What’s New in CrowdSec 1.8: WAF Bot Detection, Kubernetes Datasource, and Performance Improvements
I wrote this for humans; I’m aware it’s becoming a niche audience, so Hi anyway 🙂
As the holidays are ending for most of us, it’s time for us to showcase what we’ve been cooking: CrowdSec 1.8 and more!
WAF: Bot Detection
Your average bot in 2026 has a real Chrome with a consistent TLS fingerprint, a residential IP, and a lot more patience than your on-call engineer: According to most metrics, it’s a more exemplary user than your actual users. That’s why it’s tricky: blocking bots is easy, but not your users.
That’s why we’re bringing bot detection to CrowdSec’s WAF! This is something that we’ve been contemplating for a while, have worked on for the past 6 months, and can finally release.
What it actually means is that the WAF can now not only react to “what the user does” but also to “what the user is”: a human and a browser, or a bot pretending to be one. For a legitimate user, this is solved transparently, while an automated client cannot cheaply fake it.
Our approach combines several techniques, most notably fingerprinting and proof of work: it forces the attacker to play on the anti-detection side, but also stack compute cost on top of it, raising the economics of botting.
From a use-case perspective, it’s an efficient way to deal with distributed attacks, scraping, scalping, and generally any kind of aggressive automation.
To ensure a production-ready approach, it comes with sets of allowlists and exclusions to avoid blocking legitimate bots that cannot solve such challenges, while also providing the usual fine-grained configuration to solve more edge cases that one might encounter – support for Web Bot Authentication is also planned. While provided baselines should deal with most common bots, the operator can easily implement its own detection patterns, relying on weak signals and various anomalies to deter specific bots targeting you.
It’s already compatible with the latest nginx/openresty release; haproxy is imminent, and we’re waiting on traefik and envoy releases. The goal is to have it supported by all major web bouncers; it’s just a small step for those already supporting the WAF feature. In terms of deployments, we tried our best to make it industrialization-friendly, with multi-tenancy support and a good amount of observability.
Dedicated Kubernetes datasource
Previously, our Kubernetes users had to deploy multiple CrowdSec instances as a daemonset to monitor their infrastructure. This led to various undesired side-effects, mostly as a result of the induced complexity. The new datasource talks directly to the Kubernetes API, following pods/logs for pods matching the given selector, allowing users to deploy a single CrowdSec instance to monitor multiple pods.
This will hopefully make both the build, the run, and the architecture of CrowdSec’s Kubernetes deployments a lot easier and cheaper.
Bouncer to LAPI optimisation
We made significant optimisations to the interaction between the Local API and the bouncer to improve performance of decision synchronization.
For example, on a setup with 1M alerts and 10 bouncers, time spent reduction ranges from x600 (MySQL) to x13 (PgSQL): This aims at better supporting the larger setups that we are seeing more and more often, while also improving the performance for the rest of us.
Console: new alerts page
The console’s alert page is one of the most used features of the console – as it’s available to all tiers of users. We’re bringing a very significant revamp of this page to help our users make the most out of it:
- Leveraging IP reputation in signals allows you to easily cut through the noise and isolate outliers.
- IP grouping and merging allow you to get a better overview of activity without having to look at detailed alerts.
- Detailed breakdown to explore data via any angle of the alert, from scenario to targeted asset to IP reputation.
- Save views to create shortcuts to your relevant alerts to streamline recurrent workflows.
CrowdSec skill
Although technically not tied to this CrowdSec release, we continue to expand our crowdsec skill : all of CrowdSec’s knowledge at your LLM’s fingertips!
Closing word
By the time you’re reading this blog post, *nix packages, Docker images, and Helm charts should already be available; Windows packages, {opn,pf}sense are on their way (keep in mind some of those require 3rd-party validation).
Don’t be a stranger; drop on Discord to ask for help or report bugs,
Happy hacking 🦙
