From 2cd48f0a3b2ebac48a491700a54df06df44df26a Mon Sep 17 00:00:00 2001 From: mmetc <92726601+mmetc@users.noreply.github.com> Date: Wed, 4 Oct 2023 18:20:25 +0200 Subject: [PATCH 1/4] typo and note about apu board (#437) * typo * note about apu board * package table fix --- crowdsec-docs/docs/bouncers/firewall.mdx | 18 ++---------------- .../docs/getting_started/install_freebsd.md | 6 ++++-- .../getting_started/install_freebsd.mdx | 2 +- .../getting_started/install_freebsd.mdx | 4 ++-- .../getting_started/install_freebsd.md | 4 ++-- .../getting_started/install_freebsd.md | 4 ++-- 6 files changed, 13 insertions(+), 25 deletions(-) diff --git a/crowdsec-docs/docs/bouncers/firewall.mdx b/crowdsec-docs/docs/bouncers/firewall.mdx index a05ee0ccc..06e0ffcc3 100644 --- a/crowdsec-docs/docs/bouncers/firewall.mdx +++ b/crowdsec-docs/docs/bouncers/firewall.mdx @@ -59,13 +59,6 @@ sudo apt install crowdsec-firewall-bouncer-iptables sudo yum install crowdsec-firewall-bouncer-iptables ``` - - - -```bash -sudo pkg install crowdsec-firewall-bouncer -``` - @@ -92,13 +85,6 @@ sudo apt install crowdsec-firewall-bouncer-nftables sudo yum install crowdsec-firewall-bouncer-nftables ``` - - - -```bash -sudo pkg install crowdsec-firewall-bouncer -``` - @@ -323,8 +309,8 @@ table persist ### ipset - ipset lists have to exist before crowdsec-firewall-bouncer starts - you can create them and add them to your iptables like this: + ipset lists have to exist before crowdsec-firewall-bouncer starts. + You can create them and add them to your iptables like this: ```console ipset create crowdsec-blacklists hash:ip timeout 0 maxelem 150000 diff --git a/crowdsec-docs/docs/getting_started/install_freebsd.md b/crowdsec-docs/docs/getting_started/install_freebsd.md index cae92ffdb..ffba828e4 100644 --- a/crowdsec-docs/docs/getting_started/install_freebsd.md +++ b/crowdsec-docs/docs/getting_started/install_freebsd.md @@ -125,7 +125,9 @@ will compile and install the packages and all their dependencies. Then configure ## Troubleshooting -In some case, Crowdsec is unable to generate the machine id. +In some cases, CrowdSec is unable to generate the machine id and is unable to initialize properly. + +We saw it happen with an APU board, likely due to the open source coreboot firmware. Start `hostid` and `hostid_save`: @@ -134,4 +136,4 @@ Start `hostid` and `hostid_save`: /etc/rc.d/hostid_save start ``` -Then start again the Crowdsec' service `service crowdsec start`. \ No newline at end of file +Then start again the CrowdSec' service `service crowdsec start`. diff --git a/crowdsec-docs/versioned_docs/version-v1.3.0/getting_started/install_freebsd.mdx b/crowdsec-docs/versioned_docs/version-v1.3.0/getting_started/install_freebsd.mdx index fbe1385b7..b3a8760ac 100644 --- a/crowdsec-docs/versioned_docs/version-v1.3.0/getting_started/install_freebsd.mdx +++ b/crowdsec-docs/versioned_docs/version-v1.3.0/getting_started/install_freebsd.mdx @@ -123,7 +123,7 @@ will compile and install the packages and all their dependencies. Then configure ## Troubleshooting -In some case, Crowdsec is unable to generate the machine id. +In some cases, Crowdsec is unable to generate the machine id. Start `hostid` and `hostid_save`: diff --git a/crowdsec-docs/versioned_docs/version-v1.3.4/getting_started/install_freebsd.mdx b/crowdsec-docs/versioned_docs/version-v1.3.4/getting_started/install_freebsd.mdx index 2311f08df..de1c16b32 100644 --- a/crowdsec-docs/versioned_docs/version-v1.3.4/getting_started/install_freebsd.mdx +++ b/crowdsec-docs/versioned_docs/version-v1.3.4/getting_started/install_freebsd.mdx @@ -123,7 +123,7 @@ will compile and install the packages and all their dependencies. Then configure ## Troubleshooting -In some case, Crowdsec is unable to generate the machine id. +In some cases, Crowdsec is unable to generate the machine id. Start `hostid` and `hostid_save`: @@ -132,4 +132,4 @@ Start `hostid` and `hostid_save`: /etc/rc.d/hostid_save start ``` -Then start again the Crowdsec' service `service crowdsec start`. \ No newline at end of file +Then start again the Crowdsec' service `service crowdsec start`. diff --git a/crowdsec-docs/versioned_docs/version-v1.4.0/getting_started/install_freebsd.md b/crowdsec-docs/versioned_docs/version-v1.4.0/getting_started/install_freebsd.md index 2311f08df..de1c16b32 100644 --- a/crowdsec-docs/versioned_docs/version-v1.4.0/getting_started/install_freebsd.md +++ b/crowdsec-docs/versioned_docs/version-v1.4.0/getting_started/install_freebsd.md @@ -123,7 +123,7 @@ will compile and install the packages and all their dependencies. Then configure ## Troubleshooting -In some case, Crowdsec is unable to generate the machine id. +In some cases, Crowdsec is unable to generate the machine id. Start `hostid` and `hostid_save`: @@ -132,4 +132,4 @@ Start `hostid` and `hostid_save`: /etc/rc.d/hostid_save start ``` -Then start again the Crowdsec' service `service crowdsec start`. \ No newline at end of file +Then start again the Crowdsec' service `service crowdsec start`. diff --git a/crowdsec-docs/versioned_docs/version-v1.5.0/getting_started/install_freebsd.md b/crowdsec-docs/versioned_docs/version-v1.5.0/getting_started/install_freebsd.md index cae92ffdb..f7fe16df9 100644 --- a/crowdsec-docs/versioned_docs/version-v1.5.0/getting_started/install_freebsd.md +++ b/crowdsec-docs/versioned_docs/version-v1.5.0/getting_started/install_freebsd.md @@ -125,7 +125,7 @@ will compile and install the packages and all their dependencies. Then configure ## Troubleshooting -In some case, Crowdsec is unable to generate the machine id. +In some cases, Crowdsec is unable to generate the machine id. Start `hostid` and `hostid_save`: @@ -134,4 +134,4 @@ Start `hostid` and `hostid_save`: /etc/rc.d/hostid_save start ``` -Then start again the Crowdsec' service `service crowdsec start`. \ No newline at end of file +Then start again the Crowdsec' service `service crowdsec start`. From fc38e2c106f1211b7dc6bd61aa38d88c9d90d498 Mon Sep 17 00:00:00 2001 From: Laurence Jones Date: Wed, 4 Oct 2023 18:03:13 +0100 Subject: [PATCH 2/4] Please dont break this (#455) * Please dont break this * Fix this * Fix this * Fix this --- .github/workflows/build_doc.yaml | 22 +++++++++++++++++++ .../configuration/crowdsec_configuration.md | 3 +-- crowdsec-docs/docs/contributing/code.md | 2 +- crowdsec-docs/docs/cti_api/taxonomy.md | 2 +- .../docs/data_sources/introduction.md | 2 +- .../docs/getting_started/getting_started.md | 2 +- crowdsec-docs/docs/parsers/format.md | 8 +++---- crowdsec-docs/docs/parsers/introduction.mdx | 2 +- crowdsec-docs/docs/profiles/format.md | 4 ++-- crowdsec-docs/docs/profiles/intro.md | 2 +- crowdsec-docs/docs/scenarios/format.md | 10 ++++----- crowdsec-docs/docs/whitelist/format.md | 6 ++--- crowdsec-docs/docs/whitelist/introduction.md | 1 + .../configuration/crowdsec_configuration.md | 1 - .../version-v1.0/cscli/cscli_alerts.md | 2 +- .../version-v1.0/cscli/cscli_bouncers.md | 2 +- .../version-v1.0/cscli/cscli_capi.md | 2 +- .../version-v1.0/cscli/cscli_collections.md | 2 +- .../version-v1.0/cscli/cscli_completion.md | 2 +- .../version-v1.0/cscli/cscli_config.md | 2 +- .../version-v1.0/cscli/cscli_console.md | 2 +- .../version-v1.0/cscli/cscli_dashboard.md | 2 +- .../version-v1.0/cscli/cscli_decisions.md | 2 +- .../version-v1.0/cscli/cscli_hub.md | 2 +- .../version-v1.0/cscli/cscli_lapi.md | 2 +- .../version-v1.0/cscli/cscli_machines.md | 2 +- .../version-v1.0/cscli/cscli_metrics.md | 2 +- .../version-v1.0/cscli/cscli_parsers.md | 2 +- .../version-v1.0/cscli/cscli_postoverflows.md | 2 +- .../version-v1.0/cscli/cscli_scenarios.md | 2 +- .../version-v1.0/cscli/cscli_simulation.md | 2 +- .../version-v1.0/cscli/cscli_version.md | 2 +- .../versioned_docs/version-v1.0/intro.mdx | 2 +- .../user_guides/decisions_management.md | 2 +- .../configuration/crowdsec_configuration.md | 2 -- .../user_guides/hub_management.md | 2 +- .../versioned_docs/version-v1.2.2/concepts.md | 2 +- .../configuration/crowdsec_configuration.md | 1 - .../notification_plugins/intro.md | 2 +- .../user_guides/hub_management.md | 2 +- .../versioned_docs/version-v1.2/concepts.md | 4 ++-- .../configuration/crowdsec_configuration.md | 1 - .../notification_plugins/intro.md | 2 +- .../user_guides/hub_management.md | 2 +- .../versioned_docs/version-v1.3.0/concepts.md | 2 +- .../configuration/crowdsec_configuration.md | 1 - .../notification_plugins/intro.md | 2 +- .../user_guides/hub_management.md | 2 +- .../configuration/crowdsec_configuration.md | 1 - .../version-v1.3.4/contributing/code.md | 2 +- .../notification_plugins/intro.md | 2 +- .../version-v1.4.0/bouncers/aws-waf.mdx | 2 +- .../configuration/crowdsec_configuration.md | 3 +-- .../version-v1.4.0/contributing/code.md | 2 +- .../version-v1.4.0/cti_api/taxonomy.md | 2 +- .../version-v1.4.0/profiles/intro.md | 2 +- .../configuration/crowdsec_configuration.md | 4 +--- .../version-v1.5.0/contributing/code.md | 2 +- .../version-v1.5.0/cti_api/taxonomy.md | 2 +- .../data_sources/introduction.md | 2 +- .../getting_started/getting_started.md | 2 +- .../notification_plugins/intro.md | 2 +- .../version-v1.5.0/profiles/intro.md | 2 +- 63 files changed, 89 insertions(+), 77 deletions(-) create mode 100644 .github/workflows/build_doc.yaml diff --git a/.github/workflows/build_doc.yaml b/.github/workflows/build_doc.yaml new file mode 100644 index 000000000..d9c7b1ebf --- /dev/null +++ b/.github/workflows/build_doc.yaml @@ -0,0 +1,22 @@ +name: Build documentation + +on: + push: + branches: [main] + pull_request: + branches: [main] + +jobs: + build: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v3 + - name: Use Node.js 18.x + uses: actions/setup-node@v3 + with: + node-version: 18.x + - name: Install dependencies + run: npm ci + working-directory: ./crowdsec-docs/ + - run: npm run build --if-present + working-directory: ./crowdsec-docs/ diff --git a/crowdsec-docs/docs/configuration/crowdsec_configuration.md b/crowdsec-docs/docs/configuration/crowdsec_configuration.md index 1b2814c11..a65720bc6 100644 --- a/crowdsec-docs/docs/configuration/crowdsec_configuration.md +++ b/crowdsec-docs/docs/configuration/crowdsec_configuration.md @@ -180,7 +180,7 @@ always replaced. - `bouncers/crowdsec-blocklist-mirror.yaml` In the case of `profiles.yaml`, the files are read as a whole (as if they were -attached) instead of merged. See [profiles - introduction](/profiles/intro). +attached) instead of merged. See [profiles - introduction](/profiles/intro.md). ## Configuration directives @@ -614,7 +614,6 @@ db_config: ``` The port to connect to (only if the type of database is `mysql` or `postgresql`). Must be omitted if using socket file. -#### `sslmode` ```yaml db_config: diff --git a/crowdsec-docs/docs/contributing/code.md b/crowdsec-docs/docs/contributing/code.md index 58e623a10..1edce4a09 100644 --- a/crowdsec-docs/docs/contributing/code.md +++ b/crowdsec-docs/docs/contributing/code.md @@ -39,7 +39,7 @@ Run with `make bats-build bats-fixture` once, then `make bats-test-hub`. We receive contributions on the _master_ branch (or _main_, in recent repositories). To contribute, fork the repository, commit the code in a dedicated branch and ask for a Pull Request. By default it will target the master branch on the upstream repository, so in most cases you don't have to change anything. It will be reviewed by the core team and merged when ready, possibly after some changes. It is recommended to open [an Issue linked to the PR](https://docs.github.com/en/issues/tracking-your-work-with-issues/linking-a-pull-request-to-an-issue) in order to discuss it and track its progression. -You may also receive feedback from the CI scripts (directory [.github/workflows](.github/workflows)) that run a series of linters and tests. You are encouraged to run these on your environment as well, before committing (see the "Testing" section above, and "Style guide" below). +You may also receive feedback from the CI scripts (directory [.github/workflows](https://github.com/crowdsecurity/hub/tree/master/.github/workflows)) that run a series of linters and tests. You are encouraged to run these on your environment as well, before committing (see the "Testing" section above, and "Style guide" below). ## Release branches diff --git a/crowdsec-docs/docs/cti_api/taxonomy.md b/crowdsec-docs/docs/cti_api/taxonomy.md index c59da019b..9320f5eb6 100644 --- a/crowdsec-docs/docs/cti_api/taxonomy.md +++ b/crowdsec-docs/docs/cti_api/taxonomy.md @@ -48,7 +48,7 @@ sidebar_position: 3 - `false_positive`: A list of false positives tags associated with the IP. Any IP with `known_false_positive` tags shouldn't be considered as malicious - `classifications`: A list of categories associated with the IP. Those data can be sourced from 3rd parties (i.e. tor exit nodes list). [An exhaustive list](#list-of-common-classifications) is available bellow, - `attack details`: A more exhaustive list of the scenarios for which a given IP was reported. Each entry contains the following information : - - `name`: name of the scenario (see [hub.crowdsec.net](hub.crowdsec.net)) + - `name`: name of the scenario (see [hub.crowdsec.net](https://hub.crowdsec.net/)) - `label`, `description`: Human-friendly descriptions of said scenarios - `target_countries`: The top 10 reports repartition by country about the IP, as a percentage - `background_noise_score`: Evaluate the noisiness of an IP address, from a scale of 0 (not noisy) to 10 (extremely noisy) diff --git a/crowdsec-docs/docs/data_sources/introduction.md b/crowdsec-docs/docs/data_sources/introduction.md index 9d2a4bb3e..12eb81aeb 100644 --- a/crowdsec-docs/docs/data_sources/introduction.md +++ b/crowdsec-docs/docs/data_sources/introduction.md @@ -15,7 +15,7 @@ Name | Type | Stream | One-shot [file](/data_sources/file.md) | single files, glob expressions and .gz files | yes | yes [journald](/data_sources/journald.md) | journald via filter | yes | yes [AWS cloudwatch](/data_sources/cloudwatch.md) | single stream or log group | yes | yes -[syslog service](/data_sources/syslog.md) | read logs received via syslog protocol | yes | no +[syslog service](/data_sources/syslog_service.md) | read logs received via syslog protocol | yes | no [docker](/data_sources/docker.md) | read logs from docker containers | yes | yes [AWS kinesis](/data_sources/kinesis.md)| read logs from a kinesis strean | yes | no [Kafka](/data_sources/kafka.md)| read logs from kafka topic | yes | no diff --git a/crowdsec-docs/docs/getting_started/getting_started.md b/crowdsec-docs/docs/getting_started/getting_started.md index ec807dea5..c9047d6af 100644 --- a/crowdsec-docs/docs/getting_started/getting_started.md +++ b/crowdsec-docs/docs/getting_started/getting_started.md @@ -27,7 +27,7 @@ The Security Engine by default uses the following ports: - 8080/tcp for the API - 6060/tcp for the Prometheus metrics / Debugging -If these ports are not available on your system, you can change them in the configuration file post installation. See [Configuration](/docs/configuration.md) for more information. +If these ports are not available on your system, you can change them in the configuration file post installation. See [Configuration](/configuration/crowdsec_configuration.md) for more information. Please note that the API is mandatory for your security engine, do not remove it from your configuration. diff --git a/crowdsec-docs/docs/parsers/format.md b/crowdsec-docs/docs/parsers/format.md index a5fffbb87..a38c25b84 100644 --- a/crowdsec-docs/docs/parsers/format.md +++ b/crowdsec-docs/docs/parsers/format.md @@ -171,7 +171,7 @@ DEBU[31-07-2020 16:36:28] evt.Parsed.program = 'nginx' id=withe filter: expression ``` -`filter` must be a valid [expr](/expr/helpers.md) expression that will be evaluated against the [event](/expr/event.md). +`filter` must be a valid [expr](/expr/intro.md) expression that will be evaluated against the [event](/expr/event.md). If `filter` evaluation returns true or is absent, node will be processed. @@ -194,7 +194,7 @@ A valid grok pattern #### `expression` -A valid [expr](/expr/helpers.md) expression that return a string to apply the pattern on. +A valid [expr](/expr/intro.md) expression that return a string to apply the pattern on. #### `apply_on` @@ -463,11 +463,11 @@ The name of the stash. Distinct parsers can manipulate the same cache. #### `key` -The [expression](/expr/helpers.md) that defines the string that will be used as a key. +The [expression](/expr/intro.md) that defines the string that will be used as a key. #### `value` -The [expression](/expr/helpers.md) that defines the string that will be used as a value. +The [expression](/expr/intro.md) that defines the string that will be used as a value. #### `ttl` diff --git a/crowdsec-docs/docs/parsers/introduction.mdx b/crowdsec-docs/docs/parsers/introduction.mdx index 744eab217..11d4728c0 100644 --- a/crowdsec-docs/docs/parsers/introduction.mdx +++ b/crowdsec-docs/docs/parsers/introduction.mdx @@ -12,7 +12,7 @@ import useBaseUrl from '@docusaurus/useBaseUrl'; A parser is a YAML configuration file that describes how a string must be parsed. Said string can be a log line, or a field extracted from a previous parser. -While a lot of parsers rely on the **GROK** approach (a.k.a regular expression named capture groups), parsers can also use [expressions](/expr/helpers.md) to perform parsing on specific data (ie. json), [refer to external methods for enrichment](https://hub.crowdsec.net/author/crowdsecurity/configurations/geoip-enrich) or even [perform whitelisting](https://hub.crowdsec.net/author/crowdsecurity/configurations/whitelists.md). +While a lot of parsers rely on the **GROK** approach (a.k.a regular expression named capture groups), parsers can also use [expressions](/expr/intro.md) to perform parsing on specific data (ie. json), [refer to external methods for enrichment](https://hub.crowdsec.net/author/crowdsecurity/configurations/geoip-enrich) or even [perform whitelisting](https://hub.crowdsec.net/author/crowdsecurity/configurations/whitelists.md). The [event](/expr/event.md) enters the parser, and might exit successfully or not: diff --git a/crowdsec-docs/docs/profiles/format.md b/crowdsec-docs/docs/profiles/format.md index 28ea697bc..d6c445f6a 100644 --- a/crowdsec-docs/docs/profiles/format.md +++ b/crowdsec-docs/docs/profiles/format.md @@ -51,7 +51,7 @@ filters: - Alert.Remediation == true && Alert.GetScope() == "Ip" ``` -If any `filter` of the list returns `true`, the profile is eligible and the `decisions` will be applied (note: `filter` can use [expr helpers](/expr/helpers.md)). +If any `filter` of the list returns `true`, the profile is eligible and the `decisions` will be applied (note: `filter` can use [expr helpers](/expr/intro.md)). The filter allows you to then create custom decisions for some specific scenarios for example: @@ -113,7 +113,7 @@ duration_expr: "Sprintf('%dh', (GetDecisionsCount(Alert.GetValue()) + 1) * 4)" If the profile