cscli metrics show acquisitioncscli collections listcscli collections listcscli collections inspectpierre42100/bots-user-agentscrowdsecurity/http-bad-user-agent Name ๐ฆ Status Version Local Path
crowdsecurity/base-http-scenarios โ๏ธ enabled 1.2 /etc/crowdsec/collections/base-http-scenarios.yaml
crowdsecurity/http-cve โ๏ธ enabled 2.9 /etc/crowdsec/collections/http-cve.yaml
crowdsecurity/traefik โ๏ธ enabled 0.1 /etc/crowdsec/collections/traefik.yaml
pierre42100/custom ๐ enabled,local /etc/crowdsec/collections/custom_collection.yaml cscli collections inspect pierre42100/customtype: collections
name: pierre42100/custom
file_name: custom_collection.yaml
dependencies: {}
local_path: /etc/crowdsec/collections/custom_collection.yaml
downloadpath: ""
up_to_date: true
tainted: false
installed: true
local: true
Current metrics: cscli hub update and cscli hub upgradecrowdsec-1 | time="2025-12-01T17:19:59+01:00" level=info msg="WAF block: anomaly score block: rfi: 5, anomaly: 5, from <myIP> (172.22.0.2)"
crowdsec-1 | time="2025-12-01T17:19:59+01:00" level=info msg="(localhost) alert : anomaly score block: rfi: 5, anomaly: 5, by ip <myIP> (FR/12322)"root@localhost:~# docker exec crowdsec cscli notifications test discord
level=info msg="Crowdsec CTI helper enabled"
time="2025-11-29T16:52:38Z" level=debug msg="starting plugin" args="[/usr/local/lib/crowdsec/plugins/notification-http]" path=/usr/local/lib/crowdsec/plugins/notification-http
time="2025-11-29T16:52:38Z" level=debug msg="plugin started" path=/usr/local/lib/crowdsec/plugins/notification-http pid=538
time="2025-11-29T16:52:38Z" level=debug msg="waiting for RPC address" plugin=/usr/local/lib/crowdsec/plugins/notification-http
time="2025-11-29T16:52:38Z" level=debug msg="using plugin" version=1
time="2025-11-29T16:52:38Z" level=trace msg="waiting for stdio data"
level=info msg="registered plugin discord"
level=info msg="registered plugin http_default"
level=info msg="pluginTomb dying"
time="2025-11-29T16:52:38Z" level=info msg="cti call for 10.10.10.10" type=crowdsec-cti
time="2025-11-29T16:52:39Z" level=debug msg="request for 10.10.10.10 took 661.664301ms" type=crowdsec-cti
time="2025-11-29T16:52:39Z" level=info msg="received signal for discord config" @module=http-plugin
level=info msg="killing all plugins"
time="2025-11-29T16:52:39Z" level=debug msg="received EOF, stopping recv loop" err="rpc error: code = Unavailable desc = error reading from server: EOF"
time="2025-11-29T16:52:39Z" level=info msg="plugin process exited" id=538 plugin=/usr/local/lib/crowdsec/plugins/notification-http
time="2025-11-29T16:52:39Z" level=debug msg="plugin exited"name: pierre42100/custom
parsers:
- crowdsecurity/traefik-logs
collections:
# Rely on Traefik
- crowdsecurity/base-http-scenarios
description: "Custom collection for custom scenarios"
author: pierre42100
scenarios:
- pierre42100/bots-user-agents
tags:
- custom
- traefik
- http
- bruteforce # crowdsec container data
- /etc/crowdsec/acquis.yaml:/etc/crowdsec/acquis.yaml
- crowdsec-db:/var/lib/crowdsec/data
- crowdsec-config:/etc/crowdsec