# How to not forward alerts

**URL:** <https://discourse.crowdsec.net/t/how-to-not-forward-alerts/2675>\
**Category:** Uncategorized\
**Created:** [September 2, 2025, 11:03am UTC](https://discourse.crowdsec.net/t/how-to-not-forward-alerts/2675 "2025-09-02T11:03:21Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![yadd](https://dub1.discourse-cdn.com/flex013/user_avatar/discourse.crowdsec.net/yadd/32/70_2.png) [@yadd](https://discourse.crowdsec.net/u/yadd)\
**Post date:** [September 2, 2025, 11:03am UTC](https://discourse.crowdsec.net/t/how-to-not-forward-alerts/2675/1 "2025-09-02T11:03:21Z")

</div>

My Crowdsec server receives many alerts, I’d like to forward to Crowdsec only those with a decision. Is it possible ? How ?

---

<div class="post-metadata">

**Author:** ![iiAmLoz](https://dub1.discourse-cdn.com/flex013/user_avatar/discourse.crowdsec.net/iiamloz/32/386_2.png) [@iiAmLoz](https://discourse.crowdsec.net/u/iiAmLoz)\
**Post date:** [September 2, 2025, 1:08pm UTC](https://discourse.crowdsec.net/t/how-to-not-forward-alerts/2675/2 "2025-09-02T13:08:09Z")

</div>

Could you elaborate on what you mean, as in alerts shown in the console?

if so, not really you can use `cscli console disable` to disable sending `custom`, `manual` or `tainted` alerts, however, there isnt an option for ones without decisions.

---

<div class="post-metadata">

**Author:** ![yadd](https://dub1.discourse-cdn.com/flex013/user_avatar/discourse.crowdsec.net/yadd/32/70_2.png) [@yadd](https://discourse.crowdsec.net/u/yadd)\
**Post date:** [September 2, 2025, 1:32pm UTC](https://discourse.crowdsec.net/t/how-to-not-forward-alerts/2675/3 "2025-09-02T13:32:36Z")

</div>

Thank you. my agent generates one alert each time a bad URL is called (such as phpinfo.php,..) and send a decision when there are more than X alerts in Y minutes (looking at alerts using API). These alerts are very “local”, no need to push them to console, only decisions are usefull

---

<div class="post-metadata">

**Author:** ![iiAmLoz](https://dub1.discourse-cdn.com/flex013/user_avatar/discourse.crowdsec.net/iiamloz/32/386_2.png) [@iiAmLoz](https://discourse.crowdsec.net/u/iiAmLoz)\
**Post date:** [September 2, 2025, 1:33pm UTC](https://discourse.crowdsec.net/t/how-to-not-forward-alerts/2675/4 "2025-09-02T13:33:37Z")

</div>

So is this a custom scenario you crafted?

---

<div class="post-metadata">

**Author:** ![yadd](https://dub1.discourse-cdn.com/flex013/user_avatar/discourse.crowdsec.net/yadd/32/70_2.png) [@yadd](https://discourse.crowdsec.net/u/yadd)\
**Post date:** [September 3, 2025, 11:42am UTC](https://discourse.crowdsec.net/t/how-to-not-forward-alerts/2675/5 "2025-09-03T11:42:31Z")

</div>

Yes, I built an agent for Lemonldap-NG ([LLNG Corwdsec Agent](https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/blob/v2.0/lemonldap-ng-portal/lib/Lemonldap/NG/Portal/Plugins/CrowdSecAgent.pm)). Its logic is:

- push an alert for each bad behavior
- when X alerts during Y seconds, the new alert is a ban decision

Is it a good way ?

---

<div class="post-metadata">

**Author:** ![iiAmLoz](https://dub1.discourse-cdn.com/flex013/user_avatar/discourse.crowdsec.net/iiamloz/32/386_2.png) [@iiAmLoz](https://discourse.crowdsec.net/u/iiAmLoz)\
**Post date:** [September 4, 2025, 11:07am UTC](https://discourse.crowdsec.net/t/how-to-not-forward-alerts/2675/6 "2025-09-04T11:07:50Z")

</div>

well good way is purely your own opinion, the problem is pushing _any_ alerts will always go to console.

so it depends if you want to see “each bad behavior” as your bypassing the log processor component of the security engine which handles these monitoring and the eventual triggering of the bad behavior.