applies, and the `duration_expr` generates a valid [golang's duration](https://pkg.go.dev/time#ParseDuration), it will replace the decision duration. It can be used to have custom duration. For example, you can have an increased duration every time an attacker comes back. -It relies on [expr helpers](/expr/helpers.md). +It relies on [expr helpers](/expr/intro.md). ### `on_success` diff --git a/crowdsec-docs/docs/profiles/intro.md b/crowdsec-docs/docs/profiles/intro.md index 3907948e4..cd02e249d 100644 --- a/crowdsec-docs/docs/profiles/intro.md +++ b/crowdsec-docs/docs/profiles/intro.md @@ -15,7 +15,7 @@ The profiles configuration allows users to configure which kind of remediation s The profiles configuration is located in `/etc/crowdsec/profiles.yaml`. You can also write your profiles in a `profiles.yaml.local` file (as explained -in [Crowdsec configuration](/configuration/crowdsec_configuration)), and they +in [Crowdsec configuration](/configuration/crowdsec_configuration.md)), and they will be read _before_ `profiles.yaml`. In this case, you may want to provide `on_success: break` because the YAML files are not merged together, but read as a single multi-document configuration. diff --git a/crowdsec-docs/docs/scenarios/format.md b/crowdsec-docs/docs/scenarios/format.md index 4ef953214..d98d90a2c 100644 --- a/crowdsec-docs/docs/scenarios/format.md +++ b/crowdsec-docs/docs/scenarios/format.md @@ -208,7 +208,7 @@ A reference to third party documents. This is a list of string. filter: expression ``` -`filter` must be a valid [expr](/expr/helpers.md) expression that will be evaluated against the event. +`filter` must be a valid [expr](/expr/intro.md) expression that will be evaluated against the event. If `filter` evaluation returns true or is absent, event will be pour in the bucket. @@ -258,7 +258,7 @@ groupby: evt.Meta.source_ip ``` -An [expression](/expr/helpers.md) that must return a string. This string will be used as a partition for the buckets. +An [expression](/expr/intro.md) that must return a string. This string will be used as a partition for the buckets. #### Examples @@ -289,7 +289,7 @@ distinct: evt.Meta.http_path ``` -An [expression](/expr/helpers.md) that must return a string. The event will be poured **only** if the string is not already present in the bucket. +An [expression](/expr/intro.md) that must return a string. The event will be poured **only** if the string is not already present in the bucket. #### Examples @@ -512,7 +512,7 @@ Cache size will affect the number of events you receive within an alert. If you overflow_filter: any(queue.Queue, { .Enriched.IsInEU == "true" }) ``` -`overflow_filter` is an [expression](/expr/helpers.md) that is run when the bucket overflows. +`overflow_filter` is an [expression](/expr/intro.md) that is run when the bucket overflows. If this expression is present and returns false, the overflow will be discarded. --- @@ -522,7 +522,7 @@ If this expression is present and returns false, the overflow will be discarded. cancel_on: evt.Parsed.something == 'somevalue' ``` -`cancel_on` is an [expression](/expr/helpers.md) that runs on each event poured to the bucket. +`cancel_on` is an [expression](/expr/intro.md) that runs on each event poured to the bucket. If the `cancel_on` expression returns true, the bucket is immediately destroyed (and doesn't overflow). diff --git a/crowdsec-docs/docs/whitelist/format.md b/crowdsec-docs/docs/whitelist/format.md index af3783d01..021b76b86 100644 --- a/crowdsec-docs/docs/whitelist/format.md +++ b/crowdsec-docs/docs/whitelist/format.md @@ -107,7 +107,7 @@ whitelist: - "127.0.0.1" ``` -A valid [expr](/expr/helpers.md) expression that return a string to apply the pattern on. +A valid [expr](/expr/intro.md) expression that return a string to apply the pattern on. #### `cidr` @@ -120,7 +120,7 @@ whitelist: - "172.16.0.0/12" ``` -A valid [expr](/expr/helpers.md) expression that return a string to apply the pattern on. +A valid [expr](/expr/intro.md) expression that return a string to apply the pattern on. #### `expression` @@ -134,7 +134,7 @@ whitelist: - evt.Enriched.IsoCode == 'FR' ``` -A valid [expr](/expr/helpers.md) expression that return a string to apply the pattern on. +A valid [expr](/expr/intro.md) expression that return a string to apply the pattern on. ### `data` diff --git a/crowdsec-docs/docs/whitelist/introduction.md b/crowdsec-docs/docs/whitelist/introduction.md index a9d8a3e62..da530073c 100644 --- a/crowdsec-docs/docs/whitelist/introduction.md +++ b/crowdsec-docs/docs/whitelist/introduction.md @@ -4,6 +4,7 @@ title: Introduction sidebar_position: 1 --- + Whitelists are special parsers that allow you to "discard" events, and can exist at two different steps : - *Parser whitelists* : Allows you to discard an event at parse time, so that it never hits the buckets. diff --git a/crowdsec-docs/versioned_docs/version-v1.0/configuration/crowdsec_configuration.md b/crowdsec-docs/versioned_docs/version-v1.0/configuration/crowdsec_configuration.md index c793ef572..49e974f75 100644 --- a/crowdsec-docs/versioned_docs/version-v1.0/configuration/crowdsec_configuration.md +++ b/crowdsec-docs/versioned_docs/version-v1.0/configuration/crowdsec_configuration.md @@ -403,7 +403,6 @@ db_config: ``` The port to connect to (only if the type of database is `mysql` or `postgresql`) -#### `sslmode` ```yaml db_config: diff --git a/crowdsec-docs/versioned_docs/version-v1.0/cscli/cscli_alerts.md b/crowdsec-docs/versioned_docs/version-v1.0/cscli/cscli_alerts.md index 7ae9cf344..f48551588 100644 --- a/crowdsec-docs/versioned_docs/version-v1.0/cscli/cscli_alerts.md +++ b/crowdsec-docs/versioned_docs/version-v1.0/cscli/cscli_alerts.md @@ -26,7 +26,7 @@ Manage alerts ### SEE ALSO -* [cscli](/docs/v1.0/cscli/cscli) - cscli allows you to manage crowdsec +* [cscli](/docs/v1.0/cscli/) - cscli allows you to manage crowdsec * [cscli alerts delete](/docs/v1.0/cscli/cscli_alerts_delete) - Delete alerts /!\ This command can be use only on the same machine than the local API. * [cscli alerts inspect](/docs/v1.0/cscli/cscli_alerts_inspect) - Show info about an alert diff --git a/crowdsec-docs/versioned_docs/version-v1.0/cscli/cscli_bouncers.md b/crowdsec-docs/versioned_docs/version-v1.0/cscli/cscli_bouncers.md index 91c8fe0e9..d8ca280ac 100644 --- a/crowdsec-docs/versioned_docs/version-v1.0/cscli/cscli_bouncers.md +++ b/crowdsec-docs/versioned_docs/version-v1.0/cscli/cscli_bouncers.md @@ -32,7 +32,7 @@ Note: This command requires database direct access, so is intended to be run on ### SEE ALSO -* [cscli](/docs/v1.0/cscli/cscli) - cscli allows you to manage crowdsec +* [cscli](/docs/v1.0/cscli/) - cscli allows you to manage crowdsec * [cscli bouncers add](/docs/v1.0/cscli/cscli_bouncers_add) - add bouncer * [cscli bouncers delete](/docs/v1.0/cscli/cscli_bouncers_delete) - delete bouncer * [cscli bouncers list](/docs/v1.0/cscli/cscli_bouncers_list) - List bouncers diff --git a/crowdsec-docs/versioned_docs/version-v1.0/cscli/cscli_capi.md b/crowdsec-docs/versioned_docs/version-v1.0/cscli/cscli_capi.md index d014d0c65..60e852c92 100644 --- a/crowdsec-docs/versioned_docs/version-v1.0/cscli/cscli_capi.md +++ b/crowdsec-docs/versioned_docs/version-v1.0/cscli/cscli_capi.md @@ -26,7 +26,7 @@ Manage interaction with Central API (CAPI) ### SEE ALSO -* [cscli](/docs/v1.0/cscli/cscli) - cscli allows you to manage crowdsec +* [cscli](/docs/v1.0/cscli/) - cscli allows you to manage crowdsec * [cscli capi register](/docs/v1.0/cscli/cscli_capi_register) - Register to Central API (CAPI) * [cscli capi status](/docs/v1.0/cscli/cscli_capi_status) - Check status with the Central API (CAPI) diff --git a/crowdsec-docs/versioned_docs/version-v1.0/cscli/cscli_collections.md b/crowdsec-docs/versioned_docs/version-v1.0/cscli/cscli_collections.md index f476a25de..2154cf9a7 100644 --- a/crowdsec-docs/versioned_docs/version-v1.0/cscli/cscli_collections.md +++ b/crowdsec-docs/versioned_docs/version-v1.0/cscli/cscli_collections.md @@ -30,7 +30,7 @@ Install/Remove/Upgrade/Inspect collections from the CrowdSec Hub. ### SEE ALSO -* [cscli](/docs/v1.0/cscli/cscli) - cscli allows you to manage crowdsec +* [cscli](/docs/v1.0/cscli/) - cscli allows you to manage crowdsec * [cscli collections inspect](/docs/v1.0/cscli/cscli_collections_inspect) - Inspect given collection * [cscli collections install](/docs/v1.0/cscli/cscli_collections_install) - Install given collection(s) * [cscli collections list](/docs/v1.0/cscli/cscli_collections_list) - List all collections or given one diff --git a/crowdsec-docs/versioned_docs/version-v1.0/cscli/cscli_completion.md b/crowdsec-docs/versioned_docs/version-v1.0/cscli/cscli_completion.md index 40337ef49..aa64660ae 100644 --- a/crowdsec-docs/versioned_docs/version-v1.0/cscli/cscli_completion.md +++ b/crowdsec-docs/versioned_docs/version-v1.0/cscli/cscli_completion.md @@ -72,5 +72,5 @@ cscli completion [bash|zsh] ### SEE ALSO -* [cscli](/docs/v1.0/cscli/cscli) - cscli allows you to manage crowdsec +* [cscli](/docs/v1.0/cscli/) - cscli allows you to manage crowdsec diff --git a/crowdsec-docs/versioned_docs/version-v1.0/cscli/cscli_config.md b/crowdsec-docs/versioned_docs/version-v1.0/cscli/cscli_config.md index 4f2b8182d..eef47d3e3 100644 --- a/crowdsec-docs/versioned_docs/version-v1.0/cscli/cscli_config.md +++ b/crowdsec-docs/versioned_docs/version-v1.0/cscli/cscli_config.md @@ -26,7 +26,7 @@ Allows to view current config ### SEE ALSO -* [cscli](/docs/v1.0/cscli/cscli) - cscli