Check if decision has been succesfully taken?

I'm really unsure if I've configured crowdsec fully functional now or not.
So

journalctl -u sshd -e

journalctl -u sshd -e

contains messages like this:

Jun 03 02:47:01 server sshd-session[1760286]: Connection reset by authenticating user root 45.140.17.124 port 33492 [preauth]

Jun 03 02:47:01 server sshd-session[1760286]: Connection reset by authenticating user root 45.140.17.124 port 33492 [preauth]

cscli explain --log <the log entry> --type syslog

cscli explain --log <the log entry> --type syslog

gives me this:

line: Jun 03 02:47:01 server sshd-session[1760286]: Connection reset by authenticating user root 45.140.17.124 port 33492 [preauth]
        ├ s00-raw
        |       ├ 🔴 crowdsecurity/cri-logs
        |       ├ 🔴 crowdsecurity/docker-logs
        |       └ 🟢 crowdsecurity/syslog-logs (+12 ~9)
        ├ s01-parse
        |       ├ 🔴 LePresidente/authelia-logs
        |       ├ 🔴 LePresidente/grafana-logs
        |       └ 🟢 crowdsecurity/sshd-logs (+6 ~1)
        ├ s02-enrich
        |       ├ 🟢 crowdsecurity/dateparse-enrich (+2 ~2)
        |       ├ 🟢 crowdsecurity/geoip-enrich (+13)
        |       ├ 🔴 crowdsecurity/http-logs
        |       └ 🟢 crowdsecurity/whitelists (unchanged)
        ├-------- parser success 🟢
        ├ Scenarios
                ├ 🟢 crowdsecurity/ssh-bf
                ├ 🟢 crowdsecurity/ssh-bf_user-enum
                ├ 🟢 crowdsecurity/ssh-slow-bf
                └ 🟢 crowdsecurity/ssh-slow-bf_user-enum

line: Jun 03 02:47:01 server sshd-session[1760286]: Connection reset by authenticating user root 45.140.17.124 port 33492 [preauth]
        ├ s00-raw
        |       ├ 🔴 crowdsecurity/cri-logs
        |       ├ 🔴 crowdsecurity/docker-logs
        |       └ 🟢 crowdsecurity/syslog-logs (+12 ~9)
        ├ s01-parse
        |       ├ 🔴 LePresidente/authelia-logs
        |       ├ 🔴 LePresidente/grafana-logs
        |       └ 🟢 crowdsecurity/sshd-logs (+6 ~1)
        ├ s02-enrich
        |       ├ 🟢 crowdsecurity/dateparse-enrich (+2 ~2)
        |       ├ 🟢 crowdsecurity/geoip-enrich (+13)
        |       ├ 🔴 crowdsecurity/http-logs
        |       └ 🟢 crowdsecurity/whitelists (unchanged)
        ├-------- parser success 🟢
        ├ Scenarios
                ├ 🟢 crowdsecurity/ssh-bf
                ├ 🟢 crowdsecurity/ssh-bf_user-enum
                ├ 🟢 crowdsecurity/ssh-slow-bf
                └ 🟢 crowdsecurity/ssh-slow-bf_user-enum

so the parses seem to detect (if I'm interpreting the output right) that this is an attack.
However, if I do

nft list ruleset | grep '45.140.17.124

nft list ruleset | grep '45.140.17.124

I can't find an entry of it. Also I can't find a new alert entry in

cscli alerts list

cscli alerts list

. What could I've been doing wrong?

CrowdSec•6/3/25, 12:52 AM

Important Information

This post has been marked as resolved. If this is a mistake please press the red button below or type

•

6/3/25, 8:10 AM

TTornaxO7 I'm really unsure if I've configured crowdsec fully functional now or not. So `j...

Loz•6/3/25, 8:03 AM

So most of our scenarios are a bucket meaning there must be multiple attempts to login before a alert/decision is made, a single event does not mean bad behaviour (this is contextual to yourself as you may be the sole person logging in so you may want to be more aggressive). Our scenarios are designed to be minimal false positive as possible which may not fit your threat model so you can change the capacity of the scenarios to reduce the attempts before a decisions is made.

TornaxO7OP•6/3/25, 8:10 AM