Skip to content

Commit

Permalink
[console] Promote console awareness (#484)
Browse files Browse the repository at this point in the history
* Improve console awareness

* Update current version

* Inline svg

* Fix tracking

* Improve get started

* Build faster

* Move ad to reusable component

* Add light version ad

* Revert deps

* Revert deps

* Fix how slow the ad changes between themes

* Fix how slow the ad changes between theme

* Fix color changer

* Remove usememo as it was causing refresh issues

* React = stupid

* Otherway is deprecated
  • Loading branch information
LaurenceJJones authored Nov 6, 2023
1 parent f87e945 commit 0104566
Show file tree
Hide file tree
Showing 21 changed files with 248 additions and 117 deletions.
28 changes: 15 additions & 13 deletions crowdsec-docs/docs/console/enrollment.mdx
Original file line number Diff line number Diff line change
Expand Up @@ -8,12 +8,12 @@ import TabItem from '@theme/TabItem';
import CodeBlock from '@theme/CodeBlock';

:::info
$ID will be used as the placeholder for your enrollment ID, you can find this within the [console](https://app.crowdsec.net/).
`$ID` will be used as the placeholder for your enrollment ID, you can find this within the [console](https://app.crowdsec.net/signup).
:::

## Standalone

You can enroll a [Security Engine](/getting_started/getting_started.md) into the console to get a overview of your alerts. This process is handled by the following `cscli` command:
To obtain an overview of your alerts, you can enroll a [Security Engine](/getting_started/getting_started.md) in the console. This procedure is executed using the following `cscli` command:

<Tabs
defaultValue="nix"
Expand All @@ -36,23 +36,23 @@ You can enroll a [Security Engine](/getting_started/getting_started.md) into the
Docker commands are interchangeable with podman.
:::

If you are using docker, you can enroll the Security Engine by passing the enrollment ID as an environment variable:
If you are using Docker, you can enroll the Security Engine by setting the enrollment ID as an environment variable:

```bash
docker run -e ENROLL_KEY=$ID crowdsecurity/crowdsec
```

If you already have a deployment running this can also be enrolled by using the `cscli` command:
If you already have an existing deployment in operation, you can also enroll it by utilizing the `cscli` command:

```bash
docker exec -it <CONTAINER_ID> cscli console enroll $ID
```

If you are using automatic deployments, then you can automate the enrollment process depending on the system:
If you are employing automatic deployments, you can automate the enrollment process based on your system:

