diff --git a/crowdsec/SKILL.md b/crowdsec/SKILL.md index d5018d3..620070f 100644 --- a/crowdsec/SKILL.md +++ b/crowdsec/SKILL.md @@ -1,11 +1,11 @@ --- name: crowdsec +version: 0.0.1 description: >- Deploy, configure, and manage CrowdSec — the open-source, collaborative IPS/IDPS/WAF. - Covers Security Engine installation (Linux, Docker), cscli hub management, remediation - components (firewall, Traefik, Nginx, Caddy), AppSec WAF, profiles, notifications, - blocklists, CTI, metrics, and production best practices. Use when setting up or - troubleshooting CrowdSec. + Covers Security Engine setup (Linux, Docker), cscli hub management, remediation + components, AppSec WAF, profiles, notifications, blocklists, CTI, and metrics. + Use when setting up or troubleshooting CrowdSec. license: MIT compatibility: Any agent supporting Agent Skills format — commands use standard shell and CLI tools metadata: @@ -47,7 +47,7 @@ CrowdSec has a modular, API-centric architecture. The main components: | List alerts | `sudo cscli alerts list` | | List decisions | `sudo cscli decisions list` | | Manually ban IP | `sudo cscli decisions add --ip ` | -| Manually unban IP | `sudo cscli decisions remove --ip ` | +| Manually unban IP | `sudo cscli decisions delete --ip ` (or `remove --ip`, which is an alias) | | View status | `sudo systemctl status crowdsec` | | Reload config | `sudo systemctl reload crowdsec` | @@ -132,6 +132,8 @@ labels: The `labels.type` field is **mandatory** — it determines which parsers handle the logs. +> **Note:** For log files on network shares (NFS, SMB) or Docker bind mounts where inotify doesn't work reliably, add `poll_without_inotify: true` to the acquisition entry. This polls the file at intervals instead of relying on filesystem events. + ### Profiles (`/etc/crowdsec/profiles.yaml`) Controls what remediation action is taken when a scenario triggers: @@ -164,65 +166,15 @@ exclusions: **Global flags:** `-c ` (config path), `-o json|human|raw` (output format), `--debug`, `--color` -### Hub Management +| Category | Key Commands | Load detail | +|----------|-------------|-------------| +| Hub Management | `cscli hub update`, `cscli collections install/list/upgrade/inspect`, `cscli parsers install/list/upgrade`, `cscli scenarios install/list/upgrade` | `references/cscli-command-reference.md` | +| Decisions & Alerts | `cscli decisions add/list/delete`, `cscli alerts list/inspect` | `references/cscli-command-reference.md` | +| Bouncers & Agents | `cscli bouncers add/list/delete`, `cscli machines add/list/delete` | `references/cscli-command-reference.md` | +| Metrics | `cscli metrics`, `cscli metrics show appsec\|bouncers` | `references/cscli-command-reference.md` | +| Console & LAPI | `cscli console status/enroll`, `cscli lapi register` | `references/cscli-command-reference.md` | -| Command | Description | -|---------|-------------| -| `cscli hub update` | Update the local hub index | -| `cscli collections install ` | Install a collection | -| `cscli collections list` | List installed collections | -| `cscli collections list --all` | List all available collections | -| `cscli collections upgrade ` | Upgrade a collection | -| `cscli collections inspect ` | Show collection details and metrics | -| `cscli parsers install ` | Install a parser | -| `cscli parsers list` | List installed parsers | -| `cscli parsers upgrade ` | Upgrade a parser | -| `cscli parsers inspect ` | Show parser details/metrics | -| `cscli scenarios install ` | Install a scenario | -| `cscli scenarios list` | List installed scenarios | -| `cscli scenarios upgrade ` | Upgrade a scenario | -| `cscli scenarios inspect ` | Show scenario details/metrics | -| `cscli appsec-rules list` | List installed AppSec rules | -| `cscli appsec-configs list` | List AppSec configurations | - -### Decision & Alert Management - -| Command | Description | -|---------|-------------| -| `cscli decisions add --ip [--duration 4h] [--type ban]` | Add a manual decision | -| `cscli decisions list` | List active decisions | -| `cscli decisions delete --id ` | Delete a specific decision | -| `cscli decisions delete --ip ` | Delete decisions for an IP | -| `cscli alerts list` | List alerts | -| `cscli alerts list --contain "scenario:ssh-bf"` | Filter alerts | -| `cscli alerts inspect ` | Show alert details | - -### Bouncer & Agent Management - -| Command | Description | -|---------|-------------| -| `cscli bouncers add ` | Add a bouncer and generate API key | -| `cscli bouncers list` | List all bouncers | -| `cscli bouncers delete ` | Remove a bouncer | -| `cscli machines add [--password ]` | Register an agent machine | -| `cscli machines list` | List registered agents | -| `cscli machines delete ` | Remove an agent | - -### Metrics & Observability - -| Command | Description | -|---------|-------------| -| `cscli metrics` | Full metrics dashboard | -| `cscli metrics show appsec` | AppSec-specific metrics | -| `cscli metrics show bouncers` | Bouncer-specific metrics | - -### Console & LAPI - -| Command | Description | -|---------|-------------| -| `cscli console status` | Check console connection status | -| `cscli console enroll ` | Enroll engine in CrowdSec Console | -| `cscli lapi register` | Register remote agent to LAPI | +See the full command reference with every subcommand and flag at `references/cscli-command-reference.md`. ## Hub Collections @@ -523,6 +475,7 @@ Load the following reference files