CrowdSec

CrowdSec is a security engine that detects and blocks malicious IPs. It parses logs and HTTP requests to spot bad behavior, then hands the verdict to remediation components that stop attacks across the application, system, and infrastructure layers.

The Security Engine combines IDS/IPS and WAF functions in one process. It ships with scenarios such as brute force, port scan, and web scan, and you can pull more scenarios from the hub. The Community Blocklist contributes a curated set of malicious IPs the engine can proactively block.

It runs on Linux, Windows, Docker, OpnSense, and Kubernetes. The Console adds visualization, fleet management, and extra blocklists, while detection rules stay open under an MIT license so you can audit and adapt them.