allows you to manage crowdsec +* [cscli](/docs/v1.0/cscli/) - cscli allows you to manage crowdsec * [cscli config backup](/docs/v1.0/cscli/cscli_config_backup) - Backup current config * [cscli config restore](/docs/v1.0/cscli/cscli_config_restore) - Restore config in backup "directory" * [cscli config show](/docs/v1.0/cscli/cscli_config_show) - Displays current config diff --git a/crowdsec-docs/versioned_docs/version-v1.0/cscli/cscli_console.md b/crowdsec-docs/versioned_docs/version-v1.0/cscli/cscli_console.md index 7c83e58f6..0170556f0 100644 --- a/crowdsec-docs/versioned_docs/version-v1.0/cscli/cscli_console.md +++ b/crowdsec-docs/versioned_docs/version-v1.0/cscli/cscli_console.md @@ -26,6 +26,6 @@ Manage interaction with Crowdsec console (https://app.crowdsec.net) ### SEE ALSO -* [cscli](/docs/v1.0/cscli/cscli) - cscli allows you to manage crowdsec +* [cscli](/docs/v1.0/cscli/) - cscli allows you to manage crowdsec * [cscli console enroll](/docs/v1.0/cscli/cscli_console_enroll) - Enroll this instance to https://app.crowdsec.net [requires local API] diff --git a/crowdsec-docs/versioned_docs/version-v1.0/cscli/cscli_dashboard.md b/crowdsec-docs/versioned_docs/version-v1.0/cscli/cscli_dashboard.md index c07da9b6a..b0309e97e 100644 --- a/crowdsec-docs/versioned_docs/version-v1.0/cscli/cscli_dashboard.md +++ b/crowdsec-docs/versioned_docs/version-v1.0/cscli/cscli_dashboard.md @@ -43,7 +43,7 @@ cscli dashboard remove ### SEE ALSO -* [cscli](/docs/v1.0/cscli/cscli) - cscli allows you to manage crowdsec +* [cscli](/docs/v1.0/cscli/) - cscli allows you to manage crowdsec * [cscli dashboard remove](/docs/v1.0/cscli/cscli_dashboard_remove) - removes the metabase container. * [cscli dashboard setup](/docs/v1.0/cscli/cscli_dashboard_setup) - Setup a metabase container. * [cscli dashboard start](/docs/v1.0/cscli/cscli_dashboard_start) - Start the metabase container. diff --git a/crowdsec-docs/versioned_docs/version-v1.0/cscli/cscli_decisions.md b/crowdsec-docs/versioned_docs/version-v1.0/cscli/cscli_decisions.md index 4867d2906..9dec2aa6c 100644 --- a/crowdsec-docs/versioned_docs/version-v1.0/cscli/cscli_decisions.md +++ b/crowdsec-docs/versioned_docs/version-v1.0/cscli/cscli_decisions.md @@ -36,7 +36,7 @@ cscli decisions [action] [filter] ### SEE ALSO -* [cscli](/docs/v1.0/cscli/cscli) - cscli allows you to manage crowdsec +* [cscli](/docs/v1.0/cscli/) - cscli allows you to manage crowdsec * [cscli decisions add](/docs/v1.0/cscli/cscli_decisions_add) - Add decision to LAPI * [cscli decisions delete](/docs/v1.0/cscli/cscli_decisions_delete) - Delete decisions * [cscli decisions list](/docs/v1.0/cscli/cscli_decisions_list) - List decisions from LAPI diff --git a/crowdsec-docs/versioned_docs/version-v1.0/cscli/cscli_hub.md b/crowdsec-docs/versioned_docs/version-v1.0/cscli/cscli_hub.md index e4ef98bd5..e2c0885ff 100644 --- a/crowdsec-docs/versioned_docs/version-v1.0/cscli/cscli_hub.md +++ b/crowdsec-docs/versioned_docs/version-v1.0/cscli/cscli_hub.md @@ -44,7 +44,7 @@ cscli hub update # Download list of available configurations from the hub ### SEE ALSO -* [cscli](/docs/v1.0/cscli/cscli) - cscli allows you to manage crowdsec +* [cscli](/docs/v1.0/cscli/) - cscli allows you to manage crowdsec * [cscli hub list](/docs/v1.0/cscli/cscli_hub_list) - List installed configs * [cscli hub update](/docs/v1.0/cscli/cscli_hub_update) - Fetch available configs from hub * [cscli hub upgrade](/docs/v1.0/cscli/cscli_hub_upgrade) - Upgrade all configs installed from hub diff --git a/crowdsec-docs/versioned_docs/version-v1.0/cscli/cscli_lapi.md b/crowdsec-docs/versioned_docs/version-v1.0/cscli/cscli_lapi.md index 217e723a9..6e554ed0e 100644 --- a/crowdsec-docs/versioned_docs/version-v1.0/cscli/cscli_lapi.md +++ b/crowdsec-docs/versioned_docs/version-v1.0/cscli/cscli_lapi.md @@ -26,7 +26,7 @@ Manage interaction with Local API (LAPI) ### SEE ALSO -* [cscli](/docs/v1.0/cscli/cscli) - cscli allows you to manage crowdsec +* [cscli](/docs/v1.0/cscli/) - cscli allows you to manage crowdsec * [cscli lapi register](/docs/v1.0/cscli/cscli_lapi_register) - Register a machine to Local API (LAPI) * [cscli lapi status](/docs/v1.0/cscli/cscli_lapi_status) - Check authentication to Local API (LAPI) diff --git a/crowdsec-docs/versioned_docs/version-v1.0/cscli/cscli_machines.md b/crowdsec-docs/versioned_docs/version-v1.0/cscli/cscli_machines.md index 86273fb2a..ac342d4a5 100644 --- a/crowdsec-docs/versioned_docs/version-v1.0/cscli/cscli_machines.md +++ b/crowdsec-docs/versioned_docs/version-v1.0/cscli/cscli_machines.md @@ -38,7 +38,7 @@ cscli machines [action] ### SEE ALSO -* [cscli](/docs/v1.0/cscli/cscli) - cscli allows you to manage crowdsec +* [cscli](/docs/v1.0/cscli/) - cscli allows you to manage crowdsec * [cscli machines add](/docs/v1.0/cscli/cscli_machines_add) - add machine to the database. * [cscli machines delete](/docs/v1.0/cscli/cscli_machines_delete) - delete machines * [cscli machines list](/docs/v1.0/cscli/cscli_machines_list) - List machines diff --git a/crowdsec-docs/versioned_docs/version-v1.0/cscli/cscli_metrics.md b/crowdsec-docs/versioned_docs/version-v1.0/cscli/cscli_metrics.md index f9146cd6e..2c5ae35c9 100644 --- a/crowdsec-docs/versioned_docs/version-v1.0/cscli/cscli_metrics.md +++ b/crowdsec-docs/versioned_docs/version-v1.0/cscli/cscli_metrics.md @@ -35,5 +35,5 @@ cscli metrics [flags] ### SEE ALSO -* [cscli](/docs/v1.0/cscli/cscli) - cscli allows you to manage crowdsec +* [cscli](/docs/v1.0/cscli/) - cscli allows you to manage crowdsec diff --git a/crowdsec-docs/versioned_docs/version-v1.0/cscli/cscli_parsers.md b/crowdsec-docs/versioned_docs/version-v1.0/cscli/cscli_parsers.md index cd9f99c7c..f14acac94 100644 --- a/crowdsec-docs/versioned_docs/version-v1.0/cscli/cscli_parsers.md +++ b/crowdsec-docs/versioned_docs/version-v1.0/cscli/cscli_parsers.md @@ -37,7 +37,7 @@ cscli parsers remove crowdsecurity/sshd-logs ### SEE ALSO -* [cscli](/docs/v1.0/cscli/cscli) - cscli allows you to manage crowdsec +* [cscli](/docs/v1.0/cscli/) - cscli allows you to manage crowdsec * [cscli parsers inspect](/docs/v1.0/cscli/cscli_parsers_inspect) - Inspect given parser * [cscli parsers install](/docs/v1.0/cscli/cscli_parsers_install) - Install given parser(s) * [cscli parsers list](/docs/v1.0/cscli/cscli_parsers_list) - List all parsers or given one diff --git a/crowdsec-docs/versioned_docs/version-v1.0/cscli/cscli_postoverflows.md b/crowdsec-docs/versioned_docs/version-v1.0/cscli/cscli_postoverflows.md index 62474ea93..e06ac8017 100644 --- a/crowdsec-docs/versioned_docs/version-v1.0/cscli/cscli_postoverflows.md +++ b/crowdsec-docs/versioned_docs/version-v1.0/cscli/cscli_postoverflows.md @@ -36,7 +36,7 @@ cscli postoverflows install crowdsecurity/cdn-whitelist ### SEE ALSO -* [cscli](/docs/v1.0/cscli/cscli) - cscli allows you to manage crowdsec +* [cscli](/docs/v1.0/cscli/) - cscli allows you to manage crowdsec * [cscli postoverflows inspect](/docs/v1.0/cscli/cscli_postoverflows_inspect) - Inspect given postoverflow * [cscli postoverflows install](/docs/v1.0/cscli/cscli_postoverflows_install) - Install given postoverflow(s) * [cscli postoverflows list](/docs/v1.0/cscli/cscli_postoverflows_list) - List all postoverflows or given one diff --git a/crowdsec-docs/versioned_docs/version-v1.0/cscli/cscli_scenarios.md b/crowdsec-docs/versioned_docs/version-v1.0/cscli/cscli_scenarios.md index 580c9d375..806cbb47d 100644 --- a/crowdsec-docs/versioned_docs/version-v1.0/cscli/cscli_scenarios.md +++ b/crowdsec-docs/versioned_docs/version-v1.0/cscli/cscli_scenarios.md @@ -37,7 +37,7 @@ cscli scenarios remove crowdsecurity/ssh-bf ### SEE ALSO -* [cscli](/docs/v1.0/cscli/cscli) - cscli allows you to manage crowdsec +* [cscli](/docs/v1.0/cscli/) - cscli allows you to manage crowdsec * [cscli scenarios inspect](/docs/v1.0/cscli/cscli_scenarios_inspect) - Inspect given scenario * [cscli scenarios install](/docs/v1.0/cscli/cscli_scenarios_install) - Install given scenario(s) * [cscli scenarios list](/docs/v1.0/cscli/cscli_scenarios_list) - List all scenario(s) or given one diff --git a/crowdsec-docs/versioned_docs/version-v1.0/cscli/cscli_simulation.md b/crowdsec-docs/versioned_docs/version-v1.0/cscli/cscli_simulation.md index ae396d4ed..ab4bb5748 100644 --- a/crowdsec-docs/versioned_docs/version-v1.0/cscli/cscli_simulation.md +++ b/crowdsec-docs/versioned_docs/version-v1.0/cscli/cscli_simulation.md @@ -34,7 +34,7 @@ cscli simulation disable crowdsecurity/ssh-bf ### SEE ALSO -* [cscli](/docs/v1.0/cscli/cscli) - cscli allows you to manage crowdsec +* [cscli](/docs/v1.0/cscli/) - cscli allows you to manage crowdsec * [cscli simulation disable](/docs/v1.0/cscli/cscli_simulation_disable) - Disable the simulation mode. Disable only specified scenarios * [cscli simulation enable](/docs/v1.0/cscli/cscli_simulation_enable) - Enable the simulation, globally or on specified scenarios * [cscli simulation status](/docs/v1.0/cscli/cscli_simulation_status) - Show simulation mode status diff --git a/crowdsec-docs/versioned_docs/version-v1.0/cscli/cscli_version.md b/crowdsec-docs/versioned_docs/version-v1.0/cscli/cscli_version.md index 62a936e38..afd22126b 100644 --- a/crowdsec-docs/versioned_docs/version-v1.0/cscli/cscli_version.md +++ b/crowdsec-docs/versioned_docs/version-v1.0/cscli/cscli_version.md @@ -30,5 +30,5 @@ cscli version [flags] ### SEE ALSO -* [cscli](/docs/v1.0/cscli/cscli) - cscli allows you to manage crowdsec +* [cscli](/docs/v1.0/cscli/) - cscli