_api/web_interface", "file_path": "crowdsec-docs/unversioned/tracker_api/web_interface.md", "short_description": "Human-friendly web UI for consuming the exploit tracker", "children": [] } - ] - } - ] -} diff --git a/crowdsec-docs/src/pages/index.tsx b/crowdsec-docs/src/pages/index.tsx index 3f8ff46f3..c21c6ffc3 100644 --- a/crowdsec-docs/src/pages/index.tsx +++ b/crowdsec-docs/src/pages/index.tsx @@ -450,7 +450,7 @@ const schemas: Omit[] = [ eyebrow: "IP Reputation & CTI", title: "Query threat intel — in the browser or via API in your tools", ctaLabel: "Explore CTI →", - ctaHref: "/cti", + ctaHref: "/u/cti_api/intro", steps: [ { num: 1, @@ -698,7 +698,7 @@ const HomePage = () => { { label: "🖥️ Console", href: "/u/console/intro" }, { label: "🛡️ AppSec / WAF", href: "/docs/next/appsec/intro" }, { label: "💻 CLI Reference", href: "/docs/next/cscli/" }, - { label: "🔑 CTI API Keys", href: "/cti" }, + { label: "🔑 CTI API Keys", href: "/u/console/ip_reputation/api_keys" }, { label: "❓ Troubleshooting", href: "/u/troubleshooting/intro" }, { label: "📖 Docs AI Assistant", diff --git a/crowdsec-docs/unversioned/integrations/intro.mdx b/crowdsec-docs/unversioned/integrations/intro.mdx index ab41909e5..6a5db6d36 100644 --- a/crowdsec-docs/unversioned/integrations/intro.mdx +++ b/crowdsec-docs/unversioned/integrations/intro.mdx @@ -66,11 +66,11 @@ Each vendor page explains how to create the integration in the CrowdSec Console gap: '0.6rem', margin: '1.5rem 0', }}> - + One IP per line — compatible with virtually any firewall, router, or HTTP-capable device - - Extends blocklist handling to platforms without native ingestion (Cloudflare, AWS WAF, …) via CrowdSec Remediation Components + + Integrate blocklists to platforms without native ingestion (Cloudflare, AWS WAF, …) via Remediation Components
From 2c705491b25198c631fffebfa4b5e22306c254a4 Mon Sep 17 00:00:00 2001 From: jdv Date: Tue, 5 May 2026 14:14:44 +0200 Subject: [PATCH 25/26] removing old cti detached home --- crowdsec-docs/src/pages/cti.tsx | 360 -------------------------------- 1 file changed, 360 deletions(-) delete mode 100644 crowdsec-docs/src/pages/cti.tsx diff --git a/crowdsec-docs/src/pages/cti.tsx b/crowdsec-docs/src/pages/cti.tsx deleted file mode 100644 index d65a25831..000000000 --- a/crowdsec-docs/src/pages/cti.tsx +++ /dev/null @@ -1,360 +0,0 @@ -import Link from "@docusaurus/Link"; -import Layout from "@theme/Layout"; -import { ExternalLink } from "lucide-react"; -import React, { useEffect } from "react"; - -// ── Intent card (same pattern as index.tsx) ─────────────────────────────────── - -type IntentCardProps = { - icon: React.ReactNode; - title: string; - desc: string; - pill: string; - accent: string; - href: string; - badge?: string; -}; - -const IntentCard = ({ icon, title, desc, pill, accent, href, badge }: IntentCardProps) => ( - { - const el = e.currentTarget as HTMLAnchorElement; - el.style.borderColor = accent; - el.style.boxShadow = `0 8px 24px ${accent}22, 0 0 0 1px ${accent}`; - el.style.transform = "translateY(-2px)"; - el.style.borderRadius = "14px"; - }} - onMouseLeave={(e) => { - const el = e.currentTarget as HTMLAnchorElement; - el.style.borderColor = ""; - el.style.boxShadow = ""; - el.style.transform = ""; - }} - > -
- {badge && ( -
- {badge} -
- )} -
-
- {icon} -
-
{title}
-
-
- {desc} -
-
- - → {pill} - - -
-
- -); - -// ── Differentiator card ─────────────────────────────────────────────────────── - -type DiffCardProps = { - icon: string; - title: string; - desc: string; -}; - -const DiffCard = ({ icon, title, desc }: DiffCardProps) => ( -
-
{icon}
-
{title}
-
{desc}
-
-); - -// ── Data ────────────────────────────────────────────────────────────────────── - -const BLUE = "#60a5fa"; - -const intents: IntentCardProps[] = [ - { - icon: 🖥️, - accent: BLUE, - badge: "🔍 No setup needed", - title: "Web IP Look up", - desc: "Open the Console and search any IP instantly — reputation score, behaviors, attack history, and CVE links.", - pill: "Console - Web UI", - href: "/u/console/ip_reputation/intro", - }, - { - icon: 🔌, - accent: "#a78bfa", - badge: "⚙️ Developer / SECOPS", - title: "Enrich your SIEM/SOAR/TIP/+", - desc: "Automate lookups in your scripts, pipelines, or custom tooling. No credit card needed.", - pill: "CTI API", - href: "/u/cti_api/intro", - }, - { - icon: 🚨, - accent: "#34d399", - badge: "🎯 Threat Hunters", - title: "Track live CVE exploitation", - desc: "See which IPs are actively exploiting known vulnerabilities — cross-reference CVEs with real-time attacker activity.", - pill: "Live Exploit Tracker", - href: "/u/console/ip_reputation/intro#live-exploit-tracker", - }, -]; - -const differentiators: DiffCardProps[] = [ - { - icon: "🌍", - title: "Community-sourced threat data", - desc: "Every CrowdSec instance contributes signals. The more sensors in the network, the more accurate the data — no honeypots, real-world detections only.", - }, - { - icon: "🔬", - title: "Behavioral fingerprinting", - desc: "Beyond a simple bad/good reputation. Each IP is tagged with the exact attack behaviors it was observed performing — brute force, scanning, exploit attempts, and more.", - }, - { - icon: "🛡️", - title: "CVE & live exploit tracking", - desc: "See which IPs are actively exploiting known vulnerabilities. Cross-reference CVEs with real-time attacker activity from the global sensor network.", - }, - { - icon: "🆓", - title: "Generous free tier", - desc: "Up to 15 lookups per day at no cost, no credit card. Paid tiers unlock bulk queries, higher rate limits, and advanced filters.", - }, - { - icon: "🏷️", - title: "Structured taxonomy", - desc: "Consistent labels across behaviors, classifications, and reputation scores — making it easy to integrate into automated workflows without custom parsing.", - }, - { - icon: "⚡", - title: "Real-time data", - desc: "The CTI database is updated continuously as new attack signals flow in from the global sensor network. No stale data.", - }, -]; - -// ── Page body (no Layout — safe to embed in MDX) ───────────────────────────── - -export const CTIContent = () => ( -
- {/* Hero */} -
-
-
-

