collaborative defence

CrowdSec

CrowdSec is a collaborative intrusion prevention system. This profile covers what it does, how it is deployed, and where it stops being the right choice.

What the product actually does

CrowdSec reads logs, parses them with scenarios, and decides whether an IP is behaving like an attacker. A decision is enforced locally by a bouncer — at the firewall, in nginx, in the application — and optionally shared with the network.

The sharing is the unusual part. A signal from one installation becomes a reputation entry for every other installation, so an IP that attacks one site is blocked at thousands of others before it reaches them.

How it is deployed and what it costs

Open source and free, with an optional commercial console for central management. The deployment is an agent plus at least one bouncer, and the agent is lightweight enough to run on a small server.

The operational cost is log parsing. Scenarios have to match the log format the service actually produces, and a custom application needs a custom parser.

Where it breaks down

False positives are the risk. A shared reputation list will occasionally contain an address that is a shared NAT or a legitimate crawler, and blocking it takes real users with it. The local allowlist is the mitigation and it has to be maintained.

The tool is a perimeter control. It stops the noisy automated attacks well and does nothing about an attacker who is already authenticated.

What switching costs

Low. The decisions are IP lists and the enforcement is at the network edge; replacing the engine keeps the effect.

Sources

CrowdSec public documentation, read October 2026.