Crowdsec IPS Compliance Automation

CrowdSec IPS

CrowdSec IPS Intrusion Prevention Behavior Analysis Community Threat Intelligence Bouncer Compliance GDPR PCI DSS ISO 27001 Automation Block IP Linux Docker Kubernetes

CrowdSec Setup

# === CrowdSec Installation ===

# Install CrowdSec
# curl -s https://packagecloud.io/install/repositories/crowdsec/crowdsec/script.deb.sh | sudo bash
# sudo apt install crowdsec

# Install Firewall Bouncer
# sudo apt install crowdsec-firewall-bouncer-iptables

# Install Nginx Bouncer
# sudo apt install crowdsec-nginx-bouncer

# Check Status
# sudo cscli metrics
# sudo cscli decisions list
# sudo cscli alerts list

# Configuration — /etc/crowdsec/acquis.yaml
# ---
# filenames:
#   - /var/log/nginx/access.log
#   - /var/log/nginx/error.log
# labels:
#   type: nginx
# ---
# filenames:
#   - /var/log/auth.log
# labels:
#   type: syslog
# ---
# filenames:
#   - /var/log/apache2/access.log
# labels:
#   type: apache2

# Install Collections (Parsers + Scenarios)
# sudo cscli collections install crowdsecurity/nginx
# sudo cscli collections install crowdsecurity/sshd
# sudo cscli collections install crowdsecurity/linux
# sudo cscli collections install crowdsecurity/http-cve

# Whitelist your IP
# sudo cscli decisions delete --ip YOUR_IP
# echo "name: whitelist\nreason: admin\nip: YOUR_IP" > /etc/crowdsec/parsers/s02-enrich/whitelist.yaml

from dataclasses import dataclass
from typing import List

@dataclass
class ThreatEvent:
    timestamp: str
    source_ip: str
    scenario: str
    action: str
    duration: str
    country: str

events = [
    ThreatEvent("14:23:15", "185.220.101.45", "crowdsecurity/ssh-bf", "ban 4h", "4 hours", "RU"),
    ThreatEvent("14:25:30", "45.155.205.233", "crowdsecurity/http-probing", "ban 4h", "4 hours", "CN"),
    ThreatEvent("14:28:45", "192.168.1.100", "crowdsecurity/http-bf-wordpress", "ban 4h", "4 hours", "TH"),
    ThreatEvent("14:30:00", "103.152.220.44", "crowdsecurity/CVE-2021-44228", "ban 24h", "24 hours", "VN"),
    ThreatEvent("14:32:10", "91.240.118.172", "crowdsecurity/http-crawl-non_statics", "ban 4h", "4 hours", "UA"),
]

print("=== CrowdSec Alert Log ===")
for e in events:
    print(f"  [{e.timestamp}] {e.source_ip} ({e.country})")
    print(f"    Scenario: {e.scenario} | Action: {e.action}")

Compliance Framework

# === Compliance Automation ===

# CrowdSec helps with:
# PCI DSS 3.2.1:
#   Req 1: Firewall configuration (Bouncer)
#   Req 10: Log monitoring (Parser + Scenarios)
#   Req 11: IDS/IPS testing (Behavior Analysis)
#
# GDPR:
#   Article 32: Security measures (automated blocking)
#   Article 33: Breach notification (alerting)
#
# ISO 27001:
#   A.12.4: Logging and monitoring
#   A.13.1: Network security management

@dataclass
class ComplianceControl:
    framework: str
    requirement: str
    crowdsec_feature: str
    status: str
    evidence: str

controls = [
    ComplianceControl("PCI DSS", "Req 1 — Firewall", "Firewall Bouncer auto-block", "Pass", "Decision logs"),
    ComplianceControl("PCI DSS", "Req 10 — Logging", "Log parsing + analysis", "Pass", "acquis.yaml + metrics"),
    ComplianceControl("PCI DSS", "Req 11 — IDS/IPS", "Behavior scenarios", "Pass", "Alert history"),
    ComplianceControl("GDPR", "Art 32 — Security", "Auto-blocking threats", "Pass", "Decision + metrics"),
    ComplianceControl("GDPR", "Art 33 — Notification", "Alert webhook", "Pass", "Slack/Email alerts"),
    ComplianceControl("ISO 27001", "A.12.4 — Monitoring", "Real-time log analysis", "Pass", "Dashboard + SIEM"),
]

print("\n=== Compliance Status ===")
for c in controls:
    print(f"  [{c.status}] {c.framework} — {c.requirement}")
    print(f"    Feature: {c.crowdsec_feature} | Evidence: {c.evidence}")

