{"users":[{"id":812,"username":"Finance6104","name":null,"avatar_template":"https://avatars.discourse-cdn.com/v4/letter/f/df705f/{size}.png","trust_level":1},{"id":1,"username":"thibault","name":"Thibault","avatar_template":"/user_avatar/discourse.crowdsec.net/thibault/{size}/2_2.png","admin":true,"moderator":true,"trust_level":4},{"id":177,"username":"mmetc","name":"mmetc","avatar_template":"/user_avatar/discourse.crowdsec.net/mmetc/{size}/233_2.png","trust_level":1},{"id":1671,"username":"brott8","name":"Brott8","avatar_template":"/user_avatar/discourse.crowdsec.net/brott8/{size}/1454_2.png","trust_level":0},{"id":1667,"username":"bosunjohnson","name":null,"avatar_template":"/user_avatar/discourse.crowdsec.net/bosunjohnson/{size}/1450_2.png","trust_level":0},{"id":1616,"username":"Emmanuel","name":"","avatar_template":"https://avatars.discourse-cdn.com/v4/letter/e/3e96dc/{size}.png","trust_level":0},{"id":606,"username":"j0nny55555","name":"Jonny5","avatar_template":"/user_avatar/discourse.crowdsec.net/j0nny55555/{size}/744_2.png","trust_level":1},{"id":1402,"username":"rbaino","name":null,"avatar_template":"https://avatars.discourse-cdn.com/v4/letter/r/e36b37/{size}.png","trust_level":0},{"id":1387,"username":"Thomas","name":"","avatar_template":"https://avatars.discourse-cdn.com/v4/letter/t/e36b37/{size}.png","trust_level":0},{"id":1228,"username":"Mic2026","name":null,"avatar_template":"https://avatars.discourse-cdn.com/v4/letter/m/5f8ce5/{size}.png","trust_level":0},{"id":1191,"username":"Lukes","name":"","avatar_template":"https://avatars.discourse-cdn.com/v4/letter/l/4da419/{size}.png","trust_level":0},{"id":1239,"username":"matthys70","name":"Matthys70","avatar_template":"/user_avatar/discourse.crowdsec.net/matthys70/{size}/1410_2.png","trust_level":0},{"id":327,"username":"Cyrille37","name":"","avatar_template":"https://avatars.discourse-cdn.com/v4/letter/c/90db22/{size}.png","trust_level":2},{"id":690,"username":"Tammes","name":null,"avatar_template":"https://avatars.discourse-cdn.com/v4/letter/t/b77776/{size}.png","trust_level":1},{"id":308,"username":"iiAmLoz","name":"Laurence","avatar_template":"/user_avatar/discourse.crowdsec.net/iiamloz/{size}/386_2.png","admin":true,"trust_level":1},{"id":1275,"username":"pedrobuffon","name":"Pedro Buffon","avatar_template":"/user_avatar/discourse.crowdsec.net/pedrobuffon/{size}/1415_2.png","trust_level":0},{"id":1243,"username":"lexuzieel","name":"Aleksei","avatar_template":"/user_avatar/discourse.crowdsec.net/lexuzieel/{size}/1411_2.png","trust_level":0},{"id":808,"username":"verybadsoldier","name":"","avatar_template":"/user_avatar/discourse.crowdsec.net/verybadsoldier/{size}/988_2.png","trust_level":1},{"id":887,"username":"isdnfan","name":"wwe","avatar_template":"/user_avatar/discourse.crowdsec.net/isdnfan/{size}/1074_2.png","trust_level":1},{"id":1011,"username":"Molt","name":null,"avatar_template":"https://avatars.discourse-cdn.com/v4/letter/m/51bf81/{size}.png","trust_level":0},{"id":1229,"username":"apommel","name":null,"avatar_template":"https://avatars.discourse-cdn.com/v4/letter/a/7c8e57/{size}.png","trust_level":0},{"id":1203,"username":"oleksandr.yashchenko","name":"Oleksandr","avatar_template":"https://avatars.discourse-cdn.com/v4/letter/o/71c47a/{size}.png","trust_level":0},{"id":1224,"username":"Grudging9729","name":"Grudging9729","avatar_template":"https://avatars.discourse-cdn.com/v4/letter/g/3da27b/{size}.png","trust_level":0},{"id":1220,"username":"jschaeff","name":"Jonathan Schaeffer","avatar_template":"/user_avatar/discourse.crowdsec.net/jschaeff/{size}/1404_2.png","trust_level":0},{"id":1153,"username":"boombies","name":"Boombies","avatar_template":"/user_avatar/discourse.crowdsec.net/boombies/{size}/1354_2.png","trust_level":1},{"id":1206,"username":"jnavarro","name":"Jamie","avatar_template":"https://avatars.discourse-cdn.com/v4/letter/j/f14d63/{size}.png","trust_level":0},{"id":421,"username":"DuvelCorp","name":"Duvel","avatar_template":"/user_avatar/discourse.crowdsec.net/duvelcorp/{size}/529_2.png","trust_level":1},{"id":1204,"username":"Damncold","name":"Damncold","avatar_template":"/user_avatar/discourse.crowdsec.net/damncold/{size}/1391_2.png","trust_level":1},{"id":1201,"username":"soif-deconnaissance","name":"","avatar_template":"/user_avatar/discourse.crowdsec.net/soif-deconnaissance/{size}/1388_2.png","trust_level":0},{"id":1196,"username":"thingandstuff889","name":"ThingAndStuff","avatar_template":"https://avatars.discourse-cdn.com/v4/letter/t/3bc359/{size}.png","trust_level":1},{"id":1193,"username":"TheHuman","name":null,"avatar_template":"https://avatars.discourse-cdn.com/v4/letter/t/59ef9b/{size}.png","trust_level":1},{"id":781,"username":"urbaman","name":"","avatar_template":"https://avatars.discourse-cdn.com/v4/letter/u/b2d939/{size}.png","trust_level":1},{"id":493,"username":"notban","name":null,"avatar_template":"https://avatars.discourse-cdn.com/v4/letter/n/0ea827/{size}.png","trust_level":0},{"id":1197,"username":"bhugh","name":"","avatar_template":"/user_avatar/discourse.crowdsec.net/bhugh/{size}/1385_2.png","trust_level":0},{"id":532,"username":"Dmitry","name":"Dmitry","avatar_template":"/user_avatar/discourse.crowdsec.net/dmitry/{size}/657_2.png","trust_level":1},{"id":796,"username":"multitude","name":"Sid","avatar_template":"https://avatars.discourse-cdn.com/v4/letter/m/48db29/{size}.png","trust_level":0},{"id":1195,"username":"Sumi","name":"","avatar_template":"https://avatars.discourse-cdn.com/v4/letter/s/7ba0ec/{size}.png","trust_level":0},{"id":788,"username":"TomTom","name":null,"avatar_template":"/user_avatar/discourse.crowdsec.net/tomtom/{size}/957_2.png","trust_level":1},{"id":1189,"username":"coloradobug","name":"","avatar_template":"https://avatars.discourse-cdn.com/v4/letter/c/9e8a1a/{size}.png","trust_level":0}],"primary_groups":[],"flair_groups":[],"topic_list":{"can_create_topic":false,"filter":"latest","more_topics_url":"/c/crowdsec/5?page=1","per_page":30,"topics":[{"fancy_title":"Crowdsec