Skip to Content
ReferenceAPI referenceCrowdSec

Get one CrowdSec alert

GET
/api/v1/crowdsec/alerts/{alert_id}

Returns the alert with its context, the events the LAPI kept and its decisions, expired ones included. Answers 403 when the server has no CrowdSec machine credentials, CROWDSEC_MACHINE_ID and CROWDSEC_MACHINE_PASSWORD.

Authorization

cookiesession<token>

Session cookie authentication.

Path Parameters

alert_id*integer

The alert's id.

Response Body

Request fulfilled, document follows

application/json
  1. response

One CrowdSec alert with its context, stored events and decisions.

activeDecisionCount*integer

The decisions still in force.

asName*|

The source's network name, as the LAPI gives it.

asNumber*|

The source's AS number, as the LAPI gives it.

context*array<>
countryCode*string|null
countryName*|

From GeoMetrikks' own traffic or its GeoIP database. The LAPI sends only a code.

createdAt*string

When the LAPI stored the alert, as RFC 3339.

decisionCount*integer

The decisions the alert made, expired ones included.

decisionTypes*array<string>

Each decision type once, in the order the LAPI lists the decisions.

decisions*array<>
events*array<>

A sample of the events. The LAPI keeps fewer than eventsCount on busy alerts.

eventsCount*integer

How many events set off the scenario.

id*|

The LAPI's alert id.

kind*|

Where the alert came from, such as crowdsec for a log scenario, waf or bot-detection. Null from a LAPI that predates the field.

machineId*|

The CrowdSec machine that sent the alert.

message*string
range*|

The source's network as a CIDR, as the LAPI gives it.

scenario*string
scope*string

What value holds, such as Ip or Range.

simulated*boolean

True when CrowdSec ran the scenario in simulation mode.

startAt*|

When the first event happened.

stopAt*|

When the last event happened.

value*string

The source the alert is about, such as an IP.

Example Request
curl -X GET 'https://geometrikks.example.com/api/v1/crowdsec/alerts/0'
Example Response
{  "activeDecisionCount": 0,  "asName": "string",  "asNumber": "string",  "context": [    {      "key": "string",      "values": [        "string"      ]    }  ],  "countryCode": "string",  "countryName": "string",  "createdAt": "string",  "decisionCount": 0,  "decisionTypes": [    "string"  ],  "decisions": [    {      "duration": "string",      "expired": true,      "id": 0,      "origin": "string",      "scenario": "string",      "scope": "string",      "simulated": true,      "type": "string",      "value": "string"    }  ],  "events": [    {      "meta": {        "property1": "string",        "property2": "string"      },      "timestamp": "string"    }  ],  "eventsCount": 0,  "id": 0,  "kind": "string",  "machineId": "string",  "message": "string",  "range": "string",  "scenario": "string",  "scope": "string",  "simulated": true,  "startAt": "string",  "stopAt": "string",  "value": "string"}

Count the scenarios among recent CrowdSec alerts GET

Returns the scenarios among the newest 500 alerts that match `since` and `kind`, with how many of those alerts each one has, the most first. Scenarios with the same count sort by name. Answers 403 when the server has no CrowdSec machine credentials, CROWDSEC_MACHINE_ID and CROWDSEC_MACHINE_PASSWORD.

Ban an IP or range through CrowdSec POST

Creates a `ban` or `captcha` decision with origin `geometrikks` on one IP or CIDR, and answers 204 with no body. The bouncers attached to the LAPI enforce it. A CIDR that covers every address gets a 400. Answers 403 when the server has no CrowdSec machine credentials, CROWDSEC_MACHINE_ID and CROWDSEC_MACHINE_PASSWORD. Needs a Read/write API key or a browser session.