From c0b18926fba0d486cff042cdcb7e59b4834a743f Mon Sep 17 00:00:00 2001 From: mazzma12 Date: Wed, 30 Sep 2026 14:59:06 +0200 Subject: [PATCH] fix(docs): repair wrong-target and redirected links from the review --- .../docs/appsec/bot_detection/configuration.md | 2 +- .../docs/appsec/bot_detection/intro.md | 2 +- .../appsec/configuration_creation_testing.md | 4 ++-- .../docs/appsec/quickstart/general.mdx | 1 - .../docs/appsec/quickstart/haproxy_spoa.mdx | 2 +- .../docs/appsec/quickstart/nginx-ingress.mdx | 4 ++-- .../docs/appsec/quickstart/nginxopenresty.mdx | 4 ++-- .../docs/appsec/quickstart/npmplus.mdx | 2 +- .../docs/appsec/quickstart/traefik.mdx | 2 +- .../docs/appsec/quickstart/wordpress.mdx | 2 +- crowdsec-docs/docs/appsec/rules_syntax.md | 2 +- crowdsec-docs/docs/appsec/troubleshooting.md | 2 +- crowdsec-docs/docs/contributing/code.md | 2 +- .../contributing/specs/bouncer_appsec_specs.mdx | 4 ++-- crowdsec-docs/docs/expr/strings_helpers.md | 4 ---- .../docs/getting_started/crowdsec_tour.mdx | 2 +- crowdsec-docs/docs/intro.mdx | 4 ++-- .../log_processor/collections/introduction.md | 2 +- .../docs/log_processor/data_sources/appsec.md | 6 +++--- .../log_processor/data_sources/cloudwatch.md | 2 +- .../docs/log_processor/data_sources/docker.md | 2 +- .../docs/log_processor/data_sources/kafka.md | 2 +- .../docs/log_processor/data_sources/kinesis.md | 2 +- .../log_processor/data_sources/kubernetes.md | 2 +- .../data_sources/kubernetes_audit.md | 2 +- .../docs/log_processor/data_sources/loki.md | 2 +- .../docs/log_processor/data_sources/s3.md | 2 +- .../log_processor/data_sources/victorialogs.md | 2 +- .../docs/log_processor/scenarios/create.md | 2 +- .../docs/log_processor/scenarios/format.md | 6 +++--- crowdsec-docs/docs/observability/cscli.md | 2 +- crowdsec-docs/src/pages/blocklists.tsx | 2 +- .../static/img/blaas/logo-rawiplist.png | Bin 0 -> 20632 bytes .../img/blaas/logo-remediationcomponent.png | Bin 0 -> 20632 bytes .../static/img/cti-integrations/logo-ipdex.png | Bin 0 -> 20632 bytes crowdsec-docs/unversioned/beta_program.mdx | 2 +- crowdsec-docs/unversioned/bouncers/aws-waf.mdx | 2 +- .../unversioned/bouncers/blocklist-mirror.mdx | 2 +- .../bouncers/cloudflare-deprecated.mdx | 4 ++-- .../unversioned/bouncers/cloudflare.mdx | 6 +++--- crowdsec-docs/unversioned/bouncers/custom.mdx | 2 +- crowdsec-docs/unversioned/bouncers/firewall.mdx | 5 ++--- crowdsec-docs/unversioned/bouncers/haproxy.mdx | 2 +- .../unversioned/bouncers/ingress-nginx.mdx | 2 +- crowdsec-docs/unversioned/bouncers/nginx.mdx | 2 +- .../unversioned/bouncers/openresty.mdx | 2 +- .../unversioned/console/blocklists/details.md | 2 +- .../console/ip_reputation/search_ui.mdx | 2 +- .../console/premium_upgrade/optimal_setup.mdx | 2 +- .../console/service_api/allowlists.mdx | 2 +- .../console/service_api/blocklists.mdx | 4 ++-- .../api_integration/integration_ms_sentinel.md | 2 +- .../integration_paloalto_xsoar.md | 2 +- .../api_integration/integration_splunk_siem.md | 2 +- crowdsec-docs/unversioned/cti_api/intro.mdx | 2 +- .../unversioned/cti_api/taxonomy/cti_fields.md | 2 +- .../unversioned/cti_api/taxonomy/intro.md | 2 +- .../getting_started/installation/kubernetes.mdx | 2 +- .../unversioned/troubleshooting/intro.md | 2 +- .../issue_integration_rc_offline.md | 2 +- .../troubleshooting/issue_lp_no_logs_parsed.md | 2 +- .../troubleshooting/issue_se_no_active_rc.md | 2 +- .../troubleshooting/security_engine.mdx | 2 +- .../unversioned/troubleshooting/usecases.mdx | 4 ++-- .../version-v1.6/appsec/configuration.md | 2 +- .../appsec/quickstart/nginxopenresty.mdx | 4 ++-- .../appsec/quickstart/wordpress.mdx | 4 ++-- .../version-v1.6/appsec/troubleshooting.md | 2 +- .../version-v1.6/contributing/code.md | 2 +- .../contributing/specs/bouncer_appsec_specs.mdx | 4 ++-- .../version-v1.6/expr/strings_helpers.md | 4 ---- .../getting_started/crowdsec_tour.mdx | 2 +- .../versioned_docs/version-v1.6/intro.mdx | 2 +- .../log_processor/data_sources/appsec.md | 2 +- .../log_processor/data_sources/cloudwatch.md | 2 +- .../log_processor/data_sources/docker.md | 2 +- .../log_processor/data_sources/kafka.md | 2 +- .../log_processor/data_sources/kinesis.md | 2 +- .../data_sources/kubernetes_audit.md | 2 +- .../log_processor/data_sources/loki.md | 2 +- .../log_processor/data_sources/s3.md | 2 +- .../log_processor/data_sources/victorialogs.md | 2 +- .../log_processor/scenarios/create.md | 2 +- .../log_processor/scenarios/format.md | 6 +++--- .../version-v1.6/observability/cscli.md | 2 +- .../appsec/configuration_creation_testing.md | 4 ++-- .../version-v1.7/appsec/quickstart/general.mdx | 1 - .../appsec/quickstart/haproxy_spoa.mdx | 2 +- .../appsec/quickstart/nginx-ingress.mdx | 4 ++-- .../appsec/quickstart/nginxopenresty.mdx | 4 ++-- .../version-v1.7/appsec/quickstart/npmplus.mdx | 2 +- .../version-v1.7/appsec/quickstart/traefik.mdx | 2 +- .../appsec/quickstart/wordpress.mdx | 2 +- .../version-v1.7/appsec/rules_syntax.md | 2 +- .../version-v1.7/appsec/troubleshooting.md | 2 +- .../version-v1.7/contributing/code.md | 2 +- .../contributing/specs/bouncer_appsec_specs.mdx | 4 ++-- .../version-v1.7/expr/strings_helpers.md | 4 ---- .../getting_started/crowdsec_tour.mdx | 2 +- .../versioned_docs/version-v1.7/intro.mdx | 4 ++-- .../log_processor/collections/introduction.md | 2 +- .../log_processor/data_sources/appsec.md | 4 ++-- .../log_processor/data_sources/cloudwatch.md | 2 +- .../log_processor/data_sources/docker.md | 2 +- .../log_processor/data_sources/kafka.md | 2 +- .../log_processor/data_sources/kinesis.md | 2 +- .../data_sources/kubernetes_audit.md | 2 +- .../log_processor/data_sources/loki.md | 2 +- .../log_processor/data_sources/s3.md | 2 +- .../log_processor/data_sources/victorialogs.md | 2 +- .../log_processor/scenarios/create.md | 2 +- .../log_processor/scenarios/format.md | 6 +++--- .../version-v1.7/observability/cscli.md | 2 +- .../appsec/bot_detection/configuration.md | 2 +- .../version-v1.8/appsec/bot_detection/intro.md | 2 +- .../appsec/configuration_creation_testing.md | 4 ++-- .../version-v1.8/appsec/quickstart/general.mdx | 1 - .../appsec/quickstart/haproxy_spoa.mdx | 2 +- .../appsec/quickstart/nginx-ingress.mdx | 4 ++-- .../appsec/quickstart/nginxopenresty.mdx | 4 ++-- .../version-v1.8/appsec/quickstart/npmplus.mdx | 2 +- .../version-v1.8/appsec/quickstart/traefik.mdx | 2 +- .../appsec/quickstart/wordpress.mdx | 2 +- .../version-v1.8/appsec/rules_syntax.md | 2 +- .../version-v1.8/appsec/troubleshooting.md | 2 +- .../version-v1.8/contributing/code.md | 2 +- .../contributing/specs/bouncer_appsec_specs.mdx | 4 ++-- .../version-v1.8/expr/strings_helpers.md | 4 ---- .../getting_started/crowdsec_tour.mdx | 2 +- .../versioned_docs/version-v1.8/intro.mdx | 4 ++-- .../log_processor/collections/introduction.md | 2 +- .../log_processor/data_sources/appsec.md | 6 +++--- .../log_processor/data_sources/cloudwatch.md | 2 +- .../log_processor/data_sources/docker.md | 2 +- .../log_processor/data_sources/kafka.md | 2 +- .../log_processor/data_sources/kinesis.md | 2 +- .../log_processor/data_sources/kubernetes.md | 2 +- .../data_sources/kubernetes_audit.md | 2 +- .../log_processor/data_sources/loki.md | 2 +- .../log_processor/data_sources/s3.md | 2 +- .../log_processor/data_sources/victorialogs.md | 2 +- .../log_processor/scenarios/create.md | 2 +- .../log_processor/scenarios/format.md | 6 +++--- .../version-v1.8/observability/cscli.md | 2 +- 144 files changed, 171 insertions(+), 191 deletions(-) create mode 100644 crowdsec-docs/static/img/blaas/logo-rawiplist.png create mode 100644 crowdsec-docs/static/img/blaas/logo-remediationcomponent.png create mode 100644 