[TP] Lab 4: Track banned IPs and attacks with Prometheus

What you will learn in this TP
Answer with cscli
Expose metrics
Query Prometheus
Alert on health

Introduction #

What you will learn in this section
Answer with cscli
Expose metrics
Query Prometheus
Alert on health

Context. Your manager wants to know each week how many addresses are blocked and which attacks recur.

Prerequisites: lab 1 · Estimated time: 40 min

Guided steps, with their solution.

1. Immediate answers
With cscli, in the lab from lab 1.
2. Add Prometheus
Add this service to the lab 1 Compose file.
3. Open and query
Why? Metrics listen on 127.0.0.1 by default: Prometheus, in another container, would not see them.
4. Alert
Write two health rules and validate them.

Difficulty level : ●●○○○ (2/5)

Monitoring CrowdSec: cscli metrics, banned IPs, detected attacks, volume blocked by bouncers, Pro...

What CrowdSec is, how it detects and blocks attacks: Security Engine, parsers, scenarios, Local A...

Comparing CrowdSec and Fail2ban: detection, blocking, sharing, performance, multi-server, and how...

Install CrowdSec with packages or Docker, understand its files, declare the logs to read, enroll ...

Understanding CrowdSec bouncers: where to block, live and stream modes, API keys, decisions API, ...

Setting up the CrowdSec bouncer in Traefik: plugin, middleware, stream and live modes, real IP be...

Setting up CrowdSec bouncers for Nginx, OpenResty, Apache and HAProxy SPOA: configuration, block ...

Block at the CDN with Cloudflare Workers, feed pfSense or MikroTik with Blocklist Mirror, protect...

Manage decisions with cscli, adapt block duration and type with profiles, avoid false positives w...