## K8s / Helm

K8's and helm use our standard container image so can also use the enrollment ID as an environment variable:
Kubernetes (K8s) and Helm utilize our standard container image, allowing you to use the enrollment ID as an environment variable:

```yaml
lapi:
Expand All @@ -62,12 +62,12 @@ lapi:
```
:::info
Note here we are placing it within the LAPI environment **NOT** the agent as the agent is not responsible for the enrollment process.
Note that we are placing it within the LAPI environment **NOT** the agent, as the agent is not responsible for the enrollment process.
:::
## Chef, Puppet, Ansible
If you are using a configuration management tool, you can use the `cscli` command to enroll the Security Engine:
If you utilize a configuration management tool, you have the option to enroll the Security Engine using the `cscli` command:

```bash
sudo cscli console enroll $ID
Expand All @@ -79,19 +79,21 @@ sudo cscli console enroll $ID

## Where can I find my enrollment key?

You can find your enrollment key within the [console](https://app.crowdsec.net/).
Your enrollment key can be located within the [console](https://app.crowdsec.net/).

Once you have authenticated, you can find the key within the `Add Security Engine` button on the [Security Engines page](https://app.crowdsec.net/security-engines).
After authentication, you can find the key by clicking the `Add Security Engine` button on the [Security Engines page](https://app.crowdsec.net/security-engines).

## My security engine is failing to connect to the console?

The Security Engine and `cscli` must have internet access, this can be through a proxy or directly. If you are using a proxy, you can configure it using the GOLANG `HTTP_PROXY` and `HTTPS_PROXY` environment variables
Both the Security Engine and `cscli` require internet access, which can be achieved through a proxy or direct connection.

If you are using a proxy, you can configure it using the GOLANG `HTTP_PROXY` and `HTTPS_PROXY` environment variables.

## My security engine has already been enrolled on another account, can I transfer it?

Yes, you can transfer the security engine within the console interface to another organization.
Yes, you have the ability to transfer the Security Engine from within the console interface to another organization.

If for whatever reason you cannot access the old account you can force the new enrollment by running the `cscli` command with the overwrite flag:
If, for any reason, you are unable to access the old account, you can trigger the new enrollment by using the `cscli` command with the overwrite flag:

<Tabs
defaultValue="nix"
Expand Down
24 changes: 12 additions & 12 deletions crowdsec-docs/docs/console/intro.md
Original file line number Diff line number Diff line change
Expand Up @@ -14,21 +14,21 @@ import AcademyPromo from '@site/src/components/AcademyPromo';
utm="?utm_source=docs&utm_medium=banner&utm_campaign=console-page&utm_id=academydocs"
/>

The [console](https://app.crowdsec.net) is a web interface hosted by crowdsec that allows you to get even more from crowdsec :
- aggregate, tag and classify your instances (without having them share a common local API)
- view/filter/export alerts in real-time
- get statistics and insights on your alerts compared
- organization management, MFA and more
- and much more
The [CrowdSec console](https://app.crowdsec.net/signup) is a web-based interface provided by CrowdSec, offering a wide range of features and capabilities to enhance your experience with CrowdSec:

![console-overview](/img/console-overview.png)

Once your [registration done](https://app.crowdsec.net/signup), follow the tour !
- **Instance Management**: You can aggregate, tag, and classify your instances, all without the need for them to share a common local API. This allows you to organize and manage multiple instances more effectively.

Then [enroll your instance](/console/enrollment.mdx) to the console.
- **Real-Time Alert Handling**: The console enables you to view, filter, and export alerts in real-time. This means you can react promptly to security events and take immediate action.

And see what's going in the console :
- **Third-Party Blocklists**: Enhance your security operations by leveraging third-party blocklists. You have the flexibility to import blocklists from various sources, including widely recognized open-source blocklists.

![instance-overview](/img/console-instance-overview.png)
- **Alert Statistics and Insights**: Gain access to comprehensive statistics and insights regarding your alerts. This feature allows you to analyze and understand your security landscape, helping you make informed decisions.

![stats-overview](/img/console-stats-overview.png)
- **Organization Management**: The console provides tools for efficiently managing your organization's security operations. You can organize users, configure multi-factor authentication (MFA), and more to ensure robust security practices.

- **And Much More**: Beyond the mentioned features, the CrowdSec console offers a host of additional functionalities to empower your security operations and enhance your overall experience.

Whether you're an individual user or part of a larger organization, the CrowdSec console serves as a powerful hub for maximizing the benefits of CrowdSec's security solutions.

**Feel ready to take your security to the next level? [Sign up now](https://app.crowdsec.net/signup) and unlock a world of enhanced protection!**
43 changes: 26 additions & 17 deletions crowdsec-docs/docs/getting_started/getting_started.md
Original file line number Diff line number Diff line change
Expand Up @@ -7,15 +7,20 @@ import AcademyPromo from '@site/src/components/AcademyPromo';

Welcome to CrowdSec!

This section will guide you through the installation of the Security Engine, and deployment of your first Remediation Component.
In this section, you'll be taken through the process of creating a console account, with the initial step being the installation of the Security Engine, followed by the deployment of your first Remediation Component.

## Creating a console account

To embark on your CrowdSec journey, the optimal starting point is to set up a console account, as it grants you access to complimentary features that seamlessly integrate with your Security Engine.

