Agent skill · magnus919
crowdsec
Deploy, configure, and manage CrowdSec — the open-source, collaborative
What it needs
About 9k tokens when loaded.
What this skill does
CrowdSec Skill CrowdSec is an open-source, collaborative security engine that detects and blocks malicious actors. It analyzes logs and HTTP requests using behavior-based patterns (scenarios) and enforces blocks through remediation components (bouncers). Architecture Overview CrowdSec has a modular, API-centric architecture. The main components: Component Role ----------- ------ Security Engine (crowdsec) Reads logs, parses them, evaluates scenarios, and produces alerts/decisions. Runs the Log Processor and Local API (LAPI). Local API (LAPI) HTTP API that stores decisions, serves remediation components, and communicates with the Central API. Runs inside the Security Engine. Central API (CAPI) CrowdSec's cloud service — receives signals from all instances and distributes community blocklists. Remediation Components (formerly "bouncers") Connect to LAPI to fetch decisions and enforce blocks at various levels (firewall, reverse proxy, web server). AppSec Component WAF subsystem that inspects HTTP requests in real-time. Lives in the Security Engine. cscli Command-line tool to manage the entire CrowdSec stack. Data flow: Logs → Parsers (s00-raw, s01-parse, s02-enrich) → Scenarios → Alerts → LAPI → Decisions → Remediation Components → Block Important: The Security Engine alone only detects — it does NOT block. You must add at least one remediation component to enforce decisions. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills magnus919/crowdsec