CrowdSec Reports
A read-only view of what CrowdSec has recorded: what it noticed, and what it asked other tools to do. Sign in to see it. Nothing here can block, unblock or change anything.
Checking session…
A read-only view of what CrowdSec has recorded: what it noticed, and what it asked other tools to do. Sign in to see it. Nothing here can block, unblock or change anything.
Signed in as Updated
Select a period in the chart to see what it contains.
| From | To | Local detections | Blocklist updates | Manual actions | Other or unknown | Total |
|---|
| Event type | Records | Share |
|---|
What CrowdSec recorded in the selected range, newest first. Local detections are shown by default; change the record type to see blocklist updates and manual actions. These filters change this list only, not the summary or timeline above.
| When | What happened | Source | CrowdSec response | Explanation |
|---|
Actions CrowdSec is currently asking other tools to take, such as banning an address. These are recorded requests; this report cannot show whether a firewall or other tool applied them. The list ignores the date range, and the soonest to end comes first.
| Target | Requested action | Why | From | Until | Explanation |
|---|
CrowdSec can only react to logs it reads and understands. This shows which log sources it reads and how many lines it could not parse. Counters are cumulative and not limited to the selected range.
This report mirrors what your CrowdSec instance recorded. It is read-only and does not judge how serious anything is.
A decision such as ban or captcha is a request stored in CrowdSec. A separate bouncer (a firewall, proxy or web-server plugin) has to apply it. This report cannot see bouncers, so it cannot show that a request was applied or that traffic was blocked.
Simulation mode records what CrowdSec would do without doing it. Test entries are hidden until you choose Show test entries, and are then marked Simulated.
The range applies to activity and the timeline. Protection lists what is in force now, whatever the range. Times use your browser's time zone. Only a limited number of records are loaded; when a limit notice appears, older or extra records are missing and counts are lower bounds.
An alert is not proof that someone got in, and a missing alert is not proof that nothing happened: CrowdSec only sees the logs it reads. This report cannot show whether an attacker succeeded, whether a request was blocked, or whether a system is secure.
A source address can belong to a proxy, VPN, or another compromised machine. Its country is a network-location estimate, not the location of your server or proof of who was responsible.