Skip to main content
The CrowdSec Security Engine is an open-source, self-hosted intrusion detection and prevention engine. It recognizes brute force, scanning and similar behavior through scenarios, and can hand each detection to a notification plugin. This integration uses the built-in HTTP notification plugin and turns each CrowdSec alert into one Flashduty alert.

In Flashduty On-call

You can get the integration push URL in either of the following ways.

Use a dedicated integration

  1. In the Flashduty console, select Channel and open a channel
  2. Select Configuration → Integrations → Private integration, then click Add integration
  3. Select CrowdSec, then click Save
  4. Open the generated integration card and copy the Push URL

Use a shared integration

  1. In the Flashduty console, go to Integration Center → Alert Events
  2. Select CrowdSec and enter an integration name
  3. Configure the default route and select a channel. You can add more rules under Routing after creation
  4. Click Save and copy the generated Push URL

Configure CrowdSec

Do the following on the machine that runs the CrowdSec Local API (LAPI). The HTTP notification plugin ships with CrowdSec, so nothing extra needs to be installed.
1

Configure the HTTP notification plugin

Where: /etc/crowdsec/notifications/http.yamlEdit /etc/crowdsec/notifications/http.yaml (the same path inside the container for Docker deployments). Keep the default format and fill in url and method:
format must stay {{.|toJson}}: Flashduty parses exactly the default JSON structure of the CrowdSec alert list. Replace url with the full Flashduty push URL. Flashduty identifies the integration by the integration_key in the URL, so keep this file as secret as a key.
2

Enable the notification in a profile

Where: /etc/crowdsec/profiles.yaml › notificationsEdit /etc/crowdsec/profiles.yaml and add notifications to the profile that should notify:
Only alerts that match the profile filters are pushed. After saving, reload CrowdSec with sudo systemctl reload crowdsec (restart the container for Docker deployments).
3

Turn on the auto-resolve timeout

Where: Flashduty console › Channels › Create or edit a channel › Channel info › Auto-resolve timeoutA CrowdSec alert is a one-shot event: after the ban expires, CrowdSec sends nothing more. In the channel that receives these alerts, turn on the auto-resolve timeout. We suggest a timeout equal to the ban duration (4 hours in the example above), counted from Incident trigger. Closing the incident also closes its alerts.
4

Verify

Where: Terminal on the CrowdSec machineRun this on the CrowdSec machine:
An Info alert titled test alert appears in Flashduty. It does not recover on its own, so close it by hand or let the auto-resolve timeout close it. cscli notifications list shows whether the plugin is loaded. cscli notifications test sends a well-formed test alert. To also check the profile filters, let CrowdSec detect a real attack.

What is pushed

Each request carries a JSON array with one CrowdSec alert per element; with group_wait or group_threshold, CrowdSec holds alerts until the next flush, so delivery can lag the detection by up to group_wait, and a request may hold several alerts. Flashduty creates one alert per array element. The event details (events) and the raw logs in meta are not sent to Flashduty.

Alert key

Flashduty uses the uuid that CrowdSec generates for each alert as the Alert Key. A retried request carries the same uuid and merges into the same alert; when the same source IP triggers again later, the new alert has a new uuid and creates a new Flashduty alert. For older releases that send no uuid, Flashduty derives the Alert Key from the scenario, source scope, source value and start_at. Without a uuid, the request is rejected only when scenario or source.value is missing; an empty start_at or source scope is accepted and simply goes into the hash as empty.

Status and severity

CrowdSec provides no severity, so every alert triggers at Warning, including alerts in simulation mode (simulated). The test alert from cscli notifications test is Info and uses its own Alert Key, so it never merges with a real alert.

Labels

The alert title is <scenario> from <source value> and the description is the CrowdSec message.

FAQ

Run cscli notifications test http_default first to confirm the test alert arrives. If it does not, check that url contains integration_key and look for http plugin errors in the CrowdSec log (/var/log/crowdsec.log). If the test alert arrives but real ones do not, the profile filters usually do not match, or http_default is not listed in the profile.
No. Flashduty identifies the integration by integration_key only and does not check extra request headers.
CrowdSec sends no recovery event. Turn on the auto-resolve timeout of the channel, or close the alert in Flashduty by hand.
For more options see the CrowdSec HTTP notification plugin.