CrowdSec

CrowdSec detects attacks on your machine and bans them through its bouncers. Two things are worth wiring up: report what CrowdSec bans locally, so everyone else can block it too, and import the isipsafe list as decisions, so your bouncers block known attackers before they try.

Report what CrowdSec bans

1. Create a notification in /etc/crowdsec/notifications/isipsafe.yaml. It sends the bans of the last 30 minutes as one CSV upload, which keeps a free account well inside its daily bulk-upload allowance:

   type: http
   name: isipsafe
   log_level: info
   group_wait: 30m
   
   format: |
     IP,Categories,ReportDate,Comment
     {{range . -}}{{range .Decisions -}}
     {{.Value}},15,,CrowdSec {{.Scenario}}
     {{end -}}{{end -}}
   
   url: https://isipsafe.com/api/v1/bulk-report
   method: POST
   headers:
     Content-Type: text/csv
     Authorization: Bearer sl_your_key_here

2. Turn it on in /etc/crowdsec/profiles.yaml, in the default_ip_remediation profile:

   notifications:
     - isipsafe

   Profiles only see alerts from your own scenarios, so bans that arrived from the community blocklist or from imports are not reported back.
3. Reload with sudo systemctl reload crowdsec, then check with sudo cscli notifications list. Category 15 is Hacking; the scenario name in the comment tells readers what happened. To be more specific, add one notification per scenario family (for example 18,22 for crowdsecurity/ssh-bf) and filter with filters in a dedicated profile.

Import the list as decisions

Hourly from cron, add every listed address with a confidence of 90 or more as a ban that expires after two hours, so addresses that drop off the list are released automatically:

curl -sf "https://isipsafe.com/api/v1/blocklist?key=$ISIPSAFE_KEY&format=txt&confidenceMinimum=90&limit=50000" -o /tmp/isipsafe.txt \
  && cscli decisions import -i /tmp/isipsafe.txt --format values --duration 2h --reason "isipsafe blocklist" --type ban

Every bouncer connected to this CrowdSec instance (nginx, firewall, Cloudflare) then enforces the list. cscli decisions list --origin cscli-import shows what was imported.

Need a hand?

If something here does not work with your version of CrowdSec, or you have improved it, tell us. We update these pages with what people send.

CrowdSec and its logo are trademarks of their respective owners. isipsafe is not affiliated with or endorsed by them.