Skip to main content
Version: v1.3.0

Decisions management

info

Please see your local sudo cscli help decisions for up-to-date documentation.

List active decisions#

sudo cscli decisions list
Example
sudo cscli decisions list+--------+----------+------------------+------------------------------------+--------+---------+--------------------------------+--------+-----------------+----------+|   ID   |  SOURCE  |   SCOPE:VALUE    |               REASON               | ACTION | COUNTRY |               AS               | EVENTS |   EXPIRATION    | ALERT ID |+--------+----------+------------------+------------------------------------+--------+---------+--------------------------------+--------+-----------------+----------+| 276009 | crowdsec | Ip:xx.93.x.xxx   | crowdsecurity/telnet-bf            | ban    | CN      |  xxxxxxxx xxxxxxx Advertising  |      7 | 2m53.949221341s |    33459 ||        |          |                  |                                    |        |         | Co.,Ltd.                       |        |                 |          || 276008 | crowdsec | Ip:xxx.53.xx.xxx | crowdsecurity/smb-bf               | ban    | BR      |  xxxxxxxxxx xxxxxxxxxxxxxxxx   |      6 | 1m48.728998974s |    33458 ||        |          |                  |                                    |        |         | LTDA                           |        |                 |          |+--------+----------+------------------+------------------------------------+--------+---------+--------------------------------+--------+-----------------+----------+
  • SOURCE : the source of the decisions:
    • crowdsec : decision from crowdsec agent
    • cscli : decision from cscli (manual decision)
    • CAPI : decision from crowdsec API
  • SCOPE:VALUE is the target of the decisions :
    • "scope" : the scope of the decisions (ip, range, user ...)
    • "value" : the value to apply on the decisions (ip_addr, ip_range, username ...)
  • REASON is the scenario that was triggered (or human-supplied reason)
  • ACTION is the type of the decision (ban, captcha ...)
  • COUNTRY and AS are provided by GeoIP enrichment if present
  • EVENTS number of event that triggered this decison
  • EXPIRATION is the time left on remediation
  • ALERT ID is the ID of the corresponding alert

Check command usage for additional filtering and output control flags.

Add a decision#

Ban an IP

sudo cscli decisions add -i 1.2.3.4
info
  • default duration: 4h
  • default type : ban

Add a decision (ban) on IP 1.2.3.4 for 24 hours, with reason 'web bruteforce'

sudo cscli decisions add --ip 1.2.3.4 --duration 24h --reason "web bruteforce"

Add a decision (ban) on range 1.2.3.0/24 for 4 hours, with reason 'web bruteforce'

sudo cscli decisions add --range 1.2.3.0/24 --reason "web bruteforce"

Add a decision (captcha) on ip 1.2.3.4 for 4hours (default duration), with reason 'web bruteforce'

sudo cscli decisions add --ip 1.2.3.4 --reason "web bruteforce" --type captcha

Delete a decision#

delete the decision on IP 1.2.3.4

sudo cscli decisions delete --ip 1.2.3.4

delete the decision on range 1.2.3.0/24

sudo cscli decisions delete --range 1.2.3.0/24
caution

Please note that cscli decisions list will show you only the latest alert per given ip/scope. However, several decisions targeting the same IP can exist. If you want to be sure to clear all decisions for a given ip/scope, use cscli decisions delete -i x.x.x.x

delete a decision by ID

sudo cscli  decisions delete --id 74

Delete all existing bans#

Flush all the existing bans

sudo cscli decisions delete --all
caution

This will as well remove any existing ban

Import decisions#

sudo cscli decisions import -i foo.csv

You can import a CSV or JSON file containing decisions directly with cscli.

The value field is mandatory and contains the target of the decision (ip, range, username, ...).

The following fields are optional:

  • duration: duration of the decisions, defaults to 4h
  • reason: reason for the decisions, defaults to manual
  • origin: source of the decisions, defaults to cscli
  • type: action to apply for the decision, defaults to ban
  • scope: scope of the decision, default to ip

All fields (except for value) can be overwritten by command-line arguments, you can see the list in the cli documentation.

Example JSON file:

[   {      "duration" : "4h",       "scope" : "ip",       "type" : "ban",       "value" : "1.2.3.5"   }]

Example CSV file :

duration,scope,value24h,ip,1.2.3.4
caution

If you use the sqlite database backend, performance can be negatively impacted if you import a lot of decisions (> 10000 decisions).