# CrowdSec

CrowdSec is a free, open-source IDS/IPS and WAF that detects malicious behavior by analyzing server logs and HTTP requests, then blocks offending IPs in real time. It is open source and self-hosted, installable on Proxmox, Docker Hub, Kubernetes (Helm) and Unraid.

Canonical page: https://ourlocalhost.com/app/473/crowdsec

## Description

CrowdSec is a free, open-source IDS/IPS and WAF that detects malicious behavior by analyzing server logs and HTTP requests, then blocks offending IPs in real time. It shares threat signals with a global community, giving self-hosters a crowdsourced, always-current blocklist for protecting their infrastructure. For reverse-proxy integration, pair it with a dedicated bouncer such as the CrowdSec Traefik Bouncer.

## Platform availability

Available on 4 of 9 platforms: Unraid, Proxmox, Helm, Windows.

## Desktop and other devices

Windows.

## Health score

86/100 (Excellent), based on 4 of 4 factors.
- Maintained: 100 (last commit 15 days ago)
- Popular: 84 (15,101 GitHub stars)
- Easy to install: 55 (3 install platforms, install notes, Docker image)
- Light to run: 95 (512 MB minimum RAM, runs on ARM)

## Links

- Proxmox: https://community-scripts.github.io/ProxmoxVE/scripts?id=crowdsec
- GitHub: https://github.com/crowdsecurity/crowdsec
- Docker Hub: https://hub.docker.com/r/crowdsecurity/crowdsec
- desktop: https://github.com/crowdsecurity/crowdsec/releases/latest
- Kubernetes (Helm): https://artifacthub.io/packages/helm/crowdsec/crowdsec
- Unraid: https://ca.unraid.net/apps/crowdsec-1fxlnq502ihoc1?q=crowdsec
- Official website: https://crowdsec.net/
- Documentation: https://doc.crowdsec.net/

## Common questions

### Do I need an extra component when running CrowdSec with Traefik?

Yes, if you use Traefik you should also install the traefik-bouncer. It lets CrowdSec apply blocks at the reverse proxy.

### What setup step should I run first to make CrowdSec see my services?

Run cscli setup interactive before doing much else. It detects which services are running and offers the matching log sources and rules.

### What should I do if CrowdSec sees my logs but does not detect problems?

Install only the parsers that match your logs, such as for sshd or caddy logs. Missing parsers prevent CrowdSec from understanding raw log lines and detecting issues.

### How do I configure the Cloudflare Worker bouncer with CrowdSec?

Add your CrowdSec API tokens to the command before starting it. If the tokens are missing or wrong, Cloudflare cannot apply the bans.

### Is AppSec the same as the main CrowdSec engine?

No, CrowdSec is focused on blocking attackers while AppSec is more about reducing application development risks.

## Alternatives

- Cloudflare: Protects websites with front-end proxy, dynamic DNS, CDN, and firewall; blocks DDoS and targeted attacks, optimizes traffic, and analyzes t…
- Fail2ban: Fail2ban is a daemon that monitors log files and automatically bans hosts that cause multiple authentication failures, using firewall rules…
- IPBanPro: IPBan is a FREE and open source application that allows auto banning ip addresses from failed login attempts.
- defensia-agent

---
Source: Our Local Host (https://ourlocalhost.com/app/473/crowdsec), the self-hosted and open-source app directory.