crowdsec-blocklist-import
Import 28+ threat intelligence feeds into CrowdSec with automatic deduplication, normalization, and real-time sync.
What is crowdsec-blocklist-import?
crowdsec-blocklist-import is a Python tool that fetches, normalizes, and imports IP threat intelligence from over 28 free public feeds into CrowdSec's Local API. It solves the problem of stale blocklists by ensuring fresh threat data is available within minutes and automatically removes expired entries, keeping your security stack up-to-date with active threats.
System administrators, DevOps engineers, and security professionals running CrowdSec who want to enhance their threat detection with aggregated, real-time blocklists from multiple public intelligence sources.
Developers choose crowdsec-blocklist-import because it provides a centralized, automated way to integrate 28+ threat feeds with CrowdSec, featuring built-in deduplication, normalization, and real-time sync to eliminate stale data—offering 10-20x more blocks than default setups.
Overview
10-20x more blocks for your CrowdSec bouncers — 120k+ IPs from 32 free threat feeds
Use Cases
Best For
- Enhancing CrowdSec deployments with aggregated threat intelligence from multiple free feeds
- Automating IP blocklist updates to eliminate manual curation and stale entries
- Self-hosted security stacks needing real-time sync with public threat intelligence
- Monitoring and visualizing blocklist import metrics with Prometheus and Grafana
- Integrating CrowdSec with UniFi hardware for a complete detect-decide-enforce stack
- Reducing false positives with allowlist support for trusted IPs and CIDR ranges
Not Ideal For
- Organizations not using CrowdSec as their primary threat detection platform
- Environments with strict data sovereignty laws that restrict fetching from international public feeds
- Teams requiring manual vetting of each threat feed entry before enforcement to minimize false positives
Pros & Cons
Pros
Pulls from over 28 free public sources like IPsum, Spamhaus, and Abuse.ch, providing broad threat coverage without additional cost, as detailed in the supported blocklists section.
Ensures threat IPs are updated within minutes and expired entries are automatically removed, solving the stale blocklist problem highlighted in the README's philosophy.
Features a daemon mode with configurable intervals, eliminating the need for external cron jobs, and includes webhook notifications and Prometheus metrics for monitoring.
Checks IPs against existing CrowdSec decisions to avoid redundant imports and standardizes CIDR formats across all feeds, reducing API overhead and errors.
Cons
Relies on public feeds with varying update schedules and accuracy, which can lead to false positives or missed threats, as admitted with feeds like Tor nodes that may cause false positives.
Requires configuring CrowdSec LAPI credentials, machine IDs, and bouncer keys, adding overhead for users not already familiar with CrowdSec's authentication system.
Direct API integrations like AbuseIPDB have free tier restrictions (e.g., 5 checks per day), limiting data freshness unless a paid key is used, as noted in the configuration.
Frequently Asked Questions
Related Projects
trivyFind vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more
GrypeA vulnerability scanner for container images and filesystems
ClairVulnerability Static Analysis for Containers
syftCLI tool and library for generating a Software Bill of Materials from container images and filesystems
Found a gem we're missing?
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.