crowdsec-docs/static/img/cti-integrations/logo-ipdex.png diff --git a/crowdsec-docs/docs/appsec/bot_detection/configuration.md b/crowdsec-docs/docs/appsec/bot_detection/configuration.md index 7a82c4907..1ce6698ba 100644 --- a/crowdsec-docs/docs/appsec/bot_detection/configuration.md +++ b/crowdsec-docs/docs/appsec/bot_detection/configuration.md @@ -135,4 +135,4 @@ level=info msg="on_challenge_submit rejected" source=203.0.113.7 reason=fast-bot If you don't see any `challenge submission` lines at all after a reload, double-check that: - The new appsec-config is listed in your AppSec datasource (`appsec_configs:`) — see [Where to set these values](#where-to-set-these-values). -- The bouncer is forwarding `/crowdsec-internal/challenge/*` paths unchanged — see [Prerequisites](intro.md#prerequisites) on the intro page. +- The bouncer is forwarding `/crowdsec-internal/challenge/*` paths unchanged — see [Internal challenge endpoints](challenge_protocol.md#internal-challenge-endpoints). diff --git a/crowdsec-docs/docs/appsec/bot_detection/intro.md b/crowdsec-docs/docs/appsec/bot_detection/intro.md index 736a30193..8bfe24a1b 100644 --- a/crowdsec-docs/docs/appsec/bot_detection/intro.md +++ b/crowdsec-docs/docs/appsec/bot_detection/intro.md @@ -48,7 +48,7 @@ For the full request flow, see [How it works](how_it_works.md). ## Next steps - [Enable bot detection](enable.md) — install the collection, wire the acquisition, and verify it. -- [See default collection](whats_included.md) — the request flow, the appsec-config, known-bot handling, and behavioral scenarios you just enabled. +- [Default configuration](whats_included.md) — the scoring and threshold appsec-configs, known-bot and path exclusions, alerts, and behavioral scenarios you just enabled. - [Customization & recipes](customization.md) — narrow the challenge to a path, allowlist a probe, and react to the bot signal in your own scenarios. - [Configuration](configuration.md) — master secret, key rotation, cookie TTL, and JS obfuscation. - [Hooks reference](hooks.md) — full list of helpers and the `on_challenge` / `on_challenge_submit` stages. diff --git a/crowdsec-docs/docs/appsec/configuration_creation_testing.md b/crowdsec-docs/docs/appsec/configuration_creation_testing.md index 2d5629b2f..62742fcc7 100644 --- a/crowdsec-docs/docs/appsec/configuration_creation_testing.md +++ b/crowdsec-docs/docs/appsec/configuration_creation_testing.md @@ -21,7 +21,7 @@ Often you will want multiple AppSec configurations to define groups of rules tha Use the `appsec_configs` parameter to load multiple configurations that work together. In the following example we have two configurations: -- One with [CrowdSec default AppSec rules ↗️](https://app.crowdsec.net/hub/author/crowdsecurity/appsec-configurations/appsec-default) running in in-band mode +- One with [CrowdSec default AppSec rules ↗️](https://app.crowdsec.net/hub/author/crowdsecurity/waf-configurations/appsec-default) running in in-band mode - The other for the [CRS rules ↗️](https://app.crowdsec.net/hub/author/crowdsecurity/collections/appsec-crs) that run in out-of-band mode by default ```yaml title="/etc/crowdsec/acquis.d/appsec.yaml" @@ -94,7 +94,7 @@ When multiple AppSec configurations are loaded, they are processed in the order After updating AppSec configuration files: 1. Reload CrowdSec so it picks up the new configuration. -2. Validate behavior with your usual test traffic, or use the [generic AppSec test rule](https://app.crowdsec.net/hub/author/crowdsecurity/appsec-rules/appsec-generic-test). +2. Validate behavior with your usual test traffic, or use the [generic AppSec test rule](https://app.crowdsec.net/hub/author/crowdsecurity/waf-rules/appsec-generic-test). 