Hey everyone,
when trying to run cscli collections install crowdsecurity/appsec-virtual-patching
I get the error can't find 'crowdsecurity/appsec-virtual-patching' in collections.
I wonder why this might be as cscli collections install crowdsecurity/sshd e.g. works just fine.
When I run cscli capi statusI get You can successfully interact with Central API (CAPI) so I don’t think it is a general issue. I also tried cscli hub update and restarting crowdsec.
Could you ensure the version of CrowdSec installed is at least 1.6.0? via crowdsec -version
Hello,
the output gives the following:
version: v1.6.2-debian-pragmatic-amd64-16bfab86
Codename: alphaga
BuildDate: 2024-05-31_09:15:34
GoVersion: 1.22.2
Platform: linux
libre2: C++
User-Agent: crowdsec/v1.6.2-debian-pragmatic-amd64-16bfab86-linux
Constraint_parser: >= 1.0, <= 3.0
Constraint_scenario: >= 1.0, <= 3.0
Constraint_api: v1
Constraint_acquis: >= 1.0, < 2.0
So, I managed to solve my problem.
TL;DR: Change config.yaml:
cscli:
hub_branch: master
Default for hub_branch is wip_lapi.
Longer version:
When editing the configuration to switch to TLS I noticed the option hub_branch under cscli.
So I looked it up in the docs and found out, that it defaults to wip_lapi according to the Configuration example.
Now I wondered, what impact the different branches have so I went to the repository.
This is were the issue comes from, because on wip_lapi there are only a few collections and appsec is missing. But on master I found it, so I switched the value in my config.
Now it all makes sense, but what I consider as suboptimal is, that this behaviour is not really mentioned in the documentation. I found it more or less by accident. Considering, that wip_lapi is the default, I would expect the collections mentioned in the documentation to be present on that branch or - if not the case - I would at least expect a note on pages like the AppSec documentation that this config parameter has to be changed.
I also did not really understand why wip_lapi is the default value in the first place.
Hope it helps anyone out there with a similar issue.
Kind regards,
Leo