CrowdSec
CrowdSec · Montrouge, France · founded 2020
What it is
CrowdSec is an open-source security stack designed to detect and block malicious IP addresses to help protect infrastructure and applications. Its Security Engine analyzes logs and requests for harmful behavior and attacks, while the Remediation Component blocks IPs identified by the engine. CrowdSec says analysis happens locally and logs remain within the user's infrastructure. The AppSec Component can provide web application firewall protection. The free Community offering includes real-time decision management, audit support, AWS CloudTrail scenarios, CAPI allow lists, and Kubernetes audit acquisition. Its IP Reputation service provides context such as activity timelines, autonomous system and IP range reputation, and MITRE technique classification, with hourly updated data. Listed integrations include Microsoft Sentinel, AWS log sources, WordPress, Cloudflare, Docker, and Kubernetes. The Community Security Engine is free. The IP Reputation API is listed at $49 a month for 5,000 queries. Other listed services include blocklists and threat-intelligence options; CrowdSec Console Premium lists optional premium service and support for $1K/month.
For and against
For
- Analyzes logs and requests locally.
- Remediation component blocks identified malicious IPs.
- AppSec can provide web application firewall protection.
- Community Security Engine is free.
- IP Reputation data is updated hourly.
Against
- IP Reputation API costs $49 a month for 5,000 queries.
- Console Premium service and support is listed at $1K/month.
- Commercial use of CrowdSec data in an offering requires its Partnership Program.
The verdict
CrowdSec combines local behavior analysis with IP remediation and an AppSec component. Its free Community Security Engine is distinct from paid reputation, blocklist, and premium service options.
Who it suits
CrowdSec suits teams seeking to detect or block malicious IP activity across infrastructure and applications. Listed sectors include hosting, education, ecommerce, finance, government, media, and healthcare.
Plans and prices
IP Reputation API
5,000 queries · 32 context criteria · hourly updated data · multiple API keys
Read 15 Oct 2026 · crowdsec.net
Platinum Blocklists
All blocklists · any number of company endpoints · firewall and CDN integrations
Read 15 Oct 2026 · crowdsec.net
Live Exploit Tracker
CVE exploitation status · attacker IPs · vendor targeting · hourly refreshed IPs
Read 15 Oct 2026 · crowdsec.net
Community
Free plan for enthusiasts and individuals · behavioral detection · security response automation
Read 15 Oct 2026 · crowdsec.net
Local CTI replication
Local synchronization of CrowdSec threat-intelligence data
Read 15 Oct 2026 · crowdsec.net
Community Security Engine
Open source MIT license · free CrowdSec Console account available
Read 28 Sep 2026 · crowdsec.net
IP Reputation API access
5000 queries
Read 28 Sep 2026 · crowdsec.net
CrowdSec Console Premium
Premium blocklist · alert-surge notifications · advanced stack management · health monitoring
Read 15 Oct 2026 · crowdsec.net
On the record
- API integrations
- The CTI API documentation lists native integrations including Microsoft Sentinel, Splunk, TheHive, OpenCTI, Maltego, MISP, QRadar and Security Copilot.docs.crowdsec.net · read 15 Oct 2026
- Application security
- The AppSec Component turns the Security Engine into a web application firewall and can protect web applications from the latest vulnerabilities.crowdsec.net · read 28 Sep 2026
- AppSec
- AppSec rules are part of the log processor and can filter HTTP requests from compatible web servers.docs.crowdsec.net · read 15 Oct 2026
- Behavior detection
- The Security Engine analyzes logs and requests to detect malicious behaviors and attacks.crowdsec.net · read 28 Sep 2026
- Blocklist integrations
- Hosted blocklist endpoints support plain text, F5, FortiGate, Palo Alto, Check Point, Cisco, Juniper, MikroTik, pfSense, OPNsense, Sophos and remediation-component formats.docs.crowdsec.net · read 15 Oct 2026
- Commercial usage
- The pricing FAQ says commercial use of CrowdSec data in an offering is available through its Partnership Program, with partner pricing on request.crowdsec.net · read 28 Sep 2026
- Community features
- The free Community offering includes real-time decision management, audit support, AWS CloudTrail scenarios, CAPI allow lists, and Kubernetes audit acquisition.crowdsec.net · read 28 Sep 2026
- Community intelligence
- Participating engines share detected attacks and receive a curated community blocklist of validated attackers.docs.crowdsec.net · read 15 Oct 2026
- Company profile
- LinkedIn lists CrowdSec as a privately held computer and network security company with 11–50 employees, Paris headquarters and a 2020 founding year.linkedin.com · read 15 Oct 2026
- Data handling
- CrowdSec's privacy policy says only contextualized IP addresses with incident date, time, and type are processed in the described ecosystem service, and says no directly identifying data is included in those lists.crowdsec.net · read 28 Sep 2026
- Default ports
- The Security Engine uses localhost-bound TCP ports 6060 for Prometheus metrics and 8080 for its API by default.docs.crowdsec.net · read 15 Oct 2026
- Deployment
- Official documentation describes single-host, multi-machine, centralized-log, Kubernetes, container and WAF-only deployments.docs.crowdsec.net · read 15 Oct 2026
- Detection engine
- The log processor analyzes data sources and HTTP requests, while the Local API connects processors, remediation components and the Central API.docs.crowdsec.net · read 15 Oct 2026
- Documentation depth
- The documentation includes installation guides, architecture, data sources, remediation, APIs, integrations, compilation and contribution/testing guidance.docs.crowdsec.net · read 15 Oct 2026
- Funding
- CrowdSec announced a €14 million Series A funding round in 2022 led by BREEGA and Supernova Invest.crowdsec.net · read 15 Oct 2026
- Hardware requirements
- Recommended minimums are one CPU core, 100 MB free RAM, 1 GB free disk and amd64, arm64 or armhf hardware.docs.crowdsec.net · read 15 Oct 2026
- Integration examples
- The integrations directory lists Microsoft Sentinel, Juniper, AWS log sources, WordPress, Chrome Extension, Windows Firewall, Cloudflare, Docker, and Kubernetes integrations.crowdsec.net · read 28 Sep 2026
- Kubernetes requirements
- The documented Kubernetes installation requires kubectl and Helm, and the default SQLite database does not support replication.docs.crowdsec.net · read 15 Oct 2026