allows you to manage crowdsec diff --git a/crowdsec-docs/versioned_docs/version-v1.0/intro.mdx b/crowdsec-docs/versioned_docs/version-v1.0/intro.mdx index 3d2b7b068..e842b57d3 100644 --- a/crowdsec-docs/versioned_docs/version-v1.0/intro.mdx +++ b/crowdsec-docs/versioned_docs/version-v1.0/intro.mdx @@ -31,7 +31,7 @@ Thanks to this, besides detecting and stopping attacks in real time based on you CrowdSec, besides the core "detect and react" mechanism, is committed to a few other key points : - **Easy Installation** : [Out of the box](/docs/v1.0/getting_started/install_crowdsec) on most standard setupts - - **Easy daily operations** : Using [cscli](/docs/v1.0/cscli/cscli) and the [hub](http://hub.crowdsec.net), keeping your detection mechanisms up-to-date is trivial + - **Easy daily operations** : Using [cscli](/docs/v1.0/cscli/) and the [hub](http://hub.crowdsec.net), keeping your detection mechanisms up-to-date is trivial - **Reproducibility** : Crowdsec can run not only against live logs, but [as well against cold logs](/docs/v1.0/user_guides/replay_mode). It makes it a lot easier to detect potential false-positives, perform forensic or generate reporting - **Observability** : Providing strongs insights on what is going on and what crowdsec-agent is doing : - Humans have [access to a trivially deployable web interface](/docs/v1.0/observability/dashboard) diff --git a/crowdsec-docs/versioned_docs/version-v1.0/user_guides/decisions_management.md b/crowdsec-docs/versioned_docs/version-v1.0/user_guides/decisions_management.md index 6df64f45c..fea3801d0 100644 --- a/crowdsec-docs/versioned_docs/version-v1.0/user_guides/decisions_management.md +++ b/crowdsec-docs/versioned_docs/version-v1.0/user_guides/decisions_management.md @@ -49,7 +49,7 @@ sudo cscli decisions list - `ALERT ID` is the ID of the corresponding alert -Check [command usage](/docs/v1.0/cscli/cscli) for additional filtering and output control flags. +Check [command usage](/docs/v1.0/cscli/) for additional filtering and output control flags. ## Add a decision diff --git a/crowdsec-docs/versioned_docs/version-v1.1/configuration/crowdsec_configuration.md b/crowdsec-docs/versioned_docs/version-v1.1/configuration/crowdsec_configuration.md index c793ef572..30c191ad5 100644 --- a/crowdsec-docs/versioned_docs/version-v1.1/configuration/crowdsec_configuration.md +++ b/crowdsec-docs/versioned_docs/version-v1.1/configuration/crowdsec_configuration.md @@ -403,8 +403,6 @@ db_config: ``` The port to connect to (only if the type of database is `mysql` or `postgresql`) -#### `sslmode` - ```yaml db_config: type: postgresql diff --git a/crowdsec-docs/versioned_docs/version-v1.1/user_guides/hub_management.md b/crowdsec-docs/versioned_docs/version-v1.1/user_guides/hub_management.md index e27b3fca0..e08478f86 100644 --- a/crowdsec-docs/versioned_docs/version-v1.1/user_guides/hub_management.md +++ b/crowdsec-docs/versioned_docs/version-v1.1/user_guides/hub_management.md @@ -297,7 +297,7 @@ See more details about parsers [here](/parsers/introduction.mdx). ## Enrichers -Enrichers are basically [parsers](/parsers/introduction.mdx) that can rely on external methods to provide extra contextual information to the event. The enrichers are usually in the `s02-enrich` stage (after most of the parsing happened.md). +Enrichers are basically [parsers](/parsers/introduction.mdx) that can rely on external methods to provide extra contextual information to the event. The enrichers are usually in the `s02-enrich` stage (after most of the parsing happened). Enrichers functions should all accept a string as a parameter, and return an associative string array, that will be automatically merged into the `Enriched` map of the [event](/expr/event.md). diff --git a/crowdsec-docs/versioned_docs/version-v1.2.2/concepts.md b/crowdsec-docs/versioned_docs/version-v1.2.2/concepts.md index e1d9e9934..4b81af402 100644 --- a/crowdsec-docs/versioned_docs/version-v1.2.2/concepts.md +++ b/crowdsec-docs/versioned_docs/version-v1.2.2/concepts.md @@ -163,7 +163,7 @@ An example could be slack/mattermost enrichment plugin that requires human confi An `Event` is the runtime representation of an item being processed by crowdsec : It be a Log line being parsed, or an Overflow being reprocessed. -The `Event` object is modified by parses, scenarios, and directly via user [statics expressions](/parsers/format.md#statics) (for example.md). +The `Event` object is modified by parses, scenarios, and directly via user [statics expressions](/parsers/format.md#statics) (for example). diff --git a/crowdsec-docs/versioned_docs/version-v1.2.2/configuration/crowdsec_configuration.md b/crowdsec-docs/versioned_docs/version-v1.2.2/configuration/crowdsec_configuration.md index 56c33b116..da8d85344 100644 --- a/crowdsec-docs/versioned_docs/version-v1.2.2/configuration/crowdsec_configuration.md +++ b/crowdsec-docs/versioned_docs/version-v1.2.2/configuration/crowdsec_configuration.md @@ -437,7 +437,6 @@ db_config: ``` The port to connect to (only if the type of database is `mysql` or `postgresql`) -#### `sslmode` ```yaml db_config: diff --git a/crowdsec-docs/versioned_docs/version-v1.2.2/notification_plugins/intro.md b/crowdsec-docs/versioned_docs/version-v1.2.2/notification_plugins/intro.md index f83251403..7b20cff5c 100644 --- a/crowdsec-docs/versioned_docs/version-v1.2.2/notification_plugins/intro.md +++ b/crowdsec-docs/versioned_docs/version-v1.2.2/notification_plugins/intro.md @@ -14,7 +14,7 @@ Events get dispatched to said plugins via [profile configuration](/profiles/intr The default plugins are shipped with crowdsec uppon installation, and can trivially be enabled without further installation. -Refer directly to each plugin's dedicated documentation and keep in mind that plugins needs to be enabled/dispatched at the [profile](/profiles/intro.md) level via the dedicated `notifications` section (defaults to `/etc/crowdsec/profiles.yaml`.md). +Refer directly to each plugin's dedicated documentation and keep in mind that plugins needs to be enabled/dispatched at the [profile](/profiles/intro.md) level via the dedicated `notifications` section (defaults to `/etc/crowdsec/profiles.yaml`). diff --git a/crowdsec-docs/versioned_docs/version-v1.2.2/user_guides/hub_management.md b/crowdsec-docs/versioned_docs/version-v1.2.2/user_guides/hub_management.md index 4b9b6e233..552f1cefa 100644 --- a/crowdsec-docs/versioned_docs/version-v1.2.2/user_guides/hub_management.md +++ b/crowdsec-docs/versioned_docs/version-v1.2.2/user_guides/hub_management.md @@ -297,7 +297,7 @@ See more details about parsers [here](/parsers/introduction.mdx). ## Enrichers -Enrichers are basically [parsers](/parsers/introduction.mdx) that can rely on external methods to provide extra contextual information to the event. The enrichers are usually in the `s02-enrich` stage (after most of the parsing happened.md). +Enrichers are basically [parsers](/parsers/introduction.mdx) that can rely on external methods to provide extra contextual information to the event. The enrichers are usually in the `s02-enrich` stage (after most of the parsing happened). Enrichers functions should all accept a string as a parameter, and return an associative string array, that will be automatically merged into the `Enriched` map of the [event](/expr/event.md). diff --git a/crowdsec-docs/versioned_docs/version-v1.2/concepts.md b/crowdsec-docs/versioned_docs/version-v1.2/concepts.md index 5daa1072b..585db885b 100644 --- a/crowdsec-docs/versioned_docs/version-v1.2/concepts.md +++ b/crowdsec-docs/versioned_docs/version-v1.2/concepts.md @@ -50,7 +50,7 @@ Acquistion configuration defines which streams of information CrowdSec is going A stream of information can be a file, a journald event log, a cloudwatch stream, and more or less any kind of stream, such as a kafka topic. -Acquisition configuration always contains a stream (ie. a file to tail) and a [tag](/data_sources/introduction.md) (ie. "these are in syslog format" "these are non-syslog nginx logs".md). +Acquisition configuration always contains a stream (ie. a file to tail) and a [tag](/data_sources/introduction.md) (ie. "these are in syslog format" "these are non-syslog nginx logs"). File acquisition configuration is defined as : @@ -163,7 +163,7 @@ An example could be slack/mattermost enrichment plugin that requires human confi An `Event` is the runtime representation of an item being processed by crowdsec : It be a Log line being parsed, or an Overflow being reprocessed. -The `Event` object is modified by parses, scenarios, and directly via user [statics expressions](/parsers/format.md#statics) (for example.md). +The `Event` object is modified by parses, scenarios, and directly via user [statics expressions](/parsers/format.md#statics) (for example). diff --git a/crowdsec-docs/versioned_docs/version-v1.2/configuration/crowdsec_configuration.md b/crowdsec-docs/versioned_docs/version-v1.2/configuration/crowdsec_configuration.md index 56c33b116..da8d85344 100644 --- a/crowdsec-docs/versioned_docs/version-v1.2/configuration/crowdsec_configuration.md +++ b/crowdsec-docs/versioned_docs/version-v1.2/configuration/crowdsec_configuration.md @@ -437,7 +437,6 @@ db_config: ``` The port to connect to (only if the type of database is `mysql` or `postgresql`) -#### `sslmode` ```yaml db_config: diff --git a/crowdsec-docs/versioned_docs/version-v1.2/notification_plugins/intro.md b/crowdsec-docs/versioned_docs/version-v1.2/notification_plugins/intro.md