Installation

Configurations

We use a helm chart to deploy crowdsec (crowdsecurity.cue)

Basic configuration

Use plugins

Crowdsed comes with a mecanism of plugin to do some alerting tasks. An example of plugin is the http plugin which allows us to send http requests to a server to notify when a scenario is triggered.

We created a plugin to send alerts to alertmanager, here is the configurations:

config: {   
    "profiles.yaml": """      
         name: default_ip_remediation 
         debug: true 
         filters: 
         - 1==1 
         decisions:
          - type: ban
            duration: 1h
         notifications:
           - alertmanager
         on_success: break
        """
    notifications: {
        "alertmanager.yaml": """
            type:     "alertmanager"
            name:     "alertmanager"
            format: |
              {{.|toJson}}
            loglevel: "info"
            host:     "alertmanager-mon3-0.obs-corp-stg.csfpriv.com"
            user:   "\(AlertmngrCrds.username)"
            password: "\(AlertmngrCrds.password)"
            basepath: "/api/v1"
            schemes: ["https"]
            cluster: "\(zone.cluster_zone_name)"
            team: "\(configurations.crowdsecurity.owners[0])"
        """
    }
}

The porfiles.yaml file is the configuration file for crowdsec where we set the action to taks when scenario is triggered and the plugins we want to use.

The alertmanager.yaml is created by the configuration to set parameters for the selected plugin.

See documentation for more details