3. Inspect results in logs or via `cscli metrics show appsec`. For more troubleshooting guidance, see [AppSec Troubleshooting](troubleshooting.md). diff --git a/crowdsec-docs/docs/appsec/quickstart/general.mdx b/crowdsec-docs/docs/appsec/quickstart/general.mdx index 16407be8a..3790200d0 100644 --- a/crowdsec-docs/docs/appsec/quickstart/general.mdx +++ b/crowdsec-docs/docs/appsec/quickstart/general.mdx @@ -147,7 +147,6 @@ Now that the AppSec Component is configured and running, you need to: For specific remediation component configuration, see: - [Nginx/OpenResty Setup](nginxopenresty.mdx) -- [OpenResty Setup](nginxopenresty.mdx) - [Traefik Setup](traefik.mdx) - [HAProxy (SPOA) Setup](haproxy_spoa.mdx) - [WordPress Setup](wordpress.mdx) diff --git a/crowdsec-docs/docs/appsec/quickstart/haproxy_spoa.mdx b/crowdsec-docs/docs/appsec/quickstart/haproxy_spoa.mdx index 8ac79c2b6..10567245e 100644 --- a/crowdsec-docs/docs/appsec/quickstart/haproxy_spoa.mdx +++ b/crowdsec-docs/docs/appsec/quickstart/haproxy_spoa.mdx @@ -95,7 +95,7 @@ sudo cscli metrics show appsec 1. `curl` hit HAProxy at `/.env`. 2. HAProxy forwarded the request to the SPOA remediation component. 3. The bouncer queried the AppSec Component at `appsec_url`. -4. The request matched the [`vpatch-env-access`](https://app.crowdsec.net/hub/author/crowdsecurity/appsec-rules/vpatch-env-access) rule. +4. The request matched the [`vpatch-env-access`](https://app.crowdsec.net/hub/author/crowdsecurity/waf-rules/vpatch-env-access) rule. 5. AppSec answered `403`; HAProxy blocked the request. diff --git a/crowdsec-docs/docs/appsec/quickstart/nginx-ingress.mdx b/crowdsec-docs/docs/appsec/quickstart/nginx-ingress.mdx index 814b4fe8b..c132a0703 100644 --- a/crowdsec-docs/docs/appsec/quickstart/nginx-ingress.mdx +++ b/crowdsec-docs/docs/appsec/quickstart/nginx-ingress.mdx @@ -16,8 +16,8 @@ has known security issues, and upstream removed Lua support in version `1.12`, which this integration depends on. Do not use this for new deployments. If you are already using it, plan a migration -to another supported integration such as [Traefik](/docs/next/appsec/quickstart/traefik) -or [Envoy Gateway](/docs/next/appsec/quickstart/envoy-gateway). +to another supported integration such as [Traefik](/appsec/quickstart/traefik.mdx) +or [Envoy Gateway](/appsec/quickstart/envoy-gateway.mdx). ::: ## Objectives diff --git a/crowdsec-docs/docs/appsec/quickstart/nginxopenresty.mdx b/crowdsec-docs/docs/appsec/quickstart/nginxopenresty.mdx index 123994f85..ec2a1d9cc 100644 --- a/crowdsec-docs/docs/appsec/quickstart/nginxopenresty.mdx +++ b/crowdsec-docs/docs/appsec/quickstart/nginxopenresty.mdx @@ -91,7 +91,7 @@ curl -I http://localhost/.env You should get an `HTTP/1.1 403 Forbidden` response. -We're hitting a `.env` file, a [common way to retrieve credentials left by mistake](https://app.crowdsec.net/hub/author/crowdsecurity/appsec-rules/vpatch-env-access) — the AppSec Component detects and blocks it. +We're hitting a `.env` file, a [common way to retrieve credentials left by mistake](https://app.crowdsec.net/hub/author/crowdsecurity/waf-rules/vpatch-env-access) — the AppSec Component detects and blocks it. Check that CrowdSec recorded the block: @@ -125,7 +125,7 @@ Appsec '127.0.0.1:7422/' Rules Metrics: 1. `curl` hit your web server at `/.env`. 2. The bouncer forwarded the request to the AppSec Component on `127.0.0.1:7422`. -3. The request matched the [`vpatch-env-access`](https://app.crowdsec.net/hub/author/crowdsecurity/appsec-rules/vpatch-env-access) rule. +3. The request matched the [`vpatch-env-access`](https://app.crowdsec.net/hub/author/crowdsecurity/waf-rules/vpatch-env-access) rule. 4. The AppSec Component answered `403`, the bouncer enforced it, and the web server returned the CrowdSec ban page. diff --git a/crowdsec-docs/docs/appsec/quickstart/npmplus.mdx b/crowdsec-docs/docs/appsec/quickstart/npmplus.mdx index 0a7c96d99..eb57f16aa 100644 --- a/crowdsec-docs/docs/appsec/quickstart/npmplus.mdx +++ b/crowdsec-docs/docs/appsec/quickstart/npmplus.mdx @@ -163,7 +163,7 @@ Appsec '0.0.0.0:7422/' Rules Metrics: 1. `curl` hit NPMplus at `/.env`. 