spb/tools-spboucher-ai

1{2  "slug": "crowdsec",3  "name": "CrowdSec",4  "aliases": ["CrowdSec Security Engine"],5  "vendor": { "name": "CrowdSec", "slug": "crowdsec", "website": "https://www.crowdsec.net" },6  "homepage_url": "https://www.crowdsec.net/",7  "docs_url": "https://docs.crowdsec.net/",8  "repo_url": "https://github.com/crowdsecurity/crowdsec",9  "pricing_url": "https://www.crowdsec.net/pricing",10  "license_url": "https://github.com/crowdsecurity/crowdsec/blob/master/LICENSE",11  "product_type": "platform",12  "product_status": "active",13  "summary": "Open-source behavior-based intrusion prevention engine whose detections feed a crowd-sourced IP reputation network, with remediation components for firewalls, proxies and CDNs",14  "description": "CrowdSec is an intrusion prevention system from the company of the same name. Its Security Engine, open source under the MIT license and written in Go, parses logs or network data, evaluates them against scenarios (brute force, scanning, HTTP exploits, bot patterns) and raises decisions such as bans. Separate remediation components, formerly called bouncers, enforce those decisions in iptables or nftables, NGINX, Traefik, Caddy, HAProxy, Cloudflare, AWS WAF and other integration points.\n\nThe distinguishing element is the crowd: engines that opt in share signals about aggressive IPs with CrowdSec's central API and receive a community blocklist in return, so a server benefits from attacks seen elsewhere before it is targeted. A hosted console displays alerts across engines and offers additional curated blocklists and threat-intelligence lookups on free and paid plans.\n\nCrowdSec runs on Linux, FreeBSD, Windows and in containers, and replaces Fail2Ban for many users. It has more moving parts than Fail2Ban, scenario tuning takes time, and the shared-intelligence features depend on the vendor's service.",15  "capabilities": ["Log and network parsing with scenario-based detection written in YAML", "Remediation components for firewalls, reverse proxies, CDNs and cloud WAFs", "Crowd-sourced community blocklist exchanged through the central API", "Hub of parsers, scenarios and collections for common services", "Hosted console with alert visualization and additional blocklists", "Local API for multi-machine deployments"],16  "workflows": ["Protect SSH and web services on a VPS with firewall remediation", "Block attackers at a Traefik or Caddy proxy before they reach applications", "Subscribe to curated blocklists for a fleet through the console"],17  "advantages": ["MIT-licensed engine with shared threat intelligence", "Wide set of remediation integrations", "Behavior scenarios beyond simple failed-login counting"],18  "limitations": ["More components to install and tune than Fail2Ban", "Community and premium blocklists depend on the vendor's service", "Console features are tiered"],19  "prerequisites": ["Linux, FreeBSD or Windows host or container", "Logs or traffic to analyze"],20  "audiences": ["Server administrators and self-hosters", "Security teams managing many hosts"],21  "alternatives": ["fail2ban"],22  "comparison_notes": "Fail2Ban is a single-host log watcher with firewall actions and no external dependencies; CrowdSec adds a shared reputation network, richer scenarios and enforcement at proxies and CDNs.",23  "categories": [{ "slug": "security-tools", "primary": true }],24  "tags": ["intrusion-prevention", "threat-intelligence", "firewall", "open-source", "self-hosted", "go", "security"],25  "use_cases": ["harden-servers"],26  "operating_systems": ["linux", "windows"],27  "execution_modes": ["self-hosted", "cloud"],28  "interfaces": ["cli", "api", "web"],29  "deployment_models": ["on-premises", "hybrid"],30  "integrations": ["iptables", "nftables", "NGINX", "Traefik", "Caddy", "HAProxy", "Cloudflare", "AWS WAF", "Docker"],31  "data_formats": ["YAML scenarios and parsers", "log files"],32  "languages": ["Go"],33  "source_model": "mixed",34  "license_spdx": "MIT",35  "pricing_model": ["open-source", "freemium", "paid", "enterprise"],36  "pricing_checked_at": "2026-11-02",37  "self_hostable": true,38  "sources": [39    { "url": "https://www.crowdsec.net/", "type": "official_site", "title": "CrowdSec", "supports": ["name", "summary", "vendor"], "checked_at": "2026-11-02" },40    { "url": "https://docs.crowdsec.net/", "type": "official_docs", "title": "CrowdSec Documentation", "supports": ["capabilities", "integrations", "operating_systems"], "checked_at": "2026-11-02" },41    { "url": "https://github.com/crowdsecurity/crowdsec/blob/master/LICENSE", "type": "license_page", "title": "CrowdSec LICENSE (MIT)", "supports": ["license_spdx", "source_model"], "checked_at": "2026-11-02" },42    { "url": "https://www.crowdsec.net/pricing", "type": "pricing_page", "title": "CrowdSec Pricing", "supports": ["pricing_model"], "checked_at": "2026-11-02" }43  ],44  "confidence": "high",45  "discovery_method": "editorial-research",46  "depth": "standard",47  "editorial_status": "reviewed",48  "visibility": "public",49  "featured": false,50  "author": "batch-B2"51}52