index e816f2985..d20c05b14 100644 --- a/crowdsec-docs/versioned_docs/version-v1.2/notification_plugins/intro.md +++ b/crowdsec-docs/versioned_docs/version-v1.2/notification_plugins/intro.md @@ -18,7 +18,7 @@ The default profile will not forward manual decisions (`cscli decisions add -i x The default plugins are shipped with crowdsec uppon installation, and can trivially be enabled without further installation. -Refer directly to each plugin's dedicated documentation and keep in mind that plugins needs to be enabled/dispatched at the [profile](/profiles/intro.md) level via the dedicated `notifications` section (defaults to `/etc/crowdsec/profiles.yaml`.md). +Refer directly to each plugin's dedicated documentation and keep in mind that plugins needs to be enabled/dispatched at the [profile](/profiles/intro.md) level via the dedicated `notifications` section (defaults to `/etc/crowdsec/profiles.yaml). diff --git a/crowdsec-docs/versioned_docs/version-v1.2/user_guides/hub_management.md b/crowdsec-docs/versioned_docs/version-v1.2/user_guides/hub_management.md index e27b3fca0..e08478f86 100644 --- a/crowdsec-docs/versioned_docs/version-v1.2/user_guides/hub_management.md +++ b/crowdsec-docs/versioned_docs/version-v1.2/user_guides/hub_management.md @@ -297,7 +297,7 @@ See more details about parsers [here](/parsers/introduction.mdx). ## Enrichers -Enrichers are basically [parsers](/parsers/introduction.mdx) that can rely on external methods to provide extra contextual information to the event. The enrichers are usually in the `s02-enrich` stage (after most of the parsing happened.md). +Enrichers are basically [parsers](/parsers/introduction.mdx) that can rely on external methods to provide extra contextual information to the event. The enrichers are usually in the `s02-enrich` stage (after most of the parsing happened). Enrichers functions should all accept a string as a parameter, and return an associative string array, that will be automatically merged into the `Enriched` map of the [event](/expr/event.md). diff --git a/crowdsec-docs/versioned_docs/version-v1.3.0/concepts.md b/crowdsec-docs/versioned_docs/version-v1.3.0/concepts.md index b3382b418..970165b95 100644 --- a/crowdsec-docs/versioned_docs/version-v1.3.0/concepts.md +++ b/crowdsec-docs/versioned_docs/version-v1.3.0/concepts.md @@ -163,7 +163,7 @@ An example could be slack/mattermost enrichment plugin that requires human confi An `Event` is the runtime representation of an item being processed by crowdsec : It be a Log line being parsed, or an Overflow being reprocessed. -The `Event` object is modified by parses, scenarios, and directly via user [statics expressions](/parsers/format.md#statics) (for example.md). +The `Event` object is modified by parses, scenarios, and directly via user [statics expressions](/parsers/format.md#statics) (for example). diff --git a/crowdsec-docs/versioned_docs/version-v1.3.0/configuration/crowdsec_configuration.md b/crowdsec-docs/versioned_docs/version-v1.3.0/configuration/crowdsec_configuration.md index 32db9eab1..74621d0dd 100644 --- a/crowdsec-docs/versioned_docs/version-v1.3.0/configuration/crowdsec_configuration.md +++ b/crowdsec-docs/versioned_docs/version-v1.3.0/configuration/crowdsec_configuration.md @@ -472,7 +472,6 @@ db_config: ``` The port to connect to (only if the type of database is `mysql` or `postgresql`) -#### `sslmode` ```yaml db_config: diff --git a/crowdsec-docs/versioned_docs/version-v1.3.0/notification_plugins/intro.md b/crowdsec-docs/versioned_docs/version-v1.3.0/notification_plugins/intro.md index 3da41d4b7..8fb6ca9b6 100644 --- a/crowdsec-docs/versioned_docs/version-v1.3.0/notification_plugins/intro.md +++ b/crowdsec-docs/versioned_docs/version-v1.3.0/notification_plugins/intro.md @@ -14,7 +14,7 @@ Events get dispatched to said plugins via [profile configuration](/profiles/intr The default plugins are shipped with crowdsec upon installation, and can trivially be enabled without further installation. -Refer directly to each plugin's dedicated documentation and keep in mind that plugins needs to be enabled/dispatched at the [profile](/profiles/intro.md) level via the dedicated `notifications` section (defaults to `/etc/crowdsec/profiles.yaml`.md). +Refer directly to each plugin's dedicated documentation and keep in mind that plugins needs to be enabled/dispatched at the [profile](/profiles/intro.md) level via the dedicated `notifications` section (defaults to `/etc/crowdsec/profiles.yaml`). diff --git a/crowdsec-docs/versioned_docs/version-v1.3.0/user_guides/hub_management.md b/crowdsec-docs/versioned_docs/version-v1.3.0/user_guides/hub_management.md index 4b9b6e233..552f1cefa 100644 --- a/crowdsec-docs/versioned_docs/version-v1.3.0/user_guides/hub_management.md +++ b/crowdsec-docs/versioned_docs/version-v1.3.0/user_guides/hub_management.md @@ -297,7 +297,7 @@ See more details about parsers [here](/parsers/introduction.mdx). ## Enrichers -Enrichers are basically [parsers](/parsers/introduction.mdx) that can rely on external methods to provide extra contextual information to the event. The enrichers are usually in the `s02-enrich` stage (after most of the parsing happened.md). +Enrichers are basically [parsers](/parsers/introduction.mdx) that can rely on external methods to provide extra contextual information to the event. The enrichers are usually in the `s02-enrich` stage (after most of the parsing happened). Enrichers functions should all accept a string as a parameter, and return an associative string array, that will be automatically merged into the `Enriched` map of the [event](/expr/event.md). diff --git a/crowdsec-docs/versioned_docs/version-v1.3.4/configuration/crowdsec_configuration.md b/crowdsec-docs/versioned_docs/version-v1.3.4/configuration/crowdsec_configuration.md index 69377fea5..86dadbb3a 100644 --- a/crowdsec-docs/versioned_docs/version-v1.3.4/configuration/crowdsec_configuration.md +++ b/crowdsec-docs/versioned_docs/version-v1.3.4/configuration/crowdsec_configuration.md @@ -483,7 +483,6 @@ db_config: ``` The port to connect to (only if the type of database is `mysql` or `postgresql`) -#### `sslmode` ```yaml db_config: diff --git a/crowdsec-docs/versioned_docs/version-v1.3.4/contributing/code.md b/crowdsec-docs/versioned_docs/version-v1.3.4/contributing/code.md index 58e623a10..1edce4a09 100644 --- a/crowdsec-docs/versioned_docs/version-v1.3.4/contributing/code.md +++ b/crowdsec-docs/versioned_docs/version-v1.3.4/contributing/code.md @@ -39,7 +39,7 @@ Run with `make bats-build bats-fixture` once, then `make bats-test-hub`. We receive contributions on the _master_ branch (or _main_, in recent repositories). To contribute, fork the repository, commit the code in a dedicated branch and ask for a Pull Request. By default it will target the master branch on the upstream repository, so in most cases you don't have to change anything. It will be reviewed by the core team and merged when ready, possibly after some changes. It is recommended to open [an Issue linked to the PR](https://docs.github.com/en/issues/tracking-your-work-with-issues/linking-a-pull-request-to-an-issue) in order to discuss it and track its progression. -You may also receive feedback from the CI scripts (directory [.github/workflows](.github/workflows)) that run a series of linters and tests. You are encouraged to run these on your environment as well, before committing (see the "Testing" section above, and "Style guide" below). +You may also receive feedback from the CI scripts (directory [.github/workflows](https://github.com/crowdsecurity/hub/tree/master/.github/workflows)) that run a series of linters and tests. You are encouraged to run these on your environment as well, before committing (see the "Testing" section above, and "Style guide" below). ## Release branches diff --git a/crowdsec-docs/versioned_docs/version-v1.3.4/notification_plugins/intro.md b/crowdsec-docs/versioned_docs/version-v1.3.4/notification_plugins/intro.md index 4a30f78d4..4a0ac6271 100644 --- a/crowdsec-docs/versioned_docs/version-v1.3.4/notification_plugins/intro.md +++ b/crowdsec-docs/versioned_docs/version-v1.3.4/notification_plugins/intro.md @@ -14,7 +14,7 @@ Plugins are defined at LAPI level. Events get dispatched to said plugins via [pr The default plugins are shipped with CrowdSec upon installation, and can trivially be enabled without further installation. -Refer directly to each plugin's dedicated documentation and keep in mind that plugins needs to be enabled/dispatched at the [profile](/profiles/intro.md) level via the dedicated `notifications` section (defaults to `/etc/crowdsec/profiles.yaml`.md). +Refer directly to each plugin's dedicated documentation and keep in mind that plugins needs to be enabled/dispatched at the [profile](/profiles/intro.md) level via the dedicated `notifications` section (defaults to `/etc/crowdsec/profiles.yaml`). diff --git a/crowdsec-docs/versioned_docs/version-v1.4.0/bouncers/aws-waf.mdx b/crowdsec-docs/versioned_docs/version-v1.4.0/bouncers/aws-waf.mdx index 343bb4e0e..2384ff6c4 100644 --- a/crowdsec-docs/versioned_docs/version-v1.4.0/bouncers/aws-waf.mdx +++ b/crowdsec-docs/versioned_docs/version-v1.4.0/bouncers/aws-waf.mdx @@ -99,7 +99,7 @@ waf_config: ipset_prefix: crowdsec-ipset-cf ``` -Optionally, the bouncer can also be configured using only environment variables. +Optionaly, the bouncer can also be configured using only environment variables. Environment variables will take priority over