CrowdSec isn’t really for protection against novel threats. It’s just a crowdsourced Fail2Ban that’s extensible with custom rules.
If you and I are both using CrowdSec, and some foreign machine is trying to brute force into one of my services, then when it tries to do the same to you it doesn’t even get the chance to try. It cuts down on the load.
You can also define your own scenarios. Most of the rules it ships with block IPs using a leaky bucket method but I have a custom rule that instantly blocks anyone trying to log into anything using usernames like admin, root, pgadmin, etc.
CrowdSec isn’t really for protection against novel threats. It’s just a crowdsourced Fail2Ban that’s extensible with custom rules.
If you and I are both using CrowdSec, and some foreign machine is trying to brute force into one of my services, then when it tries to do the same to you it doesn’t even get the chance to try. It cuts down on the load.
You can also define your own scenarios. Most of the rules it ships with block IPs using a leaky bucket method but I have a custom rule that instantly blocks anyone trying to log into anything using usernames like admin, root, pgadmin, etc.