# Disable CSAPI upload due to removed whitelists

**URL:** <https://discourse.crowdsec.net/t/disable-csapi-upload-due-to-removed-whitelists/728>\
**Category:** Uncategorized\
**Created:** [April 12, 2022, 3:53pm UTC](https://discourse.crowdsec.net/t/disable-csapi-upload-due-to-removed-whitelists/728 "2022-04-12T15:53:41Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![rdslw](https://dub1.discourse-cdn.com/flex013/user_avatar/discourse.crowdsec.net/rdslw/32/336_2.png) [@rdslw](https://discourse.crowdsec.net/u/rdslw)\
**Post date:** [April 12, 2022, 3:53pm UTC](https://discourse.crowdsec.net/t/disable-csapi-upload-due-to-removed-whitelists/728/1 "2022-04-12T15:53:41Z")

</div>

I must disable one of the cidr (10/8) from parsers/s02-enrich/whitelists.yaml because I do want them to be reported and acted upon. They can be source of spread in internal huge network upon possible attack.

My question is:

1. how can I disable CSAPI upload, to not polute it?  
a. completly?  
b. selectively only for those in 10/8
2. as I plan to get update from CSAPI, removing online\_client: from config.yaml is rather not an option.

Please advise.

---

<div class="post-metadata">

**Author:** ![alteredCoder](https://dub1.discourse-cdn.com/flex013/user_avatar/discourse.crowdsec.net/alteredcoder/32/44_2.png) [@alteredCoder](https://discourse.crowdsec.net/u/alteredCoder)\
**Post date:** [April 13, 2022, 8:54am UTC](https://discourse.crowdsec.net/t/disable-csapi-upload-due-to-removed-whitelists/728/2 "2022-04-13T08:54:24Z")

</div>

Hello,

It is not possible to not share signal with the Crowdsec Central API and get the community-blocklist for it.  
It is ok for us to send signal about those privates IPs, you should not worry about poluting us.

---

<div class="post-metadata">

**Author:** ![rdslw](https://dub1.discourse-cdn.com/flex013/user_avatar/discourse.crowdsec.net/rdslw/32/336_2.png) [@rdslw](https://discourse.crowdsec.net/u/rdslw)\
**Post date:** [April 14, 2022, 7:39pm UTC](https://discourse.crowdsec.net/t/disable-csapi-upload-due-to-removed-whitelists/728/3 "2022-04-14T19:39:09Z")

</div>

Thank you kindly for reply!

One more question around this: documentation at [Introduction | CrowdSec](https://docs.crowdsec.net/docs/central_api/intro/) states _" This information is only going to be pushed when a scenario is coming from the hub and is unmodified. Custom scenarios, tainted scenarios and manual decisions are not pushed_"

I did modified

> /etc/crowdsec/parsers/s02-enrich/whitelists.yaml

which came from hub, judging from the logs, signals are being pushed to CSAPI.

1. is this a bug?
2. is documentation incorrect?
3. is signal being push message in logs correct?

---

<div class="post-metadata">

**Author:** ![he2ss](https://dub1.discourse-cdn.com/flex013/user_avatar/discourse.crowdsec.net/he2ss/32/95_2.png) [@he2ss](https://discourse.crowdsec.net/u/he2ss)\
**Post date:** [April 15, 2022, 2:36pm UTC](https://discourse.crowdsec.net/t/disable-csapi-upload-due-to-removed-whitelists/728/4 "2022-04-15T14:36:44Z")

</div>

Hi @rdslw,

There is no bug, it’s only about **scenarios**. You modified a parser so it will be still pushed.  
So the documentation is correct 🙂

---

<div class="post-metadata">

**Author:** ![rdslw](https://dub1.discourse-cdn.com/flex013/user_avatar/discourse.crowdsec.net/rdslw/32/336_2.png) [@rdslw](https://discourse.crowdsec.net/u/rdslw)\
**Post date:** [April 15, 2022, 4:41pm UTC](https://discourse.crowdsec.net/t/disable-csapi-upload-due-to-removed-whitelists/728/5 "2022-04-15T16:41:49Z")

</div>

Thanks.

What does “this information” mean in the documentation in the sentence I quoted? what is or is not being pushed based on scenario being/not being modified?

---

<div class="post-metadata">

**Author:** ![he2ss](https://dub1.discourse-cdn.com/flex013/user_avatar/discourse.crowdsec.net/he2ss/32/95_2.png) [@he2ss](https://discourse.crowdsec.net/u/he2ss)\
**Post date:** [April 19, 2022, 7:55am UTC](https://discourse.crowdsec.net/t/disable-csapi-upload-due-to-removed-whitelists/728/6 "2022-04-19T07:55:31Z")

</div>

This information, means the signal meta-data that is pushed. In the same documentation link you pasted, there is all the meta-data listing :

> When crowdsec blocks an attack, [unless you opt-out of it](https://docs.crowdsec.net/docs/faq#how-to-disable-the-central-api), crowdsec is going to push “signal meta-data”. Those meta-data are :

- The name of the scenario that was triggered
- The hash & version of the scenario that was triggered
- The timestamp of the decision
- Your machine\_id
- The offending IP (along with its geoloc info when available)