on OPNsense and weird behaviour with notification-http process","id":2033,"title":"Crowdsec on OPNsense and weird behaviour with notification-http process","slug":"crowdsec-on-opnsense-and-weird-behaviour-with-notification-http-process","posts_count":5,"reply_count":2,"highest_post_number":5,"image_url":null,"created_at":"2024-10-01T06:55:42.470Z","last_posted_at":"2026-09-24T06:35:19.097Z","bumped":true,"bumped_at":"2026-09-24T06:35:19.097Z","archetype":"regular","unseen":false,"pinned":false,"unpinned":null,"excerpt":"I don’t know if this is a result of my misconfiguration or something else, but I found a behaviour that is really weird. \nI have a multi-server setup. My router (OPNsense box) is running as LAPI and other servers are run…","visible":true,"closed":false,"archived":false,"bookmarked":null,"liked":null,"views":265,"like_count":0,"has_summary":false,"last_poster_username":"brott8","category_id":5,"op_like_count":0,"pinned_globally":false,"featured_link":null,"is_hot":false,"has_accepted_answer":true,"posters":[{"extras":null,"description":"Original Poster","user_id":812,"primary_group_id":null,"flair_group_id":null},{"extras":null,"description":"Recent Poster, Accepted Answer","user_id":1,"primary_group_id":null,"flair_group_id":null},{"extras":null,"description":"Frequent Poster","user_id":177,"primary_group_id":null,"flair_group_id":null},{"extras":"latest","description":"Most Recent Poster","user_id":1671,"primary_group_id":null,"flair_group_id":null}]},{"fancy_title":"IPs fllagged as malicious in crowdsec still hitting my VPS. What can be the issue?","id":2930,"title":"IPs fllagged as malicious in crowdsec still hitting my VPS. What can be the issue?","slug":"ips-fllagged-as-malicious-in-crowdsec-still-hitting-my-vps-what-can-be-the-issue","posts_count":1,"reply_count":0,"highest_post_number":1,"image_url":"https://europe1.discourse-cdn.com/flex013/uploads/crowdsec/optimized/2X/2/2d131147453932de7b71c020dc225e759eae4843_2_1024x652.png","created_at":"2026-09-21T12:11:10.941Z","last_posted_at":"2026-09-21T12:11:10.976Z","bumped":true,"bumped_at":"2026-09-21T12:11:10.976Z","archetype":"regular","unseen":false,"pinned":false,"unpinned":null,"excerpt":"I am sharing this as an example. I am still struggling to know how crowdsec works. I have some VPS with fail2ban but I just decided to include crowdsec a few days ago. \nI see IPs like this trying to brute force and acces…","visible":true,"closed":false,"archived":false,"bookmarked":null,"liked":null,"views":24,"like_count":0,"has_summary":false,"last_poster_username":"bosunjohnson","category_id":5,"op_like_count":0,"pinned_globally":false,"featured_link":null,"is_hot":false,"has_accepted_answer":false,"posters":[{"extras":"latest single","description":"Original Poster, Most Recent Poster","user_id":1667,"primary_group_id":null,"flair_group_id":null}]},{"fancy_title":"Crowdsec decision expiration","id":2920,"title":"Crowdsec decision expiration","slug":"crowdsec-decision-expiration","posts_count":1,"reply_count":0,"highest_post_number":1,"image_url":null,"created_at":"2026-08-26T13:04:22.426Z","last_posted_at":"2026-08-26T13:04:22.486Z","bumped":true,"bumped_at":"2026-08-26T13:04:22.486Z","archetype":"regular","unseen":false,"pinned":false,"unpinned":null,"excerpt":"I have a crowdsec setup with a central server: \nLog Centralization | CrowdSec (a similar setup to this) \nThe central server receives those logs and writes them into files. \nThe Security Engine then analyzes those logs on…","visible":true,"closed":false,"archived":false,"bookmarked":null,"liked":null,"views":34,"like_count":0,"has_summary":false,"last_poster_username":"Emmanuel","category_id":5,"op_like_count":0,"pinned_globally":false,"featured_link":null,"is_hot":false,"has_accepted_answer":false,"posters":[{"extras":"latest single","description":"Original Poster, Most Recent Poster","user_id":1616,"primary_group_id":null,"flair_group_id":null}]},{"fancy_title":"Feature request - High Availability Support","id":2919,"title":"Feature request - High Availability Support","slug":"feature-request-high-availability-support","posts_count":1,"reply_count":0,"highest_post_number":1,"image_url":null,"created_at":"2026-08-06T18:13:31.133Z","last_posted_at":"2026-08-06T18:13:31.189Z","bumped":true,"bumped_at":"2026-08-06T18:13:31.189Z","archetype":"regular","unseen":false,"pinned":false,"unpinned":null,"excerpt":"While the free option with one Engine is great, it would be amazing if we could use that (free one Engine) in an HA format. \nIn this we would still be sending the same amount/group of parser/blocker/appsec agent