CrowdSec is a French cybersecurity company behind an open-source security engine that detects malicious behaviour such as brute-force attempts and port or web scans by analysing logs. An AppSec component adds a web application firewall built on Coraza. Users who report aggressive IP addresses feed a crowdsourced reputation network, from which CrowdSec offers IP reputation data and blocklists through its Console.
CrowdSec is a French simplified joint-stock company (SAS) with its registered office in Montrouge. The engine is published under the MIT licence and can run on your own infrastructure. It runs on Linux, Windows, Docker, Kubernetes and OPNsense. The Console and blocklist services are operated by the vendor; its privacy policy lists AWS and GCP among data recipients without naming a hosting region. Shared signals are IP addresses with date, time and incident type, and according to the policy contain no directly identifying personal data.