Why Crowdsec + Appsec in traefik not automate banned?

crowdsec
1

Why doesn’t CrowdSec + AppSec inside the Traefik Docker make banned decisions, even though it has already triggered an alert? How can it be made to trigger the banned action?

root@CrowdSec:/# docker exec -it traefik cscli alert list
╭────┬──────────────────┬─────────────────────────────────┬─────────┬────┬───────────┬───────────────────────────────╮
│ ID │ value │ reason │ country │ as │ decisions │ created_at │
├────┼──────────────────┼─────────────────────────────────┼─────────┼────┼───────────┼───────────────────────────────┤
+0000 UTC │
│ 1 │ Ip:xx.xx.xx.xx │ crowdsecurity/vpatch-env-access │ │ │ │ 2025-01-02 03:48:10 +0000 UTC │
╰────┴──────────────────┴─────────────────────────────────┴─────────┴────┴───────────┴───────────────────────────────╯
root@CrowdSec:/# docker exec -it traefik cscli decisions list
No active decisions
root@CrowdSec:/#

2

By default the vpatch scenario needs a user to trigger 2 distinct appsec rules to get a decision, this is because we saw alot of false positive potential if a user trips up one rule.

You can change this behavior by changing capacity to 0 and this will trigger always on the first rule that get poured.

1 Like