- IP Reputation & Threat Intelligence -

-

- IP reputation and threat data from a global sensor network. Look up IPs, enrich investigations, and automate security - workflows. -

- - {/* Quick access bar */} -
- - Quick access - -
- {[ - { - label: "Look up an IP", - href: "https://app.crowdsec.net/cti", - external: true, - primary: true, - }, - { label: "Get Started", href: "/u/cti_api/intro", external: false, primary: false }, - { label: "API Quickstart", href: "/u/console/ip_reputation/api_keys", external: false, primary: false }, - ].map(({ label, href, external, primary }) => ( - - {label} - {external && } - - ))} -
-
-
-
- - {/* How do you want to use it? */} -
-
-
- How do you want to use it? -
-
- {intents.map((intent) => ( - - ))} -
-
-
- - {/* What makes CrowdSec CTI different */} -
-
-
-
- What makes CrowdSec CTI different -
-
-
- {differentiators.map((d) => ( - - ))} -
-
-
-
-); - -// ── Standalone page (with Layout + homepage class) ──────────────────────────── - -const CTIPage = () => { - useEffect(() => { - document.body.classList.add("homepage"); - document.documentElement.classList.add("homepage"); - return () => { - document.body.classList.remove("homepage"); - document.documentElement.classList.remove("homepage"); - }; - }, []); - - return ( - - - - ); -}; - -export default CTIPage; From 4317628327b9b42f4685bf620cd324dfbc0d0acb Mon Sep 17 00:00:00 2001 From: jdv Date: Tue, 5 May 2026 14:26:29 +0200 Subject: [PATCH 26/26] nano adjusts --- crowdsec-docs/src/pages/index.tsx | 17 +++++++++-------- 1 file changed, 9 insertions(+), 8 deletions(-) diff --git a/crowdsec-docs/src/pages/index.tsx b/crowdsec-docs/src/pages/index.tsx index c21c6ffc3..db1571b49 100644 --- a/crowdsec-docs/src/pages/index.tsx +++ b/crowdsec-docs/src/pages/index.tsx @@ -382,7 +382,7 @@ const schemas: Omit[] = [ eyebrowIcon: "🛡️", eyebrow: "Security Engine", title: "Detect and block malicious behaviors on your infrastructure", - ctaLabel: "Get started →", + ctaLabel: "Install CrowdSec →", ctaHref: "/security-engine", steps: [ { @@ -420,7 +420,7 @@ const schemas: Omit[] = [ eyebrowIcon: "🚫", eyebrow: "Blocklists", title: "Push curated threat feeds directly into your firewall, CDN, or WAF", - ctaLabel: "Get started →", + ctaLabel: "Discover Blocklists →", ctaHref: "/blocklists", steps: [ { @@ -661,7 +661,7 @@ const HomePage = () => {
@@ -700,11 +700,12 @@ const HomePage = () => { { label: "💻 CLI Reference", href: "/docs/next/cscli/" }, { label: "🔑 CTI API Keys", href: "/u/console/ip_reputation/api_keys" }, { label: "❓ Troubleshooting", href: "/u/troubleshooting/intro" }, - { - label: "📖 Docs AI Assistant", - href: "https://chatgpt.com/g/g-682c3a61a78081918417571116c2b563-crowdsec-documentation", - external: true, - }, + // Need to redo the prompt this one is out of date + // { + // label: "📖 Docs AI Assistant", + // href: "https://chatgpt.com/g/g-682c3a61a78081918417571116c2b563-crowdsec-documentation", + // external: true, + // }, { label: "🌐 WWW - CrowdSec", href: "https://www.crowdsec.net", external: true }, ].map(({ label, href, external }) => (