for deeper coverage of specific topics: | Reference | Load when | File | |-----------|-----------|------| | Full config.yaml reference | You need every configuration directive explained | `references/config-reference.md` | +| cscli command reference | You need every cscli subcommand and flag | `references/cscli-command-reference.md` | | AppSec WAF deep dive | Setting up or troubleshooting AppSec | `references/appsec-deep-dive.md` | | Docker deployment guide | Running CrowdSec in Docker Compose | `references/docker-deployment.md` | | Traefik bouncer setup | Integrating with Traefik reverse proxy | `references/traefik-bouncer.md` | diff --git a/crowdsec/references/cscli-command-reference.md b/crowdsec/references/cscli-command-reference.md new file mode 100644 index 0000000..b765bd6 --- /dev/null +++ b/crowdsec/references/cscli-command-reference.md @@ -0,0 +1,105 @@ +# cscli Command Reference + +Full reference for `cscli` — the CrowdSec command-line tool for managing the entire stack. + +## Global Flags + +``` +-c, --config string path to crowdsec config file (default "/etc/crowdsec/config.yaml") +-o, --output string Output format: human, json, raw + --color string Output color: yes, no, auto (default "auto") + --debug Set logging to debug + --info Set logging to info + --warning Set logging to warning + --error Set logging to error + --trace Set logging to trace +-h, --help help for cscli +``` + +## Hub Management + +| Command | Description | +|---------|-------------| +| `cscli hub update` | Update the local hub index | +| `cscli hub list` | List hub index info | +| `cscli collections install ` | Install a collection | +| `cscli collections list` | List installed collections | +| `cscli collections list --all` | List all available collections | +| `cscli collections upgrade ` | Upgrade a collection | +| `cscli collections inspect ` | Show collection details and metrics | +| `cscli collections delete ` | Remove a collection | +| `cscli parsers install ` | Install a parser | +| `cscli parsers list` | List installed parsers | +| `cscli parsers list --all` | List all available parsers | +| `cscli parsers upgrade ` | Upgrade a parser | +| `cscli parsers inspect ` | Show parser details/metrics | +| `cscli parsers delete ` | Remove a parser | +| `cscli scenarios install ` | Install a scenario | +| `cscli scenarios list` | List installed scenarios | +| `cscli scenarios list --all` | List all available scenarios | +| `cscli scenarios upgrade ` | Upgrade a scenario | +| `cscli scenarios inspect ` | Show scenario details/metrics | +| `cscli scenarios delete ` | Remove a scenario | +| `cscli postoverflows install ` | Install a postoverflow | +| `cscli postoverflows list` | List installed postoverflows | +| `cscli appsec-rules list` | List installed AppSec rules | +| `cscli appsec-configs list` | List AppSec configurations | +| `cscli contexts list` | List contexts | +| `cscli hubtest` | Run functional tests on hub configurations | + +## Decision & Alert Management + +| Command | Description | +|---------|-------------| +| `cscli decisions add --ip [--duration 4h] [--type ban] [--reason "..."]` | Add a manual decision | +| `cscli decisions list` | List active decisions | +| `cscli decisions list -o json` | List decisions as JSON (includes CTI data) | +| `cscli decisions delete --id ` | Delete a specific decision by ID | +| `cscli decisions delete --ip ` | Delete all decisions for an IP | +| `cscli alerts list` | List alerts | +| `cscli alerts list --contain "scenario:ssh-bf"` | Filter alerts by scenario | +| `cscli alerts inspect ` | Show alert details | + +## Bouncer & Agent Management + +| Command | Description | +|---------|-------------| +| `cscli bouncers add ` | Add a bouncer and generate API key (shown once only) | +| `cscli bouncers list` | List all bouncers with IP, validity, last pull | +| `cscli bouncers delete ` | Remove a bouncer | +| `cscli machines add [--password ]` | Register an agent machine | +| `cscli machines list` | List registered agents | +| `cscli machines delete ` | Remove an agent | + +## Metrics & Observability + +| Command | Description | +|---------|-------------| +| `cscli metrics` | Full metrics dashboard | +| `cscli metrics -o json` | JSON output for programmatic use | +| `cscli metrics show appsec` | AppSec-specific metrics (processed vs blocked) | +| `cscli metrics show bouncers` | Bouncer-specific metrics | + +## Console & LAPI + +| Command | Description | +|---------|-------------| +| `cscli console status` | Check console connection status | +| `cscli console enroll ` | Enroll engine in CrowdSec Console | +| `cscli lapi register` | Register remote agent to LAPI | + +## Additional Commands + +| Command | Description | +|---------|-------------| +| `cscli version` | Display version and build info | +| `cscli config` | View current configuration | +| `cscli explain` | Explain log pipeline — simulate how a log line is processed | +| `cscli simulation` | Manage simulation status of scenarios | +| `cscli allowlists` | Manage centralized allowlists (v1.6+) | +| `cscli capi` | Manage interaction with Central API | +| `cscli papi` | Manage interaction with Polling API | +| `cscli dashboard` | Manage Metabase dashboard container | +| `cscli support` | Generate support bundle for troubleshooting | +| `cscli notifications list` | List notification plugins | +| `cscli notifications test ` | Test a notification plugin |