CrowdSec
Open-source security engine that detects attacks from logs and HTTP traffic and blocks bad IPs, using a shared
- Stars
- 15.4k
- Forks
- 756
- Licence
- MIT
- Language
- Go
- Last update
- 6 days ago
- Type
- App
What it is
CrowdSec is a security engine that watches logs and web requests for suspicious behavior such as brute-force attempts and port scans, then blocks the offending IP addresses. Its firewall or proxy 'bouncers' carry out the blocking, so detection and blocking can run on different machines. Users can also contribute detected attacks to a shared community blocklist, so an IP seen attacking one member can be blocked for others.
- Detect brute-force attempts against SSH or web logins from log files
- Block IP addresses on the community blocklist at a firewall or reverse proxy
- Run a web application firewall that can load OWASP Core Rule Set rules
- Send a JavaScript proof-of-work challenge to suspicious requests to slow down scrapers
Great for
- System administrators who run Linux servers and want fail2ban-style protection with more flexibility
- Teams running several servers or containers who want logs analyzed in one place
- Operators of websites who want a web application firewall and bot challenges
- People who want to use an existing community blocklist of malicious IPs
Not ideal for
- Users who want a simple one-click desktop tool, since the README describes it as a server security engine
- Setups that cannot send or receive threat data from an external service, because the community blocklist depends on a central API
- Anyone without someone to configure log sources and remediation rules, since setup is described as requiring configuration
How to get it
- 1
See the README
Clone the repository
git clone https://github.com/crowdsecurity/crowdsec - 2
Run it
- Follow the official documentation at https://docs.crowdsec.net to install the Security Engine for your platform
- Choose and install scenarios or collections from the hub at https://hub.crowdsec.net
- Install a remediation component (bouncer) that matches your firewall or proxy
- Check that alerts appear in the engine and that blocks are applied
- 3
Get the most out of it
- Use the hub to add scenarios beyond the defaults such as brute force, port scan, and web scan
- Enable the AppSec component to use WAF rules and JavaScript proof-of-work challenges for bots
- Connect the engine to the Console at app.crowdsec.net for visualization and management
- Deploy bouncers on separate machines to block at firewall, reverse proxy, or CDN level
Downloads
Strengths
- Combines log-based intrusion detection and a web application firewall in one engine
- Detection and remediation can be split across machines, as described in the README
- Rules are published under MIT license and can be extended from a hub
Trade-offs
- The README does not describe setup difficulty, so expect a learning curve for configuration
- Community blocklist and console features rely on a hosted service; some premium features are mentioned but not detailed
- The README is truncated and does not list all supported platforms or install steps
How it compares
| Project | Stars | Type | Level | Updated | Best for |
|---|---|---|---|---|---|
| crowdsec (this) | 15.4k | App | intermediate | 6 days ago | System administrators who run Linux servers and want fail2ban-style protection with more flexibility |
| camofox-browser | 12.1k | App | intermediate | 4 days ago | Developers building AI agents that need to read or interact with websites |
| quivr | 39.6k | Framework | advanced | 4 days ago | Developers building a search or monitoring pipeline over a stream of documents |
| gluetun | 16k | App | intermediate | 8 days ago | People who want one Docker container to run traffic through a VPN for other containers |
| uptime-kuma | 93.2k | App | beginner | 4 days ago | People who want to monitor their own websites or services without paying a hosted monitoring service |
| traefik | 65.4k | App | intermediate | 4 days ago | Teams running many microservices in Docker, Swarm, or Kubernetes |
Stats synced from GitHub. The assessment above was drafted with AI from the project's README on 2026-10-29 and may miss recent changes — check the README before relying on a command. MIT licence: free to use, modify and distribute, including commercially, as long as you keep the copyright notice.