Installation

• Adding repository

curl -s https://install.crowdsec.net | sudo sh

• Installing security engine

apt install crowdsec

• Installing IPTABLES remediation component

apt install crowdsec-firewall-bouncer-iptables

• Creating a whitelist for trusted sources

cscli allowlist create IP_WL -d 'Trusted IP range'

cscli allowlist add IP_WL 127.0.0.1 # << Change this

• Checking

cscli allowlist inspect IP_WL

• Making sure we are parsing the logs

cscli metrics show acquisition

• Log into the portal and get the enrollment key. After that enroll the engine and then accept the enrollment from the portal

cscli console enroll $ENROLLMENT_KEY