OWASP CRS Installation

Installing the CRS

CRS rules are provided with two configurations in CrowdSec: blocking mode (rules are loaded in-band) and non-blocking mode (rules are loaded out-of-band).

Non-blocking mode

If you have never deployed the CRS on your website, we recommend deploying the rules first in non-blocking mode.

In this mode, requests are evaluated out of band, meaning they cannot be blocked, but events will still be generated.

In order to use the CRS in non-blocking mode, you need to install the corresponding collection:

SH

cscli collections install crowdsecurity/appsec-crs

The crowdsecurity/appsec-crs collection includes:

• crowdsecurity/crs: AppSec config that loads CRS rules in out-of-band mode
• crowdsecurity/crowdsec-appsec-outofband: Scenario that bans IPs after 5+ out-of-band rule violations

Then use it in your acquisition configuration, for example /etc/crowdsec/acquis.d/waf.yaml:

YAML

source: appsec
appsec-configs:
  - crowdsecurity/crs
labels:
  type: appsec

info

If an IP triggers too many different rules in a very short timespan, the IP will be blocked, regardless of whether the CRS rules are in blocking mode or not.

Blocking mode

You can also configure the CRS in blocking mode. In this mode, any requests reaching the default CRS threshold for blocking will be dropped.

You need to install the corresponding collection:

SH

cscli collections install crowdsecurity/appsec-crs-inband

Then load it in your configuration:

YAML

source: appsec
appsec-configs:
  - crowdsecurity/crs-inband
labels:
  type: appsec

In this mode, requests will be blocked, and alerts will be generated by default.