Artica Wiki

The behavior detection engine (CrowdSec)

CrowdSec is a cybersecurity tool and platform designed to detect and prevent malicious activity on computer systems and networks. Its main aim is to protect servers, applications and online services against various types of attacks

Back to Your Firewall

This feature is available on Artica 4.50 with HotFix 20230719-14 or Service Pack 1
CrowdSec uses a combination of techniques, including log analysis, behavioral analysis, and threat intelligence, to identify and block malicious actors in real-time. 
It leverages a global network of sensors that collect and share information about suspicious or malicious activities, allowing it to quickly adapt and respond to emerging threats.

What are the benefits?

  1. Real-time Threat Detection: 
    It employs advanced algorithms and behavioral analysis to detect and respond to threats in real time. 
    This proactive approach allows for quick identification of malicious activities, reducing the potential damage caused by attacks.
     
  2. IDS Support:
    Intrusion Detection and Prevention System (IDPS) provides network security monitoring capabilities. 
    It is designed to analyze network traffic and detect various types of security threats and anomalies.
    When you install CrowdSec and IDS in Artica, the two solutions combine to perform automatic detection and remediation of detected threats.
     
  3. Adaptability and Flexibility: 
    CrowdSec's modular design and integration capabilities enable seamless integration with existing security infrastructure. 
    It can complement and enhance other security tools, such as firewalls and intrusion detection systems, by providing an additional layer of protection and response.
     
  4. Automated Blocking and Response: 
    Once a threat is detected, it can automatically block the malicious IP addresses or take other predefined actions, mitigating the risk and preventing further attacks. 
    This automation reduces the workload on security teams and accelerates incident response.
     
  5. Scalability: 
    It is designed to handle high-volume traffic and large-scale deployments. It can effectively protect a single server or scale to protect complex distributed systems and cloud infrastructure.

Install the service

Manage the service

Events