BeerCon3 - Day 1 - Thibault Koechlin: CrowdSec : Participative IPs

### Overview In this talk, Thibault Koechlin, CTO of CrowdSec, introduces CrowdSec, an open-source, collaborative intrusion detection and prevention system (IDS/IPS) designed to crowdsource cyber threat intelligence (CTI). Koechlin highlights that the traditional "castle" defense model is obsolete due to cloud computing, distributed IT infrastructure, and modern software architectures. Because attackers possess cheaper resources and only need to succeed once, traditional approaches of simply spending more money on security fail. CrowdSec addresses this asymmetry by turning real-world infrastructure defense into a participative network where local detection and remediation inform a global reputation database of malicious IP addresses.

### Key Topics - **Collaborative Cyber Threat Intelligence:** CrowdSec leverages a crowdsourced approach where participating nodes share minimal sighting metadata (banned IP, triggered scenario name, timestamp) back to a central network, which redistributes curated threat intelligence to protect all users. - **Architecture and Extensibility:** The architecture separates log parsing and detection from response. An agent processes log streams (local files, CloudTrail, etc.) using YAML-based parsers and scenarios from a community hub, while "bouncers" enforce actions across multiple layers. - **Flexible Remediation Across Stack Layers:** Rather than relying solely on firewall IP bans, bouncers allow customized remediation depending on business needs, such as presenting CAPTCHAs, managing Cloudflare/CDN rules, adjusting AWS/GCP security groups, or integrating directly into applications (e.g., PHP libraries or WordPress plugins). - **Combatting Poisoning and False Positives:** To preserve data integrity, CrowdSec uses a trust-rank system based on user tenure and compute expenditure, cross-verifies alerts against internal honeypot fleets, enforces open whitelists, and applies predictive clustering algorithms to group related botnet or distributed attack behaviors. - **Threat Intelligence Hygiene and Expiration:** Acknowledging that public IPs frequently belong to compromised hosts that eventually get cleaned up or reassigned by cloud providers, CrowdSec automatically rehabilitates IPs if attack signals stop for 72 hours to one week.

### Technical Details During the live demonstration, Koechlin walked through installing CrowdSec on a Linux VM running Nginx and SSH. Out of the box, CrowdSec automatically detected running services and installed the relevant configuration collections. When an attack simulation was launched using Nikto, CrowdSec parsed the access logs, identified directory traversal and HTTP probing behaviors, and locally triggered an alert with a 4-hour ban recommendation. Because the detection engine is decoupled from enforcement, blocking was enacted once an Nginx bouncer was installed, immediately returning HTTP 403 Forbidden responses to the attacker.

Koechlin demonstrated operational tooling, including Docker-based Metabase dashboards connected to SQLite for log visualization, as well as native Prometheus instrumentation. CrowdSec also supports log replay mode, allowing administrators to run new YAML detection scenarios against historical logs (e.g., from 2019) to tune rules, identify previous compromises, and avoid false positives before deploying them in production. Distributed environments communicate via REST APIs, and notification plugins support destinations like Slack, Splunk, ElasticSearch, and generic HTTP endpoints. Packages are supported across Debian, RPM, FreeBSD, Docker, OpenWrt, Helm charts, and serverless environments (e.g., AWS Lambda authorizers).

### Takeaways CrowdSec pairs open-source host security with global, crowd-powered threat intelligence to exhaust finite attacker IP resources without imposing burdensome false positives on legitimate users. The software remains free under an open-source license, while monetization centers on enterprise console capabilities (SSO, organizational management) and commercial access to the broader CTI feed for non-contributing entities. By keeping the barrier to entry low for system administrators and emphasizing timely list expiration, CrowdSec provides practical defense against both opportunistic noise and distributed attacks like credential stuffing and carding.