mirror of
https://github.com/magnus919/agent-skills.git
synced 2026-09-11 19:47:12 +03:00
Magnus HedemarkandGitHub
9f49558eed
Clarify state-changing CrowdSec hub updates and frame CLI Builder idempotency and JSON as contracts.
3.4 KiB
3.4 KiB
Hub Collections Reference
Essential CrowdSec hub collections organized by category.
Infrastructure Protection
| Collection | Protects | Includes |
|---|---|---|
crowdsecurity/linux |
Linux system logs | Syslog parser, geoip, date parsing |
crowdsecurity/sshd |
SSH service | SSH parser + SSH brute force scenario |
crowdsecurity/mysql |
MySQL database | MySQL parser + brute force scenario |
crowdsecurity/postgres |
PostgreSQL | PostgreSQL parser + scenarios |
crowdsecurity/whitelist-good-actors |
False positive prevention | SEO bots, CDN whitelists (Cloudflare, Google, etc.), reverse DNS |
Web Server Protection
| Collection | Protects |
|---|---|
crowdsecurity/nginx |
Nginx web server |
crowdsecurity/apache2 |
Apache httpd |
crowdsecurity/caddy |
Caddy web server |
crowdsecurity/traefik |
Traefik reverse proxy |
crowdsecurity/base-http-scenarios |
Generic HTTP attack scenarios |
crowdsecurity/http-cve |
CVE-based HTTP attack detection |
HTTP Attack Scenarios (from base-http-scenarios)
| Scenario | Detects |
|---|---|
crowdsecurity/http-crawl-non_statics |
Directory enumeration / forced browsing |
crowdsecurity/http-probing |
General HTTP probing |
crowdsecurity/http-bad-user-agent |
Known malicious user agents (nmap, sqlmap, gobuster, etc.) |
crowdsecurity/http-sensitive-files |
Attempts to access sensitive files (.env, .git, wp-admin) |
crowdsecurity/http-backdoors-attempts |
Backdoor / webshell access attempts |
crowdsecurity/http-sqli-probing |
SQL injection probing |
crowdsecurity/http-xss-probing |
Cross-site scripting probing |
crowdsecurity/http-path-traversal-probing |
Path traversal attempts |
crowdsecurity/http-bf-wordpress_bf |
WordPress brute force |
crowdsecurity/http-bf-joomla_bf |
Joomla brute force |
AppSec / WAF
| Collection | Description |
|---|---|
crowdsecurity/appsec-virtual-patching |
Virtual patching rules for known CVEs |
crowdsecurity/appsec-crs |
OWASP Core Rule Set (ModSecurity-compatible) |
crowdsecurity/appsec-generic-rules |
Generic WAF rules |
Bouncer Types
| Bouncer | Level | Supports AppSec |
|---|---|---|
| Firewall (iptables/nftables) | Network (IP-level) | No |
| Traefik plugin | Reverse proxy | Yes |
| Nginx | Web server | Yes |
| Caddy module | Web server | Yes |
| HAProxy SPOE | Reverse proxy | Yes |
| Cloudflare worker | CDN | No |
| Blocklist mirror | Downloadable list | No |
| Custom bouncer | Programmatic (LAPI API) | Via integration |
Finding Collections
Browse all available collections:
- Web UI: https://app.crowdsec.net/hub/collections
- CLI:
sudo cscli collections list --all - Hub: https://hub.crowdsec.net/browse/#collections
Collection Management Commands
# Install
sudo cscli collections install crowdsecurity/nginx
# List installed
sudo cscli collections list
# List all available
sudo cscli collections list --all
# Inspect (shows version + runtime metrics)
sudo cscli collections inspect crowdsecurity/nginx
# Refresh the hub index, then upgrade (state-changing; confirm the safety gate first)
sudo cscli hub update
sudo cscli collections upgrade crowdsecurity/nginx
# Remove
sudo cscli collections delete crowdsecurity/nginx
After installing/upgrading collections:
sudo systemctl reload crowdsec