Skip to content

Add CrowdSec tooling check #1624

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Add CrowdSec tooling check #1624

wants to merge 1 commit into from

Conversation

naimo84
Copy link

@naimo84 naimo84 commented Apr 24, 2025

Pull Request Summary

This Pull Request introduces a new feature to perform a check for the presence and configuration of the CrowdSec intrusion prevention system (IPS) tool.

It should fix #1575

The key changes include:

Changes:

  1. Binary Detection:

    • Added detection logic for the cscli binary in include/binaries.
    • Logs the presence of the CrowdSec tool if found.
  2. Configuration Updates:

    • Introduced a new constant CROWDSECCLIBINARY in include/consts.
  3. Tooling Tests:

    • Implemented a new test TOOL-5103 in include/tests_tooling to:
      • Check for the presence of CrowdSec.
      • Verify the existence of its configuration file (/etc/crowdsec/config.yaml).
      • Determine the running status of CrowdSec using the cscli metrics command.
      • Log and report the results in the audit output.

Files Modified:

  • include/binaries: Added detection for cscli.
  • include/consts: Defined a new constant for the CrowdSec binary.
  • include/tests_tooling: Added the logic for detecting and reporting CrowdSec's presence and status.

These changes enhance the tool's capabilities by including CrowdSec in the list of known intrusion prevention tools, providing system administrators with better oversight of their security tooling.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Check for presence of Crowdsec
1 participant