Suricata and Crowdsec

[FyreWall]

Trying out running Suricata as an IDS and Crowdsec as an IPS.
I have both enabled with Suricata set to just alert.

I see a lot of alerts in Suricata for port scans but no action from Crowdsec regarding the Suricata alerts.
Is that normal or should Crowdsec be taking action on the Suricata alerts?

[JamesFrisch]

Disclaimer: I don't know anything about Surricata.

I think you got them switched.

Crowdsec you can use multiple "parsers" (which logs it should read) and what "scenarios" it will look for.

Since this is all not "live" it isn't taxing on system resources and it won't affect your traffic speed or latency. It will block by using "bouncers" which can be pf (Opnsense), nftables or even nginx proxies.

AFAIK surricata is IPS. Resource intensive, because live.


So to get back to your question, since Surricata is live and faster already than crowdsec and does it's own blocking, why even bother sharing the information with crowdsec and vice versa? IMHO there is no point in doing that. But again, don't know much about it so happy to hear from others.