data, bu…","visible":true,"closed":false,"archived":false,"bookmarked":null,"liked":null,"views":103,"like_count":0,"has_summary":false,"last_poster_username":"j0nny55555","category_id":5,"op_like_count":0,"pinned_globally":false,"featured_link":null,"is_hot":false,"has_accepted_answer":false,"posters":[{"extras":"latest single","description":"Original Poster, Most Recent Poster","user_id":606,"primary_group_id":null,"flair_group_id":null}]},{"fancy_title":"Question about Postoverflow rules","id":2918,"title":"Question about Postoverflow rules","slug":"question-about-postoverflow-rules","posts_count":1,"reply_count":0,"highest_post_number":1,"image_url":null,"created_at":"2026-07-09T06:03:49.754Z","last_posted_at":"2026-07-09T06:03:49.844Z","bumped":true,"bumped_at":"2026-07-09T06:03:49.844Z","archetype":"regular","unseen":false,"pinned":false,"unpinned":null,"excerpt":"Hi everyone, \nI struggle a bit with using Postoverflow rules. For a Nextcloud instance I am testing CrowdSec + AppSec with, although having the Nextcloud Whitelist ruleset installed, I still need to whiteliste a few thin…","visible":true,"closed":false,"archived":false,"bookmarked":null,"liked":null,"views":128,"like_count":0,"has_summary":false,"last_poster_username":"rbaino","category_id":5,"op_like_count":0,"pinned_globally":false,"featured_link":null,"is_hot":false,"has_accepted_answer":false,"posters":[{"extras":"latest single","description":"Original Poster, Most Recent Poster","user_id":1402,"primary_group_id":null,"flair_group_id":null}]},{"fancy_title":"Line 0/1 is missing evt.StrTime","id":2916,"title":"Line 0/1 is missing evt.StrTime","slug":"line-0-1-is-missing-evt-strtime","posts_count":1,"reply_count":0,"highest_post_number":1,"image_url":null,"created_at":"2026-07-05T15:17:03.578Z","last_posted_at":"2026-07-05T15:17:03.646Z","bumped":true,"bumped_at":"2026-07-05T15:17:03.646Z","archetype":"regular","unseen":false,"pinned":false,"unpinned":null,"excerpt":"how to get ride of this line ? I’m on a debian 12 with CrowdSec version: v1.7.8-debian-pragmatic-amd64-63227459 \nCodename: alphaga \nBuildDate: 2026-05-11_12:32:51 \nGoVersion: 1.26.2 \nPlatform: linux \nlibre2: C++ \nI spend…","visible":true,"closed":false,"archived":false,"bookmarked":null,"liked":null,"views":23,"like_count":0,"has_summary":false,"last_poster_username":"Thomas","category_id":5,"op_like_count":0,"pinned_globally":false,"featured_link":null,"is_hot":false,"has_accepted_answer":false,"posters":[{"extras":"latest single","description":"Original Poster, Most Recent Poster","user_id":1387,"primary_group_id":null,"flair_group_id":null}]},{"fancy_title":"CrowdSec Parser for Stalwart Logs","id":2800,"title":"CrowdSec Parser for Stalwart Logs","slug":"crowdsec-parser-for-stalwart-logs","posts_count":20,"reply_count":12,"highest_post_number":20,"image_url":null,"created_at":"2026-04-28T20:50:40.887Z","last_posted_at":"2026-07-03T06:12:23.123Z","bumped":true,"bumped_at":"2026-07-03T06:12:23.123Z","archetype":"regular","unseen":false,"pinned":false,"unpinned":null,"excerpt":"2.687 \nHello CrowdSec Community, \nI’ve been using CrowdSec as an extension in the reverse proxy Caddy for quite some time, but I’m new to the community. Everything is running in a Docker Compose instance with its own …","visible":true,"closed":false,"archived":false,"bookmarked":null,"liked":null,"views":319,"like_count":0,"has_summary":false,"last_poster_username":"Mic2026","category_id":5,"op_like_count":0,"pinned_globally":false,"featured_link":null,"is_hot":false,"has_accepted_answer":false,"posters":[{"extras":"latest","description":"Original Poster, Most Recent Poster","user_id":1228,"primary_group_id":null,"flair_group_id":null},{"extras":null,"description":"Recent Poster","user_id":1191,"primary_group_id":null,"flair_group_id":null},{"extras":null,"description":"Recent Poster","user_id":1239,"primary_group_id":null,"flair_group_id":null}]},{"fancy_title":"Using Wordfence IP blockings (Wordpress WAF) for Crowdsec decisions","id":1921,"title":"Using Wordfence IP blockings (Wordpress WAF) for Crowdsec decisions","slug":"using-wordfence-ip-blockings-wordpress-waf-for-crowdsec-decisions","posts_count":3,"reply_count":0,"highest_post_number":3,"image_url":null,"created_at":"2024-07-13T08:28:17.896Z","last_posted_at":"2026-06-17T05:38:37.057Z","bumped":true,"bumped_at":"2026-06-17T05:38:37.057Z","archetype":"regular","unseen":false,"pinned":false,"unpinned":null,"excerpt":"Hi, \nWordfence is a great Wordpress WAF with many options for blocking IP on some unwanted behaviors. I did not find any thing on Internet about Crowdsec scenario using Wordfence blockings to take decision. \nI would like…","visible":true,"closed":false,"archived":false,"bookmarked":null,"liked":null,"views":254,"like_count":1,"has_summary":false,"last_poster_username":"Cyrille37","category_id":5,"op_like_count":1,"pinned_globally":false,"featured_link":null,"is_hot":false,"has_accepted_answer":false,"posters":[{"extras":"latest single","description":"Original Poster, Most Recent Poster","user_id":327,"primary_group_id":null,"flair_group_id":null}]},{"fancy_title":"Decision not listed","id":1943,"title":"Decision not