values defined in the configuration file. diff --git a/crowdsec-docs/versioned_docs/version-v1.4.0/configuration/crowdsec_configuration.md b/crowdsec-docs/versioned_docs/version-v1.4.0/configuration/crowdsec_configuration.md index 53e1c58db..fa813f406 100644 --- a/crowdsec-docs/versioned_docs/version-v1.4.0/configuration/crowdsec_configuration.md +++ b/crowdsec-docs/versioned_docs/version-v1.4.0/configuration/crowdsec_configuration.md @@ -166,7 +166,7 @@ always replaced. - `profiles.yaml` In the case of `profiles.yaml`, the files are read as a whole (as if they were -attached) instead of merged. See [profiles - introduction](/profiles/intro). +attached) instead of merged. See [profiles - introduction](/profiles/intro.md). ## Configuration directives @@ -571,7 +571,6 @@ db_config: ``` The port to connect to (only if the type of database is `mysql` or `postgresql`) -#### `sslmode` ```yaml db_config: diff --git a/crowdsec-docs/versioned_docs/version-v1.4.0/contributing/code.md b/crowdsec-docs/versioned_docs/version-v1.4.0/contributing/code.md index 58e623a10..1edce4a09 100644 --- a/crowdsec-docs/versioned_docs/version-v1.4.0/contributing/code.md +++ b/crowdsec-docs/versioned_docs/version-v1.4.0/contributing/code.md @@ -39,7 +39,7 @@ Run with `make bats-build bats-fixture` once, then `make bats-test-hub`. We receive contributions on the _master_ branch (or _main_, in recent repositories). To contribute, fork the repository, commit the code in a dedicated branch and ask for a Pull Request. By default it will target the master branch on the upstream repository, so in most cases you don't have to change anything. It will be reviewed by the core team and merged when ready, possibly after some changes. It is recommended to open [an Issue linked to the PR](https://docs.github.com/en/issues/tracking-your-work-with-issues/linking-a-pull-request-to-an-issue) in order to discuss it and track its progression. -You may also receive feedback from the CI scripts (directory [.github/workflows](.github/workflows)) that run a series of linters and tests. You are encouraged to run these on your environment as well, before committing (see the "Testing" section above, and "Style guide" below). +You may also receive feedback from the CI scripts (directory [.github/workflows](https://github.com/crowdsecurity/hub/tree/master/.github/workflows)) that run a series of linters and tests. You are encouraged to run these on your environment as well, before committing (see the "Testing" section above, and "Style guide" below). ## Release branches diff --git a/crowdsec-docs/versioned_docs/version-v1.4.0/cti_api/taxonomy.md b/crowdsec-docs/versioned_docs/version-v1.4.0/cti_api/taxonomy.md index 9013fc07e..996844dad 100644 --- a/crowdsec-docs/versioned_docs/version-v1.4.0/cti_api/taxonomy.md +++ b/crowdsec-docs/versioned_docs/version-v1.4.0/cti_api/taxonomy.md @@ -48,7 +48,7 @@ sidebar_position: 3 - `false_positive`: A list of false positives tags associated with the IP. Any IP with `known_false_positive` tags shouldn't be considered as malicious - `classifications`: A list of categories associated with the IP. Those data can be sourced from 3rd parties (i.e. tor exit nodes list). [An exhaustive list](#list-of-common-classifications) is available bellow, - `attack details`: A more exhaustive list of the scenarios for which a given IP was reported. Each entry contains the following information : - - `name`: name of the scenario (see [hub.crowdsec.net](hub.crowdsec.net)) + - `name`: name of the scenario (see [hub.crowdsec.net](https://hub.crowdsec.net/)) - `label`, `description`: Human-friendly descriptions of said scenarios - `target_countries`: The top 10 reports repartition by country about the IP, as a percentage - `background_noise_score`: Evaluate the noisiness of an IP address, from a scale of 0 (not noisy) to 10 (extremely noisy) diff --git a/crowdsec-docs/versioned_docs/version-v1.4.0/profiles/intro.md b/crowdsec-docs/versioned_docs/version-v1.4.0/profiles/intro.md index 3907948e4..cd02e249d 100644 --- a/crowdsec-docs/versioned_docs/version-v1.4.0/profiles/intro.md +++ b/crowdsec-docs/versioned_docs/version-v1.4.0/profiles/intro.md @@ -15,7 +15,7 @@ The profiles configuration allows users to configure which kind of remediation s The profiles configuration is located in `/etc/crowdsec/profiles.yaml`. You can also write your profiles in a `profiles.yaml.local` file (as explained -in [Crowdsec configuration](/configuration/crowdsec_configuration)), and they +in [Crowdsec configuration](/configuration/crowdsec_configuration.md)), and they will be read _before_ `profiles.yaml`. In this case, you may want to provide `on_success: break` because the YAML files are not merged together, but read as a single multi-document configuration. diff --git a/crowdsec-docs/versioned_docs/version-v1.5.0/configuration/crowdsec_configuration.md b/crowdsec-docs/versioned_docs/version-v1.5.0/configuration/crowdsec_configuration.md index 381270a84..9a90dd080 100644 --- a/crowdsec-docs/versioned_docs/version-v1.5.0/configuration/crowdsec_configuration.md +++ b/crowdsec-docs/versioned_docs/version-v1.5.0/configuration/crowdsec_configuration.md @@ -179,7 +179,7 @@ always replaced. - `bouncers/crowdsec-blocklist-mirror.yaml` In the case of `profiles.yaml`, the files are read as a whole (as if they were -attached) instead of merged. See [profiles - introduction](/profiles/intro). +attached) instead of merged. See [profiles - introduction](/profiles/intro.md). ## Configuration directives @@ -604,8 +604,6 @@ db_config: ``` The port to connect to (only if the type of database is `mysql` or `postgresql`). Must be omitted if using socket file. -#### `sslmode` - ```yaml db_config: type: postgresql diff --git a/crowdsec-docs/versioned_docs/version-v1.5.0/contributing/code.md b/crowdsec-docs/versioned_docs/version-v1.5.0/contributing/code.md index 58e623a10..1edce4a09 100644 --- a/crowdsec-docs/versioned_docs/version-v1.5.0/contributing/code.md +++ b/crowdsec-docs/versioned_docs/version-v1.5.0/contributing/code.md @@ -39,7 +39,7 @@ Run with `make bats-build bats-fixture` once, then `make bats-test-hub`. We receive contributions on the _master_ branch (or _main_, in recent repositories). To contribute, fork the repository, commit the code in a dedicated branch and ask for a Pull Request. By default it will target the master branch on the upstream repository, so in most cases you don't have to change anything. It will be reviewed by the core team and merged when ready, possibly after some changes. It is recommended to open [an Issue linked to the PR](https://docs.github.com/en/issues/tracking-your-work-with-issues/linking-a-pull-request-to-an-issue) in order to discuss it and track its progression. -You may also receive feedback from the CI scripts (directory [.github/workflows](.github/workflows)) that run a series of linters and tests. You are encouraged to run these on your environment as well, before committing (see the "Testing" section above, and "Style guide" below). +You may also receive feedback from the CI scripts (directory [.github/workflows](https://github.com/crowdsecurity/hub/tree/master/.github/workflows)) that run a series of linters and tests. You are encouraged to run these on your environment as well, before committing (see the "Testing" section above, and "Style guide" below). ## Release branches diff --git a/crowdsec-docs/versioned_docs/version-v1.5.0/cti_api/taxonomy.md b/crowdsec-docs/versioned_docs/version-v1.5.0/cti_api/taxonomy.md index 9013fc07e..996844dad 100644 --- a/crowdsec-docs/versioned_docs/version-v1.5.0/cti_api/taxonomy.md +++ b/crowdsec-docs/versioned_docs/version-v1.5.0/cti_api/taxonomy.md @@ -48,7 +48,7 @@ sidebar_position: 3 - `false_positive`: A list of false positives tags associated with the IP. Any IP with `known_false_positive` tags shouldn't be considered as malicious - `classifications`: A list of categories associated with the IP. Those data can be sourced from 3rd parties (i.e. tor exit nodes list). [An exhaustive list](#list-of-common-classifications) is available bellow, - `attack details`: A more exhaustive list of the scenarios for which a given IP was reported. Each entry contains the following information : - - `name`: name of the scenario (see [hub.crowdsec.net](hub.crowdsec.net)) + - `name`: name of the scenario (see [hub.crowdsec.net](https://hub.crowdsec.net/)) - `label`, `description`: Human-friendly descriptions of said scenarios - `target_countries`: The top 10 reports repartition by country about the IP, as a percentage - `background_noise_score`: Evaluate the noisiness of an IP address, from a scale of 0 (not noisy) to 10 (extremely noisy) diff --git a/crowdsec-docs/versioned_docs/version-v1.5.0/data_sources/introduction.md b/crowdsec-docs/versioned_docs/version-v1.5.0/data_sources/introduction.md index 9d2a4bb3e..12eb81aeb 100644 --- a/crowdsec-docs/versioned_docs/version-v1.5.0/data_sources/introduction.md +++ b/crowdsec-docs/versioned_docs/version-v1.5.0/data_sources/introduction.md @@ -15,7 +15,7 @@ Name | Type | Stream | One-shot [file](/data_sources/file.md) | single files, glob expressions and .gz files | yes | yes [journald](/data_sources/journald.md) | journald via filter | yes | yes [AWS cloudwatch](/data_sources/cloudwatch.md) | single stream or log group | yes | yes -[syslog service](/data_sources/syslog.md) | read logs received via syslog protocol | yes | no +[syslog service](/data_sources/syslog_service.md) | read