Now that I have a bouncer running on my OpenWrt router, I wonder if there is a way to track the block action so
- I could see the blocked IPs in the lapi and the dashboard.
- Transfer the data to capi as a confirmation that listed IPs are still attacking devices.
If you enroll your instance to the console, you’ll be able to see all your alerts. You second point is actually a good idea, because right now only when an attack happend it sent to CAPI but after that if the bouncer block it we don’t have any signal.
Thanks for this feedback, I’ll transfer the idea to the core team.
the idea was
- see the ips from blocklist that are actually been blocked on my bouncer and
- transfer this information to capi.
It would give me / a user a feedback on attacks blocked and also a feedback to crowdsec to see effectiveness of the blocklist.