Crowdsec IPS Cost Optimization ลดค่าใช้จ่าย

CrowdSec IPS Cost Optimization

CrowdSec IPS Cost Optimization ลดค่าใช้จ่าย Open Source Community Intelligence Bouncer Firewall Nginx Cloudflare Block Attack

Installation & Setup

# === CrowdSec Installation ===

# Install CrowdSec Agent
# curl -s https://packagecloud.io/install/repositories/crowdsec/crowdsec/script.deb.sh | sudo bash
# sudo apt install crowdsec
#
# Install Firewall Bouncer
# sudo apt install crowdsec-firewall-bouncer-iptables
#
# Install Nginx Bouncer (alternative)
# sudo apt install crowdsec-nginx-bouncer
#
# Check Status
# sudo systemctl status crowdsec
# sudo cscli metrics
#
# Install Scenarios
# sudo cscli scenarios install crowdsecurity/http-bf
# sudo cscli scenarios install crowdsecurity/ssh-bf
# sudo cscli scenarios install crowdsecurity/http-crawl-non_statics
# sudo cscli scenarios install crowdsecurity/http-bad-user-agent
#
# Whitelist Trusted IPs
# sudo cscli parsers install crowdsecurity/whitelists
# # Edit /etc/crowdsec/parsers/s02-enrich/whitelists.yaml
# # Add your office/VPN IPs
#
# View Decisions (Blocked IPs)
# sudo cscli decisions list
# sudo cscli alerts list

from dataclasses import dataclass

@dataclass
class SetupStep:
    step: str
    command: str
    time: str
    note: str

steps = [
    SetupStep("Install Agent",
        "apt install crowdsec",
        "2 นาที",
        "Auto-detect Nginx Apache SSH Logs"),
    SetupStep("Install Bouncer",
        "apt install crowdsec-firewall-bouncer-iptables",
        "1 นาที",
        "Block ที่ iptables Level ทันที"),
    SetupStep("Install Scenarios",
        "cscli scenarios install crowdsecurity/http-bf",
        "1 นาที",
        "HTTP Brute-force SSH BF Crawl Bad UA"),
    SetupStep("Whitelist IPs",
        "Edit whitelists.yaml add office VPN IPs",
        "5 นาที",
        "ป้องกัน Block ตัวเอง"),
    SetupStep("Enable Community Blocklist",
        "cscli capi register (auto on install)",
        "อัตโนมัติ",
        "รับ Blocklist จาก Community ทั่วโลก"),
    SetupStep("Setup Console",
        "cscli console enroll TOKEN",
        "2 นาที",
        "Dashboard ดู Alert Decisions ทุก Server"),
]

print("=== Setup Steps ===")
for s in steps:
    print(f"  [{s.step}] Time: {s.time}")
    print(f"    Command: {s.command}")
    print(f"    Note: {s.note}")

Cost Comparison

# === Cost Comparison Calculator ===

@dataclass
class CostItem:
    solution: str
    license_year: float
    hardware_year: float
    admin_year: float
    total_year: float
    notes: str

costs = [
    CostItem("Palo Alto IPS (10 Servers)",
        25000, 15000, 80000, 120000,
        "Hardware Appliance + License + Dedicated Admin"),
    CostItem("Fortinet IPS (10 Servers)",
        15000, 10000, 80000, 105000,
        "Hardware UTM + License + Dedicated Admin"),
    CostItem("Cloudflare WAF Pro (10 Domains)",
        24000, 0, 20000, 44000,
        "SaaS No Hardware Part-time Admin"),
    CostItem("Suricata/Snort (Self-managed)",
        0, 5000, 60000, 65000,
        "Free Software + Server + Full-time Admin for Rules"),
    CostItem("CrowdSec Free (10 Servers)",
        0, 0, 10000, 10000,
        "Free Agent Bouncer Community Blocklist Part-time"),
    CostItem("CrowdSec Premium (10 Servers)",
        6000, 0, 10000, 16000,
        "Premium Blocklist Console Support Part-time"),
]

print("=== Cost Comparison ===")
baseline = costs[0].total_year
for c in costs:
    savings = baseline - c.total_year
    pct = (savings / baseline) * 100
    print(f"\n  [{c.solution}]")
    print(f"    License:  | HW:  | Admin: ")
    print(f"    Total: /year | Savings:  ({pct:.0f}%)")
    print(f"    Notes: {c.notes}")

Production Monitoring

# === CrowdSec Production Monitoring ===

# Prometheus Metrics
# CrowdSec exposes metrics at localhost:6060/metrics
# cs_active_decisions - Current blocked IPs
# cs_alerts_total - Total alerts
# cs_parsers_hits_total - Log lines parsed
# cs_scenarios_overflow_total - Scenarios triggered

@dataclass
class MonitorMetric:
    metric: str
    source: str
    target: str
    alert: str

metrics = [
    MonitorMetric("Active Decisions (Blocked IPs)",
        "cscli decisions list | Prometheus cs_active_decisions",
        "ดูจำนวน IP ที่ Block อยู่",
        "Spike > 2x average → Check Attack Campaign"),
    MonitorMetric("Alert Rate",
        "cscli alerts list | Prometheus cs_alerts_total",
        "< 100 alerts/hour ปกติ",
        "> 500/hour → P2 Active Attack Campaign"),
    MonitorMetric("False Positive Rate",
        "Manual review + User reports",
        "< 1% of decisions",
        "Any FP on critical IP → P1 Whitelist Immediately"),
    MonitorMetric("Agent Health",
        "systemctl status crowdsec | Prometheus up",
        "Running on all servers",
        "Agent Down → P1 Server Unprotected"),
    MonitorMetric("Bouncer Health",
        "systemctl status crowdsec-firewall-bouncer",
        "Running and connected to Agent",
        "Bouncer Down → P1 Decisions Not Enforced"),
    MonitorMetric("Community Blocklist Sync",
        "cscli capi status",
        "Last sync < 1 hour ago",
        "Sync Failed > 4 hours → P2 Check API Key Network"),
]

print("=== Production Monitoring ===")
for m in metrics:
    print(f"  [{m.metric}]")
    print(f"    Source: {m.source}")
    print(f"    Target: {m.target}")
    print(f"    Alert: {m.alert}")

เคล็ดลับ

• Cloudflare Bouncer: ใช้ Cloudflare Bouncer Block ที่ Edge ลด Load 90%+
• Whitelist: Whitelist Office VPN IP ก่อนเปิดใช้ ป้องกัน Block ตัวเอง
• Community: เปิด Community Blocklist รับ Threat Intel ฟรีจากทั่วโลก
• Console: ใช้ Console Dashboard จัดการหลาย Server จากที่เดียว
• Ban Duration: ตั้ง Ban Duration ตาม Attack Type (SSH=24h HTTP=4h)

CrowdSec คืออะไร

Open Source IPS Crowd-sourced Community Intelligence Agent Bouncer Scenario Block Firewall Nginx Cloudflare MIT License Free

สรุป

CrowdSec IPS Cost Optimization ลดค่าใช้จ่าย 80-95% Open Source Community Blocklist Agent Bouncer Firewall Nginx Cloudflare Production