listed","slug":"decision-not-listed","posts_count":13,"reply_count":9,"highest_post_number":13,"image_url":null,"created_at":"2024-07-26T12:28:24.477Z","last_posted_at":"2026-06-05T12:42:14.704Z","bumped":true,"bumped_at":"2026-06-05T12:42:14.704Z","archetype":"regular","unseen":false,"pinned":false,"unpinned":null,"excerpt":"Hello, \nI have set up crowdsec 1.6.2 as multiserver setup on debian servers and installed the crowdsecurity/linux collection (which includes sshd) and the iptables firewall bouncer. When I try to ssh into a non existent …","visible":true,"closed":false,"archived":false,"bookmarked":null,"liked":null,"views":1182,"like_count":0,"has_summary":false,"last_poster_username":"Tammes","category_id":5,"op_like_count":0,"pinned_globally":false,"featured_link":null,"is_hot":false,"has_accepted_answer":true,"posters":[{"extras":"latest","description":"Original Poster, Most Recent Poster, Accepted Answer","user_id":690,"primary_group_id":null,"flair_group_id":null},{"extras":null,"description":"Recent Poster","user_id":308,"primary_group_id":null,"flair_group_id":null}]},{"fancy_title":"TLS handshake timeout to https://api.crowdsec.net/","id":2874,"title":"TLS handshake timeout to https://api.crowdsec.net/","slug":"tls-handshake-timeout-to-https-api-crowdsec-net","posts_count":2,"reply_count":0,"highest_post_number":2,"image_url":null,"created_at":"2026-05-29T12:58:38.934Z","last_posted_at":"2026-05-29T16:37:07.926Z","bumped":true,"bumped_at":"2026-05-29T16:37:07.926Z","archetype":"regular","unseen":false,"pinned":false,"unpinned":null,"excerpt":"i had to recreate my docker volumes, when crowdsec docker was creating the files i notice some weird behavior when it came to connecting to the https://api.crowdsec.net/, online_api_credentials.yaml was not being auto fi…","visible":true,"closed":false,"archived":false,"bookmarked":null,"liked":null,"views":113,"like_count":0,"has_summary":false,"last_poster_username":"pedrobuffon","category_id":5,"op_like_count":0,"pinned_globally":false,"featured_link":null,"is_hot":false,"has_accepted_answer":true,"posters":[{"extras":"latest single","description":"Original Poster, Most Recent Poster, Accepted Answer","user_id":1275,"primary_group_id":null,"flair_group_id":null}]},{"fancy_title":"Best way to disable crowdsec for specific domain?","id":2817,"title":"Best way to disable crowdsec for specific domain?","slug":"best-way-to-disable-crowdsec-for-specific-domain","posts_count":1,"reply_count":0,"highest_post_number":1,"image_url":null,"created_at":"2026-05-26T01:59:02.619Z","last_posted_at":"2026-05-26T01:59:02.685Z","bumped":true,"bumped_at":"2026-05-26T01:59:02.685Z","archetype":"regular","unseen":false,"pinned":false,"unpinned":null,"excerpt":"I have Crowdsec setup with Caddy and I am considering being able to enable/disable it for particular hosts (similar to how you can disable WAF in Cloudflare). I have stumbled upon this: Allowlisting and Rule Overrides | …","visible":true,"closed":false,"archived":false,"bookmarked":null,"liked":null,"views":84,"like_count":0,"has_summary":false,"last_poster_username":"lexuzieel","category_id":5,"op_like_count":0,"pinned_globally":false,"featured_link":null,"is_hot":false,"has_accepted_answer":false,"posters":[{"extras":"latest single","description":"Original Poster, Most Recent Poster","user_id":1243,"primary_group_id":null,"flair_group_id":null}]},{"fancy_title":"Improved exim parser","id":2807,"title":"Improved exim parser","slug":"improved-exim-parser","posts_count":1,"reply_count":0,"highest_post_number":1,"image_url":null,"created_at":"2026-05-10T12:43:13.584Z","last_posted_at":"2026-05-10T12:43:13.668Z","bumped":true,"bumped_at":"2026-05-10T12:43:13.668Z","archetype":"regular","unseen":false,"pinned":false,"unpinned":null,"excerpt":"I just noticed my exim parser at /etc/crowdsec/parsers/s01-parse/exim-logs.yaml was not working well. Even if it was parsing a very default exim4 mainlog file. \nI just want to share my current modified one (exim-logs.yam…","visible":true,"closed":false,"archived":false,"bookmarked":null,"liked":null,"views":39,"like_count":0,"has_summary":false,"last_poster_username":"matthys70","category_id":5,"op_like_count":0,"pinned_globally":false,"featured_link":null,"is_hot":false,"has_accepted_answer":false,"posters":[{"extras":"latest single","description":"Original Poster, Most Recent Poster","user_id":1239,"primary_group_id":null,"flair_group_id":null}]},{"fancy_title":"Running crowdsec as non-root user in Docker?","id":2021,"title":"Running crowdsec as non-root user in Docker?","slug":"running-crowdsec-as-non-root-user-in-docker","posts_count":6,"reply_count":1,"highest_post_number":6,"image_url":null,"created_at":"2024-09-18T19:15:18.144Z","last_posted_at":"2026-04-30T22:05:53.625Z","bumped":true,"bumped_at":"2026-04-30T22:05:53.625Z","archetype":"regular","unseen":false,"pinned":false,"unpinned":null,"excerpt":"Hi everyone, \nI am new to crowdsec and I have set up crowdsec using the Docker container from here in my home lab: \nhttps://hub.docker.com/r/crowdsecurity/crowdsec \nThe container seems to running as root by default. Is i…","visible":true,"closed":false,"archived":false,"bookmarked":null,"liked":null,"views":1569,"like_count":1,"has_summary":false,"last_poster_username":"apommel","category_id":5,"op_like_count":1,"pinned_globally":false,"featured_link":null,"is_hot":false,"has_accepted_answer":false,"posters":[{"extras":null,"description":"Original