The CrowdSec console serves as a web-based interface enabling you to conveniently monitor all your CrowdSec instances from a centralized hub. To get started, simply [sign up here](https://app.crowdsec.net/signup).

:::info
You may see CrowdSec referred to as "Security Engine" and Bouncers referred to as "Remediation Components" within new documentation. This is to better reflect the role of each component within the CrowdSec ecosystem.
:::

## Walkthrough
## Deploy

If you would like to follow a step-by-step video to install Security Engine on a sandbox environment please follow our guide.
### Walkthrough

If you prefer a guided, step-by-step video tutorial for installing the Security Engine in a sandbox environment, please refer to our comprehensive guide.

<iframe width="100%" height="500" src="https://www.youtube-nocookie.com/embed/yxbimVtd2nw?controls=1" title="YouTube video player" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share" allowfullscreen></iframe>

Expand All @@ -29,9 +34,13 @@ If you would like to follow a step-by-step video to install Security Engine on a

or follow the steps below.

## Installation Security Engine
### Security Engine

:::info
In our updated documentation, we now refer to CrowdSec as the "Security Engine" and Bouncers as "Remediation Components" to better describe their roles in the ecosystem.
:::

### Prerequisites
#### Prerequisites

The Security Engine by default uses the following ports:
- 8080/tcp for the API
Expand All @@ -43,7 +52,7 @@ Please note that the API is mandatory for your security engine, do not remove it

#### Using the repository

The easiest way to install the Security Engine is to use the official repository. This will ensure that you always have the latest version of the Security Engine.
For the most straightforward installation of the Security Engine, utilize the official repository, guaranteeing you'll constantly have the latest version.

Please see the relevant documentation for your OS:
- [Linux](/getting_started/install.mdx)
Expand All @@ -52,20 +61,20 @@ Please see the relevant documentation for your OS:

#### Installing from source

If you wish to install from source, we have a short video guide on how to do this.
Should you opt for a source-based installation, we offer a brief video guide to assist you in the process.

<iframe width="100%" height="500" src="https://www.youtube.com/embed/-1xxkwQyI2M" title="YouTube video player" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share" allowfullscreen></iframe>

#### Installing a Remediation Component
### Remediation Component

Once you have installed the Security Engine, you can install a Remediation Component. This is the component that will take action on the decisions made by the Security Engine.
After installing the Security Engine, you can proceed to install a Remediation Component, which is responsible for executing actions based on the decisions made by the Security Engine.

Depending on your network / OS setup, you will need to install a different Remediation Component.
The specific Remediation Component to install may vary based on your network and operating system configuration.

If you are unsure which to install, please see our [Remediation Components](/bouncers/intro.md) section OR join our [discord](https://discord.gg/crowdsec) and ask our community.
If you are uncertain about which one to install, please refer to our [Remediation Components](/bouncers/intro.md) section or join our [Discord](https://discord.gg/crowdsec) and ask our community.

## Enrolling your instance
## Enroll

Next step is to enroll your instance to the CrowdSec console. This will allow you to view your instance in the console, and enhance your security by using our third party lists.
Since you created your account on the CrowdSec console, you can now enroll your Security Engine to your account.

See the [console section](/console/intro.md) for more information.
To do so, you can find steps outlined [here](/console/enrollment.mdx).
Original file line number Diff line number Diff line change
Expand Up @@ -185,6 +185,6 @@ When done, you will need to enable the `cs-windows-firewall-bouncer` service and

## Enrolling your instance

Next step is to enroll your instance to the CrowdSec console. This will allow you to view your instance in the console, and enhance your security by using our third party lists.
The next step is to enroll your instance with the [CrowdSec Console](https://app.crowdsec.net/signup).

See the [console section](/console/intro.md) for more information.
For the benefits, please visit the [Console section](/console/intro.md).
12 changes: 6 additions & 6 deletions crowdsec-docs/docs/getting_started/install.mdx
Original file line number Diff line number Diff line change
Expand Up @@ -113,6 +113,12 @@ You need to deploy a [Remediation Component](/bouncers/intro.md) to enforce deci

:::

## Enrolling your instance

The next step is to enroll your instance with the [CrowdSec Console](https://app.crowdsec.net/signup).

For the benefits, please visit the [Console section](/console/intro.md).

## Running CrowdSec on Raspberry Pi OS/Raspbian

Please keep in mind that Raspberry Pi OS is designed to work on all
Expand All @@ -128,9 +134,3 @@ do:
4. Update the GOARCH variable in the Makefile to `arm`
5. install the arm gcc cross compiler (On debian the package is gcc-arm-linux-gnueabihf)
6. Compile CrowdSec using the usual `make` command

## Enrolling your instance

Next step is to enroll your instance to the CrowdSec console. This will allow you to view your instance in the console, and enhance your security by using our third party lists.

See the [console section](/console/intro.md) for more information.
4 changes: 2 additions & 2 deletions crowdsec-docs/docs/getting_started/install_freebsd.md
Original file line number Diff line number Diff line change
Expand Up @@ -140,6 +140,6 @@ Then start again the CrowdSec' service `service crowdsec start`.

## Enrolling your instance

Next step is to enroll your instance to the CrowdSec console. This will allow you to view your instance in the console, and enhance your security by using our third party lists.
