CrowdSec

What it is

An open-source security engine that parses logs and web requests, runs behavior scenarios against them, and hands decisions to separate remediation components called bouncers. Detection and blocking are decoupled, so one machine can analyze while another enforces.

What it helps with

- Detecting brute force, port scans, and web scans from existing logs
- Blocking offending IPs at a firewall, reverse proxy, or CDN
- Filtering web requests with its built-in WAF component
- Pulling extra detection scenarios from a public hub

Who it's for

Sysadmins, hosting providers, and SOC teams protecting servers and web services they run.

Worth knowing

The engine is free and open source, and installs share signals that build a community blocklist. A hosted console has a free tier, while Premium and Enterprise plans add stack management, extra blocklists, and alert features.

Is the engine itself limited on the free plan?
No, detection and blocking run fully without paying, and the paid tiers sit in the console.

How does it compare with Suricata?
In our view they complement each other, since Suricata inspects network packets while CrowdSec works from logs and requests.

Can it run in containers?
Yes, Docker and Kubernetes deployments are supported.