Error while calling crowdsec cti. cit is disabled

crowdsec
1

I was trying to use crowdsec CTI api to show additional information on my alert notification. So I generated a CTI API key and paste it on the following location

/etc/crowdsec/config.yaml file

the contents are like this

 cti:
    key: api_key
    cache_timeout: 60m
    cache_size: 50
    enabled: true
    log_level: info

but whenever I try to invoke a test notification it shows me the following warning

error while calling CrowdsecCTI : cti is disabled

I have already restarted the app. and reloaded all config.

2

this error is returned when the api key is empty or missing so are you passing the value as is in the configuration and not attempting to use environment variables?

3

Yes, I am directly using the key value inside the configuration. I have removed the key on the above example for privacy. didn’t use the environment vairable.

4

All good though ill check. Just to ask within the config.yaml is it nested under api?

api:
  cti:
    #The API key you got from the console
    key: <API CTI KEY>
    #How long should CTI lookups be kept in cache
    cache_timeout: 60m
    #How many items can we keep in cache
    cache_size: 50
    enabled: true
    log_level: info|debug|trace
5

Yes. It is nested under API

6

Here’s how it’s configured. the full api block.

api:
  client:
    insecure_skip_verify: false
    credentials_path: /etc/crowdsec/local_api_credentials.yaml
  server:
    log_level: info
    listen_uri: 127.0.0.1:8080
    profiles_path: /etc/crowdsec/profiles.yaml
    console_path: /etc/crowdsec/console.yaml
    online_client: # Central API credentials (to push signals and receive bad IPs)
      credentials_path: /etc/crowdsec/online_api_credentials.yaml
    trusted_ips: # IP ranges, or IPs which can have admin API access
      - 127.0.0.1
      - ::1
  cti:
    key: ftwM<removed_letter_part>
    cache_timeout: 60m
    cache_size: 50
    enabled: true
    log_level: info
7

Hi, have you checked? any solution? Thanks