Collections, parsers and scenarios

1. The Hub and collections #

Ready-to-use content.

What is a collection? #

A collection groups what is needed to protect a service: parsers, scenarios and sometimes other collections. Install it rather than assembling the pieces by hand. The Hub lists them.

sudo cscli hub update
sudo cscli collections install crowdsecurity/nginx
sudo cscli collections list
sudo cscli scenarios list
sudo cscli parsers list
sudo systemctl reload crowdsec

# Mises à jour régulières
sudo cscli hub update && sudo cscli hub upgrade

2. Parsers #

Understanding each line.

Three stages #

Each line goes through three stages: s00-raw extracts the message, s01-parse recognizes the service, s02-enrich adds date, country or HTTP fields. The result is an event, with fields such as evt.Meta.source_ip.

cscli explain: the essential tool #

Why did this line trigger nothing? cscli explain shows its path. 🟢: the parser succeeded. 🔴: it does not apply to this line.

sudo cscli explain --log "Nov  7 08:58:22 srv sshd[9]: Failed password for root from 203.0.113.70 port 5 ssh2" --type syslog

line: Nov  7 08:58:22 srv sshd[9]: Failed password for root from 203.0.113.70 port 5 ssh2
	├ s00-raw
	|	└ 🟢 crowdsecurity/syslog-logs (+12 ~9)
	├ s01-parse
	|	├ 🔴 crowdsecurity/nginx-logs
	|	└ 🟢 crowdsecurity/sshd-logs (+9 ~1)
	├ s02-enrich
	|	├ 🟢 crowdsecurity/dateparse-enrich (+2 ~2)
	|	├ 🟢 crowdsecurity/geoip-enrich (+9)
	|	└ 🔴 crowdsecurity/http-logs
	├-------- parser success 🟢
	├ Scenarios
		├ 🟢 crowdsecurity/ssh-bf
		├ 🟢 crowdsecurity/ssh-slow-bf
		└ 🟢 crowdsecurity/ssh-time-based-bf

3. Scenarios #

Recognizing a behavior.

The leaky bucket #

A burst overflows quickly. A visitor making an occasional mistake never fills their bucket: this is what separates an attack from human error.

Writing your scenario #

Let us detect brute force on our login form. Create /etc/crowdsec/scenarios/local-login-bf.yaml:

type: leaky
name: local/login-bf
description: "Detects brute force on the login form"
filter: "evt.Meta.service == 'http' && evt.Parsed.verb == 'POST' && evt.Meta.http_path == '/login' && evt.Meta.http_status == '401'"
groupby: evt.Meta.source_ip
capacity: 4
leakspeed: 10s
blackhole: 1m
labels:
  remediation: true
  service: http
  behavior: http:bruteforce
  label: "Brute force on /login"

sudo systemctl reload crowdsec
sudo cscli scenarios list
sudo cscli alerts list

Testing safely: simulation #

In simulation, the scenario creates an alert and a decision marked (simul), which bouncers do not enforce. Ideal for measuring false positives.

sudo cscli simulation enable local/login-bf
sudo systemctl reload crowdsec
sudo cscli simulation status
sudo cscli decisions list
#  Ip:192.0.2.77 | local/login-bf | (simul)ban

sudo cscli simulation disable local/login-bf

Sources #

• CrowdSec : Scenarios
• CrowdSec : Parsers
• CrowdSec Hub