Poster","user_id":808,"primary_group_id":null,"flair_group_id":null},{"extras":null,"description":"Frequent Poster","user_id":887,"primary_group_id":null,"flair_group_id":null},{"extras":null,"description":"Recent Poster","user_id":1011,"primary_group_id":null,"flair_group_id":null},{"extras":"latest","description":"Most Recent Poster","user_id":1229,"primary_group_id":null,"flair_group_id":null}]},{"fancy_title":"CrowdSec Appsec doesn’t process JSON/XML","id":2787,"title":"CrowdSec Appsec doesn't process JSON/XML","slug":"crowdsec-appsec-doesnt-process-json-xml","posts_count":4,"reply_count":1,"highest_post_number":4,"image_url":null,"created_at":"2026-03-13T20:08:40.073Z","last_posted_at":"2026-04-22T16:28:53.389Z","bumped":true,"bumped_at":"2026-04-22T16:28:53.389Z","archetype":"regular","unseen":false,"pinned":false,"unpinned":null,"excerpt":"Dear Community, \nDuring the migration to Crowdsec AppSec engine, we’ve noticed that JSON/XML request body headers aren’t processed automatically. It used to work for NGINX + ModSec + CRS stack. \nEnvironment: \n\n\nCrowdSec …","visible":true,"closed":false,"archived":false,"bookmarked":null,"liked":null,"views":97,"like_count":1,"has_summary":false,"last_poster_username":"oleksandr.yashchenko","category_id":5,"op_like_count":0,"pinned_globally":false,"featured_link":null,"is_hot":false,"has_accepted_answer":true,"posters":[{"extras":"latest","description":"Original Poster, Most Recent Poster, Accepted Answer","user_id":1203,"primary_group_id":null,"flair_group_id":null},{"extras":null,"description":"Recent Poster","user_id":1224,"primary_group_id":null,"flair_group_id":null}]},{"fancy_title":"Haproxy spoa bouncer latency","id":2799,"title":"Haproxy spoa bouncer latency","slug":"haproxy-spoa-bouncer-latency","posts_count":3,"reply_count":1,"highest_post_number":3,"image_url":null,"created_at":"2026-04-13T15:06:46.446Z","last_posted_at":"2026-04-16T10:44:05.079Z","bumped":true,"bumped_at":"2026-04-16T10:44:05.079Z","archetype":"regular","unseen":false,"pinned":false,"unpinned":null,"excerpt":"Hello, \nI’m setting up the haproxy bouncer and it works great. \nWe noticed that it adds a 500ms latency for all requests, and I could not find how to minimize it. \nFirst question : is such a latency expected ? If not wha…","visible":true,"closed":false,"archived":false,"bookmarked":null,"liked":null,"views":55,"like_count":1,"has_summary":false,"last_poster_username":"jschaeff","category_id":5,"op_like_count":0,"pinned_globally":false,"featured_link":null,"is_hot":false,"has_accepted_answer":true,"posters":[{"extras":"latest","description":"Original Poster, Most Recent Poster","user_id":1220,"primary_group_id":null,"flair_group_id":null},{"extras":null,"description":"Recent Poster, Accepted Answer","user_id":308,"primary_group_id":null,"flair_group_id":null}]},{"fancy_title":"Blocklist Integration with Check Point Firewall","id":2723,"title":"Blocklist Integration with Check Point Firewall","slug":"blocklist-integration-with-check-point-firewall","posts_count":10,"reply_count":5,"highest_post_number":10,"image_url":null,"created_at":"2025-12-03T13:56:29.882Z","last_posted_at":"2026-03-26T19:07:20.971Z","bumped":true,"bumped_at":"2026-03-26T19:07:20.971Z","archetype":"regular","unseen":false,"pinned":false,"unpinned":null,"excerpt":"Has anyone successfully used the CrowdSec blocklist integration with a Check Point firewall IOC feed? Checkpoint | CrowdSec \nThe documentation is pretty straight forward but it fails to pull the IOC feed. When putting th…","visible":true,"closed":false,"archived":false,"bookmarked":null,"liked":null,"views":200,"like_count":0,"has_summary":false,"last_poster_username":"boombies","category_id":5,"op_like_count":0,"pinned_globally":false,"featured_link":null,"is_hot":false,"has_accepted_answer":false,"posters":[{"extras":"latest","description":"Original Poster, Most Recent Poster","user_id":1153,"primary_group_id":null,"flair_group_id":null},{"extras":null,"description":"Recent Poster","user_id":1206,"primary_group_id":null,"flair_group_id":null},{"extras":null,"description":"Recent Poster","user_id":308,"primary_group_id":null,"flair_group_id":null}]},{"fancy_title":"CrowdSec Appsec produces plenty of errors in OpenResty logs under high traffic","id":2790,"title":"CrowdSec Appsec produces plenty of errors in OpenResty logs under high traffic","slug":"crowdsec-appsec-produces-plenty-of-errors-in-openresty-logs-under-high-traffic","posts_count":2,"reply_count":0,"highest_post_number":2,"image_url":null,"created_at":"2026-03-18T19:59:24.818Z","last_posted_at":"2026-03-20T16:46:39.244Z","bumped":true,"bumped_at":"2026-03-20T16:46:39.244Z","archetype":"regular","unseen":false,"pinned":false,"unpinned":null,"excerpt":"Dear Community, \nEnvironment \n\nOS: Oracle Linux 9\nOpenResty: v1.29.2.1 (ngx_lua-0.10.29R2, lua-resty-http v0.12)\nCrowdSec: v1.7.6-rpm-pragmatic-amd64-eacc8192\nCrowdSec OpenResty Bouncer: v1.1.1\nAppSec: enabled, crowdsecu…","visible":true,"closed":false,"archived":false,"bookmarked":null,"liked":null,"views":105,"like_count":0,"has_summary":false,"last_poster_username":"oleksandr.yashchenko","category_id":5,"op_like_count":0,"pinned_globally":false,"featured_link":null,"is_hot":false,"has_accepted_answer":true,"posters":[{"extras":"latest single","description":"Original Poster, Most