# Automated Report
report_metrics = {
    "Threats Blocked (30d)": "12,450",
    "Unique Source IPs": "3,280",
    "Top Scenario": "SSH Brute Force (45%)",
    "Top Country": "China (28%), Russia (18%)",
    "Avg Response Time": "< 2 seconds",
    "False Positive Rate": "0.3%",
    "Community CTI Signals": "150,000+ IPs shared",
    "Uptime": "99.99%",
}

print(f"\nCompliance Report:")
for k, v in report_metrics.items():
    print(f"  {k}: {v}")

Enterprise Deployment

# === Enterprise Multi-server ===

# Docker Compose
# services:
#   crowdsec:
#     image: crowdsecurity/crowdsec:latest
#     environment:
#       - COLLECTIONS=crowdsecurity/nginx crowdsecurity/sshd
#       - ENROLL_KEY=your-console-key
#     volumes:
#       - /var/log/nginx:/var/log/nginx:ro
#       - /var/log/auth.log:/var/log/auth.log:ro
#       - crowdsec-db:/var/lib/crowdsec/data
#       - crowdsec-config:/etc/crowdsec
#     restart: always
#
#   bouncer-nginx:
#     image: crowdsecurity/crowdsec-openresty-bouncer
#     environment:
#       - CROWDSEC_BOUNCER_API_KEY=bouncer-key
#       - CROWDSEC_BOUNCER_HOST=crowdsec:8080
#     depends_on: [crowdsec]

# Kubernetes — Helm
# helm repo add crowdsec https://crowdsecurity.github.io/helm-charts
# helm install crowdsec crowdsec/crowdsec \
#   --set agent.acquisition[0].namespace=nginx \
#   --set agent.acquisition[0].podName=nginx-* \
#   --set lapi.env[0].name=ENROLL_KEY \
#   --set lapi.env[0].value=your-key

# SIEM Integration
# sudo cscli notifications install email
# sudo cscli notifications install slack
# sudo cscli notifications install http  # webhook to SIEM

# Elasticsearch Export
# profiles.yaml:
# - name: default_ip_remediation
#   notifications:
#     - http_elastic
#   on_success: apply
#   decisions:
#     - type: ban

automation_tasks = [
    "Auto-block: IP ที่ Brute Force ถูก Ban อัตโนมัติ",
    "Auto-report: สร้าง Compliance Report ทุกเดือน",
    "Auto-update: อัพเดท Scenarios Collections อัตโนมัติ",
    "Auto-alert: แจ้ง Slack Email เมื่อมี Critical Alert",
    "Auto-whitelist: Import Whitelist จาก CMDB อัตโนมัติ",
    "Auto-escalate: Escalate ถ้า Alert > Threshold",
    "Auto-export: ส่ง Log ไป SIEM ทุก Event",
]

print("Automation Tasks:")
for i, t in enumerate(automation_tasks, 1):
    print(f"  {i}. {t}")

เคล็ดลับ

• Collections: ติดตั้ง Collections ที่ตรงกับ Stack เช่น nginx sshd
• Console: ลงทะเบียน Console ดู Dashboard จัดการหลายเครื่อง
• Whitelist: Whitelist IP Admin ป้องกัน Lock ตัวเอง
• SIEM: ส่ง Alert ไป SIEM สำหรับ Audit Trail
• Update: อัพเดท Scenarios สม่ำเสมอ ป้องกัน CVE ใหม่

การนำไปใช้งานจริงในองค์กร

สำหรับองค์กรขนาดกลางถึงใหญ่ แนะนำให้ใช้หลัก Three-Tier Architecture คือ Core Layer ที่เป็นแกนกลางของระบบ Distribution Layer ที่ทำหน้าที่กระจาย Traffic และ Access Layer ที่เชื่อมต่อกับผู้ใช้โดยตรง การแบ่ง Layer ชัดเจนช่วยให้การ Troubleshoot ง่ายขึ้นและสามารถ Scale ระบบได้ตามความต้องการ

เรื่อง Network Security ก็สำคัญไม่แพ้กัน ควรติดตั้ง Next-Generation Firewall ที่สามารถ Deep Packet Inspection ได้ ใช้ Network Segmentation แยก VLAN สำหรับแต่ละแผนก ติดตั้ง IDS/IPS เพื่อตรวจจับการโจมตี และทำ Regular Security Audit อย่างน้อยปีละ 2 ครั้ง

สรุป

CrowdSec IPS Compliance Automation Behavior Analysis Community CTI Bouncer Block PCI DSS GDPR ISO 27001 SIEM Alert Docker Kubernetes Enterprise Production