The next step is to enroll your instance with the [CrowdSec Console](https://app.crowdsec.net/signup).

See the [console section](/console/intro.md) for more information.
For the benefits, please visit the [Console section](/console/intro.md).
4 changes: 2 additions & 2 deletions crowdsec-docs/docs/getting_started/install_opnsense.md
Original file line number Diff line number Diff line change
Expand Up @@ -124,6 +124,6 @@ For more information on the topic:

## Enrolling your instance

Next step is to enroll your instance to the CrowdSec console. This will allow you to view your instance in the console, and enhance your security by using our third party lists.
The next step is to enroll your instance with the [CrowdSec Console](https://app.crowdsec.net/signup).

See the [console section](/console/intro.md) for more information.
For the benefits, please visit the [Console section](/console/intro.md).
32 changes: 13 additions & 19 deletions crowdsec-docs/docs/intro.mdx
Original file line number Diff line number Diff line change
Expand Up @@ -15,30 +15,24 @@ import AcademyPromo from '@site/src/components/AcademyPromo';
&nbsp;
&nbsp;

[CrowdSec Security Engine](https://github.com/crowdsecurity/crowdsec) is an open-source and lightweight software that allows you to detect peers with malevolent behaviors and block them from accessing your systems at various levels (infrastructural, system, applicative).
The [CrowdSec Security Engine](https://github.com/crowdsecurity/crowdsec) is an open-source, lightweight software that detects and blocks malicious actors from accessing your systems at various levels, using log analysis and threat patterns called scenarios.

To achieve this, the Security Engine reads logs from different sources (files, streams ...) to parse, normalize and enrich them before matching them to threats patterns called scenarios.
CrowdSec is a modular framework, offering a variety of [popular scenarios](https://app.crowdsec.net/hub/collections). Users can choose their protection scenarios and deploy [Remediation Components](https://app.crowdsec.net/hub/bouncers) to block malicious access.

CrowdSec ecosystem is a modular and plug-able framework. It ships a large variety of [well-known popular scenarios](https://hub.crowdsec.net/browse/#configurations); users can choose what scenarios they want to be protected from as well as easily add new custom ones to better fit their environment.
The crowd-sourced aspect allows sharing attack information among users, enhancing real-time attack detection and preemptive blocking of known bad actors from your system.

Detected malevolent peers can then be prevented from accessing your resources by deploying [Remediation Components](https://hub.crowdsec.net/browse/#bouncers) at various levels (applicative, system, infrastructural) of your stack.
## Main Features

One of the advantages of CrowdSec when compared to other solutions is its crowd-sourced aspect: Meta information about detected attacks (Source IP address, time, and triggered scenario) is sent to a central API and then shared amongst all users.
In addition to the core "detect and react" mechanism, CrowdSec is committed to several other key aspects:

Thanks to this, besides detecting and stopping attacks in real-time based on your logs, it allows you to preemptively block known bad actors from accessing your information system.

## Main features

Besides the core "detect and react" mechanism, is committed to a few other key points :

- **Easy Installation**: [Out of the box](/getting_started/install.mdx) on most Linux setups (see [here for FreeBSD](/getting_started/install_freebsd.md))
- **Easy daily operations** : Using [cscli](/cscli/cscli.md) and the [hub](http://hub.crowdsec.net), keeping your detection mechanisms up-to-date is trivial
- **Reproducibility**: Security Engine can run not only against live logs but [as well against cold logs](/user_guides/replay_mode.md). It makes it a lot easier to detect potential false positives, perform forensic analysis or generate reporting
- **Observability**: Providing strong insights on what is going on and what crowdsec-agent is doing :
- Humans have [access to a trivially deployable web interface](/observability/dashboard.md)
- OPs have [access to detailed Prometheus metrics](/observability/prometheus.md)
- Admins have [a friendly command-line interface tool](/observability/cscli.md)
- **API Centric**: All the components are communicating via an [HTTP API](/local_api/intro.md), allowing easy multi-machines setups
- **Easy Installation**: Effortless out-of-the-box installation on all [supported platforms](/getting_started/versions_matrix.md).
- **Simplified Daily Operations**: Use [cscli](/cscli/cscli.md) and the [hub](http://hub.crowdsec.net) for effortless maintenance and keeping your detection mechanisms up-to-date.
- **Reproducibility**: The Security Engine can analyze not only live logs but also [cold logs](/user_guides/replay_mode.md), making it easier to detect potential false triggers, conduct forensic analysis, or generate reports.
- **Observability**: Providing valuable insights into the system's activity:
- Users can view/manage alerts from the ([Console](https://app.crowdsec.net/signup)).
- Operations personnel have access to detailed Prometheus metrics ([Prometheus](/observability/prometheus.md)).
- Administrators can utilize a user-friendly command-line interface tool ([cscli](/observability/cscli.md)).
- **API-Centric**: All components communicate via an [HTTP API](/local_api/intro.md), facilitating multi-machine setups.


## Architecture
Expand Down
10 changes: 5 additions & 5 deletions crowdsec-docs/sidebars.js
Original file line number Diff line number Diff line change
Expand Up @@ -28,11 +28,6 @@
type: "doc",
id: "intro",
},
{
type: "doc",
label: "Concepts",
id: "concepts",
},
{
type: "category",
label: "Getting Started",
Expand Down Expand Up @@ -205,6 +200,11 @@
"getting_started/versions_matrix",
],
},
{
type: "doc",
label: "Concepts",
id: "concepts",
},
{
type: "category",
label: "User Guides",
Expand Down
Loading

0 comments on commit 0104566

Please sign in to comment.