Recent Poster, Accepted Answer","user_id":1203,"primary_group_id":null,"flair_group_id":null}]},{"fancy_title":"PostOverflow whitelists ONLY for specific scenarios","id":2517,"title":"PostOverflow whitelists ONLY for specific scenarios","slug":"postoverflow-whitelists-only-for-specific-scenarios","posts_count":3,"reply_count":1,"highest_post_number":3,"image_url":null,"created_at":"2025-04-23T15:38:41.126Z","last_posted_at":"2026-03-17T20:34:52.328Z","bumped":true,"bumped_at":"2026-03-17T20:34:52.328Z","archetype":"regular","unseen":false,"pinned":false,"unpinned":null,"excerpt":"Hi \nBasically I have this to whitelist some ASN of my country \nname: xxx/ASN-whitelist\ndescription: "Whitelist Trusted Belgian ASNs"\n#debug: true\nwhitelist:\n  reason: "xxx Whitelisted Belgian ASN"\n  expression:\n    - evt…","visible":true,"closed":false,"archived":false,"bookmarked":null,"liked":null,"views":229,"like_count":1,"has_summary":false,"last_poster_username":"j0nny55555","category_id":5,"op_like_count":0,"pinned_globally":false,"featured_link":null,"is_hot":false,"has_accepted_answer":false,"posters":[{"extras":null,"description":"Original Poster","user_id":421,"primary_group_id":null,"flair_group_id":null},{"extras":null,"description":"Recent Poster","user_id":887,"primary_group_id":null,"flair_group_id":null},{"extras":"latest","description":"Most Recent Poster","user_id":606,"primary_group_id":null,"flair_group_id":null}]},{"fancy_title":"Can’t start crowdsec in rootless podman","id":2788,"title":"Can't start crowdsec in rootless podman","slug":"cant-start-crowdsec-in-rootless-podman","posts_count":3,"reply_count":1,"highest_post_number":3,"image_url":null,"created_at":"2026-03-13T22:41:53.911Z","last_posted_at":"2026-03-15T20:53:03.548Z","bumped":true,"bumped_at":"2026-03-15T20:53:03.548Z","archetype":"regular","unseen":false,"pinned":false,"unpinned":null,"excerpt":"Hi, \nim trying to get crowdsec running in rootless podman. \nBut i get the following error: \ncrowdsec-pangolin[243452]: ln: /var/lib/crowdsec/data/GeoLite2-ASN.mmdb: Permission denied\n\n\nI think the permissions are correct…","visible":true,"closed":false,"archived":false,"bookmarked":null,"liked":null,"views":212,"like_count":0,"has_summary":false,"last_poster_username":"Damncold","category_id":5,"op_like_count":0,"pinned_globally":false,"featured_link":null,"is_hot":false,"has_accepted_answer":false,"posters":[{"extras":"latest single","description":"Original Poster, Most Recent Poster","user_id":1204,"primary_group_id":null,"flair_group_id":null}]},{"fancy_title":"Whitelist ban by appsec","id":2785,"title":"Whitelist ban by appsec","slug":"whitelist-ban-by-appsec","posts_count":3,"reply_count":1,"highest_post_number":3,"image_url":null,"created_at":"2026-03-13T07:52:06.940Z","last_posted_at":"2026-03-13T11:20:43.202Z","bumped":true,"bumped_at":"2026-03-13T11:20:43.202Z","archetype":"regular","unseen":false,"pinned":false,"unpinned":null,"excerpt":"Hello everyone, \nI am encountering the following error with my GitLab server, which is behind NPMplus by Zoey2936 : \n2026/03/10 15:12:09 [alert] 623#623: *3881 [lua] crowdsec.lua:783: Allow(): [Crowdsec] denied '192.168.…","visible":true,"closed":false,"archived":false,"bookmarked":null,"liked":null,"views":193,"like_count":0,"has_summary":false,"last_poster_username":"soif-deconnaissance","category_id":5,"op_like_count":0,"pinned_globally":false,"featured_link":null,"is_hot":false,"has_accepted_answer":false,"posters":[{"extras":"latest","description":"Original Poster, Most Recent Poster","user_id":1201,"primary_group_id":null,"flair_group_id":null},{"extras":null,"description":"Recent Poster","user_id":1,"primary_group_id":null,"flair_group_id":null}]},{"fancy_title":"AppSec on VPS which do TLS passthrough to local machine behind CGNAT","id":2779,"title":"AppSec on VPS which do TLS passthrough to local machine behind CGNAT","slug":"appsec-on-vps-which-do-tls-passthrough-to-local-machine-behind-cgnat","posts_count":5,"reply_count":1,"highest_post_number":5,"image_url":null,"created_at":"2026-02-27T01:57:34.150Z","last_posted_at":"2026-03-05T10:20:08.859Z","bumped":true,"bumped_at":"2026-03-05T10:20:08.859Z","archetype":"regular","unseen":false,"pinned":false,"unpinned":null,"excerpt":"Hi, \nFirst off thanks for making this wonderful piece of software. \nI have a specific setup like this: Client ⇒ VPS (Caddy L4 TLS passthrough) ⇒ (Wireguard) ⇒ Local machine (another Caddy do TLS termination) \nCurrently I…","visible":true,"closed":false,"archived":false,"bookmarked":null,"liked":null,"views":247,"like_count":2,"has_summary":false,"last_poster_username":"iiAmLoz","category_id":5,"op_like_count":0,"pinned_globally":false,"featured_link":null,"is_hot":false,"has_accepted_answer":false,"posters":[{"extras":null,"description":"Original Poster","user_id":1196,"primary_group_id":null,"flair_group_id":null},{"extras":null,"description":"Recent Poster","user_id":1193,"primary_group_id":null,"flair_group_id":null},{"extras":"latest","description":"Most Recent Poster","user_id":308,"primary_group_id":null,"flair_group_id":null}]},{"fancy_title":"Appsec not working?","id":2778,"title":"Appsec not