2. The NPMplus bouncer forwarded the request to the AppSec Component inside the Docker network (on `crowdsec:7422`). -3. AppSec matched the [`vpatch-env-access`](https://app.crowdsec.net/hub/author/crowdsecurity/appsec-rules/vpatch-env-access) rule and answered `403`. +3. AppSec matched the [`vpatch-env-access`](https://app.crowdsec.net/hub/author/crowdsecurity/waf-rules/vpatch-env-access) rule and answered `403`. 4. NPMplus served the ban page. diff --git a/crowdsec-docs/docs/appsec/quickstart/traefik.mdx b/crowdsec-docs/docs/appsec/quickstart/traefik.mdx index bbd3d2ce4..20da5667f 100644 --- a/crowdsec-docs/docs/appsec/quickstart/traefik.mdx +++ b/crowdsec-docs/docs/appsec/quickstart/traefik.mdx @@ -667,7 +667,7 @@ What happened in the test that we just did is: 1. We did a request (`localhost/.env`) to our local webserver 2. Thanks to its configuration, the Remediation Component forwarded the request to the AppSec Component 3. Our AppSec Component, listening on `http://127.0.0.1:7422` analyzed the request - 4. The request matches the [AppSec rule to detect .env access](https://app.crowdsec.net/hub/author/crowdsecurity/appsec-rules/vpatch-env-access) + 4. The request matches the [AppSec rule to detect .env access](https://app.crowdsec.net/hub/author/crowdsecurity/waf-rules/vpatch-env-access) 5. The AppSec Component thus answered with [HTTP 403](https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/403) to the Remediation Component, indicating that the request must be blocked 6. The web server then presented us with the default "request blocked" page. diff --git a/crowdsec-docs/docs/appsec/quickstart/wordpress.mdx b/crowdsec-docs/docs/appsec/quickstart/wordpress.mdx index b9b6a1404..456a20802 100644 --- a/crowdsec-docs/docs/appsec/quickstart/wordpress.mdx +++ b/crowdsec-docs/docs/appsec/quickstart/wordpress.mdx @@ -70,7 +70,7 @@ AppSec requires the WordPress plugin to use API-key authentication (not TLS cert ## 4. Verify -From any machine, send a request with a malicious body through WordPress — this example trips the [`vpatch-CVE-2022-22965`](https://app.crowdsec.net/hub/author/crowdsecurity/appsec-rules/vpatch-CVE-2022-22965) rule (Spring4Shell): +From any machine, send a request with a malicious body through WordPress — this example trips the [`vpatch-CVE-2022-22965`](https://app.crowdsec.net/hub/author/crowdsecurity/waf-rules/vpatch-CVE-2022-22965) rule (Spring4Shell): ```bash curl -X POST https:/// \ diff --git a/crowdsec-docs/docs/appsec/rules_syntax.md b/crowdsec-docs/docs/appsec/rules_syntax.md index 4ce66a4cc..0dc4c078a 100644 --- a/crowdsec-docs/docs/appsec/rules_syntax.md +++ b/crowdsec-docs/docs/appsec/rules_syntax.md @@ -135,7 +135,7 @@ rules: value: /crowdsec-test-NtktlJHV4TfBSK3wvlhiOBnl ``` -See the [appsec-generic-test rule](https://app.crowdsec.net/hub/author/crowdsecurity/appsec-rules/appsec-generic-test) for a full example. +See the [appsec-generic-test rule](https://app.crowdsec.net/hub/author/crowdsecurity/waf-rules/appsec-generic-test) for a full example. ### Rule condition fields diff --git a/crowdsec-docs/docs/appsec/troubleshooting.md b/crowdsec-docs/docs/appsec/troubleshooting.md index 3c5de6053..3eabe0435 100644 --- a/crowdsec-docs/docs/appsec/troubleshooting.md +++ b/crowdsec-docs/docs/appsec/troubleshooting.md @@ -178,7 +178,7 @@ To test that the AppSec Component is working, send requests directly to it. Keep This example tests detection for CVE-2023-42793, part of the [virtual patching collection](https://app.crowdsec.net/hub/author/crowdsecurity/collections/appsec-virtual-patching). Make sure the collection is installed (`cscli