crowdsecurity/crowdsec

What it does

CrowdSec is an open-source security engine that combines intrusion detection and prevention (IDS/IPS) with a web application firewall (WAF) and bot detection. It analyses log sources and HTTP requests to identify hostile behaviour, then applies remediation through separate components called bouncers at the firewall, reverse proxy or CDN layer. Detection and remediation are decoupled, so logs can be parsed on one machine and blocked somewhere else README.

The default installation ships with scenarios for brute force, port scans and web scans, and more detection rules, parsers and remediation components can be pulled from the CrowdSec Hub README.

The optional crowdsourced blocklist is a second layer: contributed attacks feed a curated list of malicious IPs that participating instances block proactively community blocklist docs. The AppSec component is built on Coraza, so SecLang rules and the OWASP Core Rule Set load unchanged; it can also answer suspicious requests with a JavaScript proof-of-work challenge at a configurable difficulty README.

Who it is for

System administrators and security teams running Linux, Windows, Docker or Kubernetes workloads who want fail2ban-style behaviour blocking with centralised detection and multiple enforcement points, and who may want to opt into shared threat intelligence.

Quick start

The engine is installed from the official documentation, which covers Linux, Windows, Docker, OpenWrt/OPNsense, Kubernetes and other targets installation guide. The README itself does not contain the install commands or the engine's configuration steps, so use that guide rather than copying commands from here.

A typical full setup proceeds in three parts:

1. Install the Security Engine on the host or cluster where logs are collected.
2. Install at least one remediation component (bouncer) for the enforcement point you use — firewall, nginx, Traefik, Cloudflare and others are listed in the repository's linked docs on bouncers bouncers documentation.
3. Choose whether to enrol the instance with the CrowdSec Console for visualisation and extra blocklists Console.

Participation and privacy

The crowdsourced blocklist is optional. Without contributing, the engine still works with local scenarios and remediations, but you do not receive the community IP reputation data — a point the team clarified during the project's early discussion HN comment. Contributing sends offending IP, timestamp and triggered scenario for consensus building, not full log content, according to the same discussion HN comment.

Constraints

• Detection coverage depends on the installed scenarios and the log formats you feed in; added rules come from the Hub and are distributed under the MIT license README.
• Bouncers are separate packages, so a working block requires both the engine and a remediation component for your stack.
• The AppSec WAF runs on Coraza and accepts SecLang and OWASP CRS rules, so existing ModSecurity-style rule sets can be reused README.
• The repository is MIT-licensed; the Console is a hosted service with premium features, distinct from the self-hostable engine README.

HotRepo's take

CrowdSec's strongest public discussion came in 2020, when it was presented as a Go-based fail2ban alternative and drew 170 points and 93 comments on Hacker News HN thread. That thread centred on the opt-in nature of data sharing and on integration requests such as Caddy support Caddy request, themes that still define how new users evaluate the project. On HotRepo the repository recorded 24 stars gained in the Go daily ranking on 2026-11-13, placing 11th that day, which is a moderate signal for a project of this size rather than a breakout. Its long-term value rests less on the star count than on the decoupled detect-here/remedy-there architecture and the Hub ecosystem of rules and bouncers.