working?","slug":"appsec-not-working","posts_count":3,"reply_count":1,"highest_post_number":3,"image_url":null,"created_at":"2026-02-25T11:17:38.571Z","last_posted_at":"2026-03-03T11:46:00.574Z","bumped":true,"bumped_at":"2026-03-03T11:46:00.574Z","archetype":"regular","unseen":false,"pinned":false,"unpinned":null,"excerpt":"Hi, \nI’m trying to see if Appsec is working or not (cannot see any alerts triggered by appsec). \nsudo cscli appsec-configs list\n────────────────────────────────────────────────────────────────────────────────────────────…","visible":true,"closed":false,"archived":false,"bookmarked":null,"liked":null,"views":113,"like_count":0,"has_summary":false,"last_poster_username":"urbaman","category_id":5,"op_like_count":0,"pinned_globally":false,"featured_link":null,"is_hot":false,"has_accepted_answer":true,"posters":[{"extras":"latest","description":"Original Poster, Most Recent Poster","user_id":781,"primary_group_id":null,"flair_group_id":null},{"extras":null,"description":"Recent Poster, Accepted Answer","user_id":308,"primary_group_id":null,"flair_group_id":null}]},{"fancy_title":"I am constantly being banned from my server","id":1318,"title":"I am constantly being banned from my server","slug":"i-am-constantly-being-banned-from-my-server","posts_count":5,"reply_count":1,"highest_post_number":5,"image_url":null,"created_at":"2023-06-10T23:29:36.047Z","last_posted_at":"2026-02-28T11:31:49.715Z","bumped":true,"bumped_at":"2026-02-28T11:31:49.715Z","archetype":"regular","unseen":false,"pinned":false,"unpinned":null,"excerpt":"CrowdSec runs in the stack (Docker). \nAlthough I added my IP to the exception, I get banned regularly - at least 1x a day. \nIt always depends on how often I use other Docker services like Seafile and how often I access m…","visible":true,"closed":false,"archived":false,"bookmarked":null,"liked":null,"views":3101,"like_count":0,"has_summary":false,"last_poster_username":"bhugh","category_id":5,"op_like_count":0,"pinned_globally":false,"featured_link":null,"is_hot":false,"has_accepted_answer":false,"posters":[{"extras":null,"description":"Original Poster","user_id":493,"primary_group_id":null,"flair_group_id":null},{"extras":null,"description":"Recent Poster","user_id":308,"primary_group_id":null,"flair_group_id":null},{"extras":"latest","description":"Most Recent Poster","user_id":1197,"primary_group_id":null,"flair_group_id":null}]},{"fancy_title":"[SQLITE_CANTOPEN] Unable to open the database file (unable to open database file)","id":1393,"title":"[SQLITE_CANTOPEN] Unable to open the database file (unable to open database file)","slug":"sqlite-cantopen-unable-to-open-the-database-file-unable-to-open-database-file","posts_count":7,"reply_count":5,"highest_post_number":7,"image_url":"https://europe1.discourse-cdn.com/flex013/uploads/crowdsec/optimized/1X/0351e68a0773e41c84fe89ed5b6da8c6ebe86ca7_2_1024x495.png","created_at":"2023-08-19T12:34:50.980Z","last_posted_at":"2026-02-28T07:14:17.156Z","bumped":true,"bumped_at":"2026-02-28T07:14:17.156Z","archetype":"regular","unseen":false,"pinned":false,"unpinned":null,"excerpt":"Hello. \nI installed the dashboard and the installation was successful. However, I get this message: “[SQLITE_CANTOPEN] Unable to open the database file (unable to open database file)” when I try to view the data. \n  \nCro…","visible":true,"closed":false,"archived":false,"bookmarked":null,"liked":null,"views":2886,"like_count":0,"has_summary":false,"last_poster_username":"bhugh","category_id":5,"op_like_count":0,"pinned_globally":false,"featured_link":null,"is_hot":false,"has_accepted_answer":false,"posters":[{"extras":null,"description":"Original Poster","user_id":532,"primary_group_id":null,"flair_group_id":null},{"extras":null,"description":"Frequent Poster","user_id":308,"primary_group_id":null,"flair_group_id":null},{"extras":null,"description":"Recent Poster","user_id":796,"primary_group_id":null,"flair_group_id":null},{"extras":"latest","description":"Most Recent Poster","user_id":1197,"primary_group_id":null,"flair_group_id":null}]},{"fancy_title":"Crowdsec and multiple public IPs","id":2774,"title":"Crowdsec and multiple public IPs","slug":"crowdsec-and-multiple-public-ips","posts_count":1,"reply_count":0,"highest_post_number":1,"image_url":null,"created_at":"2026-02-25T10:39:54.822Z","last_posted_at":"2026-02-25T10:39:54.874Z","bumped":true,"bumped_at":"2026-02-25T10:39:54.874Z","archetype":"regular","unseen":false,"pinned":false,"unpinned":null,"excerpt":"Hi everyone, \nI wanted to ask about something. I have an OPNsense firewall running, and Crowdsec is working well on it. \nI can see activity under Alerts and Decisions. \nHowever, I also have Postfix and RSPAMD running on …","visible":true,"closed":false,"archived":false,"bookmarked":null,"liked":null,"views":42,"like_count":0,"has_summary":false,"last_poster_username":"Sumi","category_id":5,"op_like_count":0,"pinned_globally":false,"featured_link":null,"is_hot":false,"has_accepted_answer":false,"posters":[{"extras":"latest single","description":"Original Poster, Most Recent Poster","user_id":1195,"primary_group_id":null,"flair_group_id":null}]},{"fancy_title":"Custom scenario labels (Behavior/MITRE/CVE) not appearing in CrowdSec Console","id":2772,"title":"Custom scenario labels (Behavior/MITRE/CVE) not appearing in CrowdSec