appsec-rules list`). -[This rule](https://app.crowdsec.net/hub/author/crowdsecurity/appsec-rules/vpatch-CVE-2023-42793) detects requests to a URI ending with `/rpc2`: +[This rule](https://app.crowdsec.net/hub/author/crowdsecurity/waf-rules/vpatch-CVE-2023-42793) detects requests to a URI ending with `/rpc2`: > cat /etc/crowdsec/appsec-rules/vpatch-CVE-2023-42793.yaml ```yaml diff --git a/crowdsec-docs/docs/contributing/code.md b/crowdsec-docs/docs/contributing/code.md index 3629664a2..75fe78e9e 100644 --- a/crowdsec-docs/docs/contributing/code.md +++ b/crowdsec-docs/docs/contributing/code.md @@ -39,7 +39,7 @@ Run with `make bats-build bats-fixture` once, then `make bats-test-hub`. We receive contributions on the _master_ branch (or _main_, in recent repositories). To contribute, fork the repository, commit the code in a dedicated branch and ask for a Pull Request. By default it will target the master branch on the upstream repository, so in most cases you don't have to change anything. It will be reviewed by the core team and merged when ready, possibly after some changes. It is recommended to open [an Issue linked to the PR](https://docs.github.com/en/issues/tracking-your-work-with-issues/linking-a-pull-request-to-an-issue) in order to discuss it and track its progression. -You may also receive feedback from the CI scripts (directory [.github/workflows](https://github.com/crowdsecurity/hub/tree/master/.github/workflows)) that run a series of linters and tests. You are encouraged to run these on your environment as well, before committing (see the "Testing" section above, and "Style guide" below). +You may also receive feedback from the CI scripts (directory [.github/workflows](https://github.com/crowdsecurity/crowdsec/tree/master/.github/workflows)) that run a series of linters and tests. You are encouraged to run these on your environment as well, before committing (see the "Testing" section above). ## Release branches diff --git a/crowdsec-docs/docs/contributing/specs/bouncer_appsec_specs.mdx b/crowdsec-docs/docs/contributing/specs/bouncer_appsec_specs.mdx index 19762ab97..f3bb50504 100644 --- a/crowdsec-docs/docs/contributing/specs/bouncer_appsec_specs.mdx +++ b/crowdsec-docs/docs/contributing/specs/bouncer_appsec_specs.mdx @@ -318,7 +318,7 @@ You can refer to the AppSec documentation to test request forwarding. * **startup:** set it to **TRUE** for the **initial call** to get all decisions *(when False you’ll get the delta from your last call)* * **scopes:** “ip,range” is the only relevant value when remediating on IPs -* **origins:** Leave blank to allow all origins, test your configurable origins with [those tests](#decision-example) +* **origins:** Leave blank to allow all origins, check your configurable origins against the [decision example](#decision-example) * **scenarios_containing:** leave blank by default, allow change in config * **scenarios_not_containing:** leave blank by default, allow change in config @@ -330,7 +330,7 @@ You can refer to the AppSec documentation to test request forwarding. * **ip:** ignore/leave blank: shortcut for scope:ip \+ value * **range:** ignore/leave blank: shortcut for scope:range \+ value * **contains:** leave blank by default, configurable by user -* **origins:** Leave blank to allow all origins, test your configurable origins with [those tests](#decision-example) +* **origins:** Leave blank to allow all origins, check your configurable origins against the [decision example](#decision-example) * **scenarios_containing:** leave blank by default, allow change in config * **scenarios_not_containing:** leave blank by default, allow change in config diff --git a/crowdsec-docs/docs/expr/strings_helpers.md b/crowdsec-docs/docs/expr/strings_helpers.md index a7ea5413f..408664a9d 100644 --- a/crowdsec-docs/docs/expr/strings_helpers.md +++ b/crowdsec-docs/docs/expr/strings_helpers.md @@ -100,8 +100,6 @@ If sep is empty, Split splits after each UTF-8 sequence. If both s and sep are e It is equivalent to SplitN with a count of -1. -To split around the first instance of a separator, see Cut. - ### `SplitAfter(s string, sep string) []string` SplitAfter slices s into all substrings after each instance of sep and returns a slice of those substrings. @@ -141,8 +139,6 @@ n < 0: all substrings Edge cases for s and sep (for example, empty strings) are handled as described in the documentation for Split. -To split around the first instance of a separator, see Cut. - ### `Replace(s string, old string, new string, n int) string` Replace returns a copy of the string s with the first n non-overlapping instances of old replaced by new. If old is empty, it matches at the beginning of the string and after each UTF-8 sequence, yielding up to k+1 replacements for a k-rune string. If n < 0, there is no limit on the number of replacements. diff --git a/crowdsec-docs/docs/getting_started/crowdsec_tour.mdx b/crowdsec-docs/docs/getting_started/crowdsec_tour.mdx index ca6e1ffca..8b2098a87 100644 --- a/crowdsec-docs/docs/getting_started/crowdsec_tour.mdx +++ b/crowdsec-docs/docs/getting_started/crowdsec_tour.mdx @@ -83,7 +83,7 @@ sudo cscli decisions list If you just deployed CrowdSec, the list might be empty, but don't worry, it simply means you haven't yet been attacked, congrats! Adding `-a` flag will as well list the decisions you received from the [community blocklist](/central_api/intro.md). -Check [decisions](/u/user_guides/hub_mgmt) management for more ! +Check [decisions management](/u/user_guides/decisions_mgmt) for more!
Listing decisions example diff --git a/crowdsec-docs/docs/intro.mdx b/crowdsec-docs/docs/intro.mdx index 062392306..0a4df1ff0 100644 --- a/crowdsec-docs/docs/intro.mdx +++ b/crowdsec-docs/docs/intro.mdx @@ -10,7 +10,7 @@ import AcademyPromo from "@site/src/components/academy-promo" The [CrowdSec Security Engine](https://github.com/crowdsecurity/crowdsec) is an open-source, lightweight security engine that detects and blocks malicious actors. It analyzes logs and HTTP requests using behavior-based patterns called scenarios. -CrowdSec is modular: it provides [behavior-based detection](https://app.crowdsec.net/hub/collections), including [AppSec rules](https://app.crowdsec.net/hub/appsec-rules), and optional [Remediation Components](https://app.crowdsec.net/hub/remediation-components) that enforce blocks. +CrowdSec is modular: it provides [behavior-based detection](https://app.crowdsec.net/hub/collections), including [AppSec rules](https://app.crowdsec.net/hub/waf-rules), and optional [Remediation Components](https://app.crowdsec.net/hub/remediation-components) that enforce blocks.
@@ -65,7 +65,7 @@ This architecture supports simple standalone setups and more distributed deploym - Centralized logs (rsyslog, Loki, ...): [Run CrowdSec next to your log pipeline](/u/user_guides/log_centralization), not on production workloads. - Kubernetes: See [our Helm chart](/u/getting_started/installation/kubernetes). - Containers: Use the [Docker data source](/log_processor/data_sources/docker.md). -- WAF only: Start with the [AppSec quickstart](appsec/intro.md). +- WAF only: Start with the [AppSec introduction](appsec/intro.md). Distributed architecture example: diff --git a/crowdsec-docs/docs/log_processor/collections/introduction.md b/crowdsec-docs/docs/log_processor/collections/introduction.md index 3ee1c7170..9d68c626f 100644 --- a/crowdsec-docs/docs/log_processor/collections/introduction.md +++ b/crowdsec-docs/docs/log_processor/collections/introduction.md @@ -27,7 +27,7 @@ Collections are the recommended way to install detection content because they: Collections are distributed via the CrowdSec