crowdsec
Operational skill for installing, configuring, operating, and debugging CrowdSec (cscli, LAPI/CAPI, hub, bouncers, WAF/AppSec) across bare-m
Open source Repository Open in the app JSON README (API)
About
Operational skill for installing, configuring, operating, and debugging CrowdSec (cscli, LAPI/CAPI, hub, bouncers, WAF/AppSec) across bare-metal, Docker, and Kubernetes.
Details
- Kind
- Plugins
- Topic
- Cloud & DevOps
- Publisher
- crowdsecurity
- Origin
- marketplace
- Category
- ferramentas
- Stars
- 23
- Forks
- 1
- Open pull requests
- 2
- Last push
- 2026-09-01T10:09:33Z
- Repository state
- ativo
- Language
- Shell
- License
- MIT
- Added
- 2026-08-30 01:48:58
- Updated
- 2026-09-02 17:01:04
- Origin id
crowdsecurity/crowdsec-skill/crowdsec
README
<div align="center"> <img src="https://raw.githubusercontent.com/crowdsecurity/crowdsec-docs/main/crowdsec-docs/static/img/crowdsec_logo.png" alt="CrowdSec" width="280"> # CrowdSec skills **Install, configure, operate, and debug [CrowdSec](https://doc.crowdsec.net) — straight from your terminal, with your coding agent doing the heavy lifting.** [](.claude-plugin/plugin.json) [](LICENSE) [](https://docs.claude.com/en/docs/claude-code/skills) [](https://docs.crowdsec.net) </div> --- This plugin bundles **two [Agent Skills](https://docs.claude.com/en/docs/claude-code/skills)**: - **`crowdsec`** — a hands-on CrowdSec operator. Stand up an engine, wire a bouncer, enable the WAF, or figure out why nothing's getting blocked. It knows the `cscli` commands, the config layout, the failure modes, and the safe way through each across **bare-metal/systemd, Docker, OpnSense and Kubernetes/Helm**. - **`crowdsec-service-api`** — drives the premium **Console Service API** (cloud) on your behalf with your API key: create and populate blocklists/allowlists, wire firewall/appliance integrations, pull remediation ROI metrics, and manage org-level decisions — every state change gated behind an explicit confirmation. ## What it covers **`crowdsec` (operational):** | Area | Covered | |---|---| | **Install** | bare-metal/systemd · Docker · Kubernetes/Helm · OpnSense · Console enrollment | | **Bouncers** | firewall (iptables/nftables/ipset) · nginx · traefik · caddy · apache · and more | | **WAF / AppSec** | deploy · configure · troubleshoot the AppSec component | | **Hub** | install collections/parsers/scenarios · update · debug | | **Configure** | acquisition · profiles & ban durations · notifications · allowlists | | **Operate** | health checks & smoke tests · upgrades & rollback · multi-server / remote LAPI / mTLS | | **Debug** | logs not parsing · no alerts firing · bouncer not blocking · specific errors | **`crowdsec-service-api` (premium cloud API):** | Area | Covered | |---|---| | **Blocklists** | create · add/remove/bulk IPs (with expiry) · download · share across orgs · subscribe engines/bouncers | | **Allowlists** | create · items with expiry · subscribe by engine/tag/org | | **Integrations** | firewall/appliance feeds (Palo Alto, Fortinet, Cisco, F5, Sophos, pfSense/OPNsense…) · paginated Basic-auth content pull | | **Metrics** | remediation ROI (traffic dropped, bytes/egress saved, attacks prevented) | | **Decisions** | org-level decisions + aggregated (read/manage) | ## 🚀 Install The skill loads automatically once installed. Just talk to your agent about CrowdSec. **On Claude Code** ```text /plugin marketplace add crowdsecurity/crowdsec-skill /plugin install crowdsec@crowdsecurity ``` Update later with: ```text /plugin marketplace update crowdsecurity ``` **On Codex:** install the skill with: ```text skill-installer crowdsecurity/crowdsec-skill ``` **On Claude.ai (web)** Download `crowdsec-skill-vX.Y.Z.zip` from the [latest release](https://github.com/crowdsecurity/crowdsec-skill/releases/latest) and upload it in the web skill uploader. **Or directly with skills.sh** ```bash npx skills add crowdsecurity/crowdsec-skill ``` ## 💬 Example prompts Once installed, the agent picks the skill up whenever your prompt involves CrowdSec: - _"Install CrowdSec on this server and set up the nginx bouncer."_ - _"Deploy CrowdSec in my Kubernetes cluster and enroll it in the Console."_ - _"Enable the WAF / AppSec on my server."_ - _"CrowdSec doesn't detect attacks on my nginx server, why?"_ - _"There's a decision for this IP but it's not being blocked."_ - _"Migrate my fail2ban jails to CrowdSec."_ - _"Create a Console blocklist and push these IPs from my SIEM to it."_ (Service API) - _"Wire a Palo Alto external dynamic list to my CrowdSec blocklist."_ (Service API) - _"Show me the remediation ROI metrics for last month."_ (Service API) ## What it does **not** do This is an **operational** skill. It deploys, configures, and debugs CrowdSec — it does **not author** detection content. Writing a parser, scenario, or WAF (AppSec) rule is out of scope. For authoring, head to the [CrowdSec Hub](https://hub.crowdsec.net) and the [detection-engineering docs](https://docs.crowdsec.net/docs/next/local_api/intro). ## 🤝 Contributing Issues and PRs welcome. Improvements to the reference docs and new environment coverage are appreciated. If you see anything missing or wrong, don't hesitate to open a PR. ## 🔗 Links - CrowdSec: <https://www.crowdsec.net> - Documentation: <https://docs.crowdsec.net> - Hub: <https://hub.crowdsec.net> - Console: <https://app.crowdsec.net> ## 📄 License MIT — see [LICENSE](LICENSE).