logs received via syslog protocol | yes | no [docker](/data_sources/docker.md) | read logs from docker containers | yes | yes [AWS kinesis](/data_sources/kinesis.md)| read logs from a kinesis strean | yes | no [Kafka](/data_sources/kafka.md)| read logs from kafka topic | yes | no diff --git a/crowdsec-docs/versioned_docs/version-v1.5.0/getting_started/getting_started.md b/crowdsec-docs/versioned_docs/version-v1.5.0/getting_started/getting_started.md index ec807dea5..c9047d6af 100644 --- a/crowdsec-docs/versioned_docs/version-v1.5.0/getting_started/getting_started.md +++ b/crowdsec-docs/versioned_docs/version-v1.5.0/getting_started/getting_started.md @@ -27,7 +27,7 @@ The Security Engine by default uses the following ports: - 8080/tcp for the API - 6060/tcp for the Prometheus metrics / Debugging -If these ports are not available on your system, you can change them in the configuration file post installation. See [Configuration](/docs/configuration.md) for more information. +If these ports are not available on your system, you can change them in the configuration file post installation. See [Configuration](/configuration/crowdsec_configuration.md) for more information. Please note that the API is mandatory for your security engine, do not remove it from your configuration. diff --git a/crowdsec-docs/versioned_docs/version-v1.5.0/notification_plugins/intro.md b/crowdsec-docs/versioned_docs/version-v1.5.0/notification_plugins/intro.md index 3b0c9a9ff..5d6677111 100644 --- a/crowdsec-docs/versioned_docs/version-v1.5.0/notification_plugins/intro.md +++ b/crowdsec-docs/versioned_docs/version-v1.5.0/notification_plugins/intro.md @@ -16,7 +16,7 @@ Plugins are defined at LAPI level. Events get dispatched to said plugins via [pr The default plugins are shipped with CrowdSec upon installation, and can trivially be enabled without further installation. -Refer directly to each plugin's dedicated documentation and keep in mind that plugins needs to be enabled/dispatched at the [profile](/profiles/intro.md) level via the dedicated `notifications` section (defaults to `/etc/crowdsec/profiles.yaml`.md). +Refer directly to each plugin's dedicated documentation and keep in mind that plugins needs to be enabled/dispatched at the [profile](/profiles/intro.md) level via the dedicated `notifications` section (defaults to `/etc/crowdsec/profiles.yaml`). diff --git a/crowdsec-docs/versioned_docs/version-v1.5.0/profiles/intro.md b/crowdsec-docs/versioned_docs/version-v1.5.0/profiles/intro.md index 3907948e4..cd02e249d 100644 --- a/crowdsec-docs/versioned_docs/version-v1.5.0/profiles/intro.md +++ b/crowdsec-docs/versioned_docs/version-v1.5.0/profiles/intro.md @@ -15,7 +15,7 @@ The profiles configuration allows users to configure which kind of remediation s The profiles configuration is located in `/etc/crowdsec/profiles.yaml`. You can also write your profiles in a `profiles.yaml.local` file (as explained -in [Crowdsec configuration](/configuration/crowdsec_configuration)), and they +in [Crowdsec configuration](/configuration/crowdsec_configuration.md)), and they will be read _before_ `profiles.yaml`. In this case, you may want to provide `on_success: break` because the YAML files are not merged together, but read as a single multi-document configuration. From d81eb87d12e77b5c5215e444fa3ea3ffe0254604 Mon Sep 17 00:00:00 2001 From: mmetc <92726601+mmetc@users.noreply.github.com> Date: Wed, 4 Oct 2023 21:16:28 +0200 Subject: [PATCH 3/4] remove required go version from bouncer build docs, it changes over time depending on crowdsec (#435) --- crowdsec-docs/docs/bouncers/cloudflare.mdx | 2 -- 1 file changed, 2 deletions(-) diff --git a/crowdsec-docs/docs/bouncers/cloudflare.mdx b/crowdsec-docs/docs/bouncers/cloudflare.mdx index 72a0ca807..ef013df96 100644 --- a/crowdsec-docs/docs/bouncers/cloudflare.mdx +++ b/crowdsec-docs/docs/bouncers/cloudflare.mdx @@ -113,8 +113,6 @@ sudo systemctl start crowdsec-cloudflare-bouncer # the bouncer now syncs the cro ### From source -:warning: requires go >= 1.16 - ```bash make release cd crowdsec-cloudflare-bouncer-vX.X.X From 461be2550282a7202285a64a544e6a6524f343aa Mon Sep 17 00:00:00 2001 From: Laurence Jones Date: Fri, 6 Oct 2023 13:28:05 +0100 Subject: [PATCH 4/4] Add some troubleshooting notes about SE (#387) * Add some troubleshooting notes about SE * Move info up to top of troubleshoot * Can also be IP not just port it cannot bind too * Add log locatons --- crowdsec-docs/docs/troubleshooting.md | 78 +++++++++++++++++++++++++++ 1 file changed, 78 insertions(+) diff --git a/crowdsec-docs/docs/troubleshooting.md b/crowdsec-docs/docs/troubleshooting.md index 28579a280..5ffeedddd 100644 --- a/crowdsec-docs/docs/troubleshooting.md +++ b/crowdsec-docs/docs/troubleshooting.md @@ -59,6 +59,84 @@ Each Remediation Component has its own configuration file, which is located in t They all have an `api_url` option to set the local API URL. +## CrowdSec Log Location + +By default CrowdSec will log to the following locations depending on platform: + +- **Linux** `/var/log/crowdsec.log` +- **Freebsd** `/var/log/crowdsec.log` + - **Opnsense** `/var/log/crowdsec/crowdsec.log` + - **Pfsense** `/var/log/crowdsec/crowdsec.log` +- **Windows** `C:\Program Files\CrowdSec\logs\crowdsec.log` + +This is the default log location if you are using a third party integration they may change the log location. + +## CrowdSec doesn't start (common causes) + +:::info +If it's a configuration file issue, the error message may log in a different location. For example, if a parser/scenario file is invalid, the error message will be logged in `/var/log/crowdsec.log` but if `config.yaml` is invalid, the error message will be logged in syslog instead. +::: + +Here are some common causes and solutions: + +1. CrowdSec cannot bind to the configured port or IP + - **error** message might look like: +``` +level=fatal msg="while serving local API: listen tcp 127.0.0.1:8080: bind: address already in use" +``` + - **solution** verify another service is not already using the port. If it is, you can edit the `listen_uri` port in the configuration file `/etc/crowdsec/config.yaml` and update `/etc/crowdsec/local_api_credentials.yaml` to the same port. Then you can restart CrowdSec with `sudo systemctl restart crowdsec`. + +2. CrowdSec cannot authenticate to the local API + - **error** message might look like: +``` +level=fatal msg="starting outputs error : authenticate watcher (fcb7303c4df44c03ada289dd7ec3dbe7cU3GaseSWdqUaVg6): API error: ent: machine not found" +``` + - **solution** regenerate the credentials via [cscli machines](/docs/cscli/cscli_machines_add) command. If the local API is on the same machine you can run `sudo cscli machines add -a` (`-a` will automatically generate a random machine name and password). Then you can restart CrowdSec with `sudo systemctl restart crowdsec`. + +3. CrowdSec cannot connect to the local API + - **error** message might look like: +``` +level=error msg="error while performing request: dial tcp 127.0.0.1:8080: connect: connection refused; 4 retries left" +## There may be other variations of this error message just note if the message contains `connection refused` or `connection reset by peer` or `no such host` its likely a connection issue or configuration. +``` + - **solution** verify that the local API runs on the logged IP and port. If the logged IP and port is incorrect, you can update `/etc/crowdsec/local_api_credentials.yaml` to the correct IP and port (If local API is running on the same machine you can run `grep listen_uri /etc/crowdsec/config.yaml` to find it). Then you can restart CrowdSec with `sudo systemctl restart crowdsec`. If the logged IP and port is correct, verify that the local API is running via `sudo systemctl status crowdsec`. + +4. CrowdSec cannot start because of an invalid configuration file + + - **error** message might look like: +``` +level=fatal msg="/etc/crowdsec/config.yaml: yaml: unmarshal errors:\n line 1: field test not found in type csconfig.Config" +``` + - **solution** CrowdSec will inform you which field or line is invalid. You can edit the configuration file and fix the error. Then you can restart CrowdSec with `sudo systemctl restart crowdsec`. If you are unsure what the configuration file should look like you can find the default configuration files [here](https://github.com/crowdsecurity/crowdsec/tree/master/config) or examples via the [documentation](/docs/configuration/crowdsec_configuration). + +## How can I check to see if a service is already using a port? + +You can use the `netstat` command to check if a service is already using a port. + +For example, to check if a service is using port 8080: (Our default port for the local API) + +```bash +sudo netstat -tulpn | grep :8080 +``` + +## How can I check to see if the local API is running? + +You can use the `cscli lapi` command to check if the local API is running and is contactable. + +```bash +sudo cscli lapi status +``` + +## Where does CrowdSec store its data? + +CrowdSec stores its data in `/var/lib/crowdsec/data/` folder for UNIX and `C:\Program Files\CrowdSec\data\` for Windows. + +## Where does CrowdSec store its configuration files? + +CrowdSec stores configuration files in diffent folder dependins on platform: +- **Linux** `/etc/crowdsec/` +- **Freebsd** `/usr/local/etc/crowdsec/` +- **Windows** `C:\Program Files\CrowdSec\` ## My Remediaton Component doesn't start/work (common causes)