Console","slug":"custom-scenario-labels-behavior-mitre-cve-not-appearing-in-crowdsec-console","posts_count":2,"reply_count":0,"highest_post_number":2,"image_url":null,"created_at":"2026-02-22T05:24:27.066Z","last_posted_at":"2026-02-23T11:12:24.510Z","bumped":true,"bumped_at":"2026-02-23T11:12:24.510Z","archetype":"regular","unseen":false,"pinned":false,"unpinned":null,"excerpt":"Hello, \nIs it possible to pass Behavior, MITRE technique, and CVE metrics to the CrowdSec Console for custom scenarios? \nFor my custom scenarios, I have defined the following labels: \nlabels:\n  remediation: true\n  classi…","visible":true,"closed":false,"archived":false,"bookmarked":null,"liked":null,"views":40,"like_count":0,"has_summary":false,"last_poster_username":"iiAmLoz","category_id":5,"op_like_count":0,"pinned_globally":false,"featured_link":null,"is_hot":false,"has_accepted_answer":true,"posters":[{"extras":null,"description":"Original Poster","user_id":1191,"primary_group_id":null,"flair_group_id":null},{"extras":"latest","description":"Most Recent Poster, Accepted Answer","user_id":308,"primary_group_id":null,"flair_group_id":null}]},{"fancy_title":"All working but nftables empty","id":2771,"title":"All working but nftables empty","slug":"all-working-but-nftables-empty","posts_count":1,"reply_count":0,"highest_post_number":1,"image_url":null,"created_at":"2026-02-20T13:33:19.944Z","last_posted_at":"2026-02-20T13:33:19.997Z","bumped":true,"bumped_at":"2026-02-20T13:33:19.997Z","archetype":"regular","unseen":false,"pinned":false,"unpinned":null,"excerpt":"Hi, \nI just encountered the following problem: I received tons of emails about bans, always from the same IP addresses. After researching the server, I found that everything was running fine, but the NF tables were empty…","visible":true,"closed":false,"archived":false,"bookmarked":null,"liked":null,"views":34,"like_count":0,"has_summary":false,"last_poster_username":"TomTom","category_id":5,"op_like_count":0,"pinned_globally":false,"featured_link":null,"is_hot":false,"has_accepted_answer":false,"posters":[{"extras":"latest single","description":"Original Poster, Most Recent Poster","user_id":788,"primary_group_id":null,"flair_group_id":null}]},{"fancy_title":"Activation email","id":2768,"title":"Activation email","slug":"activation-email","posts_count":1,"reply_count":0,"highest_post_number":1,"image_url":null,"created_at":"2026-02-14T14:12:51.650Z","last_posted_at":"2026-02-14T14:12:51.693Z","bumped":true,"bumped_at":"2026-02-14T14:12:51.693Z","archetype":"regular","unseen":false,"pinned":false,"unpinned":null,"excerpt":"For some reason, I did not receive the email during registration in the CrowdSec Console, and there is no resend button available. When I try to register again or reset the password, I get the error: “An account linked t…","visible":true,"closed":false,"archived":false,"bookmarked":null,"liked":null,"views":33,"like_count":0,"has_summary":false,"last_poster_username":"Lukes","category_id":5,"op_like_count":0,"pinned_globally":false,"featured_link":null,"is_hot":false,"has_accepted_answer":false,"posters":[{"extras":"latest single","description":"Original Poster, Most Recent Poster","user_id":1191,"primary_group_id":null,"flair_group_id":null}]},{"fancy_title":"CrowdSec custom parser not recognizing timestamp","id":2765,"title":"CrowdSec custom parser not recognizing timestamp","slug":"crowdsec-custom-parser-not-recognizing-timestamp","posts_count":1,"reply_count":0,"highest_post_number":1,"image_url":null,"created_at":"2026-02-11T12:29:55.610Z","last_posted_at":"2026-02-11T12:29:55.662Z","bumped":true,"bumped_at":"2026-02-11T12:29:55.662Z","archetype":"regular","unseen":false,"pinned":false,"unpinned":null,"excerpt":"Hi all, \nI’m new to CrowdSec and I’m trying to create a custom parser for Stalwart logs. \nMy logs look like this: \n2026-02-11T08:16:01Z INFO Banned due to scan (security.scan-ban) listenerId = "smtp", localPort = 25, rem…","visible":true,"closed":false,"archived":false,"bookmarked":null,"liked":null,"views":52,"like_count":0,"has_summary":false,"last_poster_username":"Lukes","category_id":5,"op_like_count":0,"pinned_globally":false,"featured_link":null,"is_hot":false,"has_accepted_answer":false,"posters":[{"extras":"latest single","description":"Original Poster, Most Recent Poster","user_id":1191,"primary_group_id":null,"flair_group_id":null}]},{"fancy_title":"Need help. Is it a bug?","id":2763,"title":"Need help. Is it a bug?","slug":"need-help-is-it-a-bug","posts_count":1,"reply_count":0,"highest_post_number":1,"image_url":null,"created_at":"2026-02-11T08:34:15.361Z","last_posted_at":"2026-02-11T08:34:15.432Z","bumped":true,"bumped_at":"2026-02-11T08:34:15.432Z","archetype":"regular","unseen":false,"pinned":false,"unpinned":null,"excerpt":"Good day. First of all, I apologize for the machine translation; English is not my native language. \nRecently, something strange has been happening with the program. Let me explain step by step. \nWe have Crowdsec install…","visible":true,"closed":false,"archived":false,"bookmarked":null,"liked":null,"views":37,"like_count":0,"has_summary":false,"last_poster_username":"coloradobug","category_id":5,"op_like_count":0,"pinned_globally":false,"featured_link":null,"is_hot":false,"has_accepted_answer":false,"posters":[{"extras":"latest single","description":"Original Poster, Most Recent Poster","user_id":1189,"primary_group_id":null,"flair_group_id":null}]}]}}