CrowdSec

CrowdSec builds threat intelligence from a large community of servers running its open-source Security Engine. The engine analyzes logs and HTTP requests locally to detect malicious behavior, and remediation components block offending IP addresses on firewalls, web servers, CDNs and cloud platforms, with an optional web application firewall component. Signals shared by the community are curated into blocklists of aggressive IPs by industry, technology and attack type, an IP reputation API for investigation and enrichment, and a live tracker of IPs exploiting specific CVEs. Security operations teams use these feeds to block mass exploitation before it reaches them and to reduce alert volume. A console manages engines and blocklist subscriptions.