Link Artica PCAP filter with CrowdSec for remediation

• Return back to the Artica PCAP filter main section

This method allows CrowdSec to send addresses to Artica PCAP, so that when CrowdSec wants to block or remove an address, it will be added to the ProxMox and/or Fortigate  server and/or an  IPSet  on the local firewall.
Note: if you are using an Artica appliance, all these operations are performed automatically; this is only for using Artica PCAP filter without Artica.

A) Install the CrowdSec Custom bouncer

Follow this documentation to install the Custom bouncer: https://docs.crowdsec.net/docs/bouncers/custom/

B) Get the bouncer API Key

Run the command cscli bouncers add "custom-bouncer" and get the API key sent in the output. 

C) Edit the configuration file

Edit /etc/crowdsec/bouncers/crowdsec-custom-bouncer.yaml 

Change the bin_path to the path where the articapsniffer binary is located, and the api_key to the key generated by the cscli bouncers add command

bin_path: /usr/local/sbin/articapsniffer
bin_args: []
feed_via_stdin: false
total_retries: 0  
scenarios_containing: []  
scenarios_not_containing: []  
origins: []
piddir: /var/run/
update_frequency: 10s
cache_retention_duration: 10s
daemonize: true
log_mode: file
log_dir: /var/log/
log_level: info
log_compression: true
log_max_size: 100
log_max_backups: 3
log_max_age: 30
api_url: http://localhost:8080/
apikey:123456

prometheus:
  enabled: true
  listen_addr: 127.0.0.1
  listen_port: 60602

Logging

When Artica PCAP filter is executed by CrowdSec Custom bouncer it will log lines like the following in /var/log/crowdsec-custom-bouncer.log:

time="12-08-2023 21:30:16" level=info msg="Processing decision 202.115.73.205 Scenario crowdsecurity/ssh-bf/crowdsecurity/ssh-bf"