Hub and managed with `cscli`: - Update the Hub index: see [`cscli hub update`](/cscli/cscli_hub_update.md) -- Install or upgrade items: see [`cscli hub upgrade`](/cscli/cscli_hub_upgrade.md) and [Hub management](/cscli/cscli_hub.md) +- Install items: see [`cscli collections install`](/cscli/cscli_collections_install.md). Upgrade installed items: see [`cscli hub upgrade`](/cscli/cscli_hub_upgrade.md). ## Collection file format diff --git a/crowdsec-docs/docs/log_processor/data_sources/appsec.md b/crowdsec-docs/docs/log_processor/data_sources/appsec.md index 81e1ac0d5..f90fcb39e 100644 --- a/crowdsec-docs/docs/log_processor/data_sources/appsec.md +++ b/crowdsec-docs/docs/log_processor/data_sources/appsec.md @@ -56,19 +56,19 @@ Number of routines to use to process the requests. Defaults to 1. ### `auth_cache_duration` -How long to cache the auth token for. Accepts values supported by [time.ParseDuration](https://golang.org/pkg/time/#ParseDuration). +How long to cache the auth token for. Accepts values supported by [time.ParseDuration](https://pkg.go.dev/time#ParseDuration). Defaults to 1m. ### `auth_timeout` -How long to wait for the local API to validate the API key of a remediation component. Accepts value supported by [time.ParseDuration](https://golang.org/pkg/time/#ParseDuration). +How long to wait for the local API to validate the API key of a remediation component. Accepts value supported by [time.ParseDuration](https://pkg.go.dev/time#ParseDuration). Set to `0` to disable the timeout. Increase it if your local API is not on the same machine or is a few network hops away. Defaults to 200ms. ### `body_read_timeout` -How long to wait for the remediation component to finish sending the request body before giving up and processing whatever was received. Accepts value supported by [time.ParseDuration](https://golang.org/pkg/time/#ParseDuration). +How long to wait for the remediation component to finish sending the request body before giving up and processing whatever was received. Accepts value supported by [time.ParseDuration](https://pkg.go.dev/time#ParseDuration). Set to `0` to disable the timeout. Defaults to 1s. diff --git a/crowdsec-docs/docs/log_processor/data_sources/cloudwatch.md b/crowdsec-docs/docs/log_processor/data_sources/cloudwatch.md index 32d014e39..f360f4f58 100644 --- a/crowdsec-docs/docs/log_processor/data_sources/cloudwatch.md +++ b/crowdsec-docs/docs/log_processor/data_sources/cloudwatch.md @@ -38,7 +38,7 @@ labels: type: apigateway ``` -Look at the `configuration parameters` to view all supported options. +See [Parameters](#parameters) for all supported options. ## Parameters diff --git a/crowdsec-docs/docs/log_processor/data_sources/docker.md b/crowdsec-docs/docs/log_processor/data_sources/docker.md index d6ac6676e..493720d0c 100644 --- a/crowdsec-docs/docs/log_processor/data_sources/docker.md +++ b/crowdsec-docs/docs/log_processor/data_sources/docker.md @@ -59,7 +59,7 @@ labels: type: log_type ``` -Look at the `configuration parameters` to view all supported options. +See [Parameters](#parameters) for all supported options. ## Parameters diff --git a/crowdsec-docs/docs/log_processor/data_sources/kafka.md b/crowdsec-docs/docs/log_processor/data_sources/kafka.md index 34f3d02f8..5fef13fc1 100644 --- a/crowdsec-docs/docs/log_processor/data_sources/kafka.md +++ b/crowdsec-docs/docs/log_processor/data_sources/kafka.md @@ -63,7 +63,7 @@ batch: The reader will always start from the latest offset. ::: -Look at the `configuration parameters` to view all supported options. +See [Parameters](#parameters) for all supported options. ## Parameters diff --git a/crowdsec-docs/docs/log_processor/data_sources/kinesis.md b/crowdsec-docs/docs/log_processor/data_sources/kinesis.md index d7c30ea91..79205a7e1 100644 --- a/crowdsec-docs/docs/log_processor/data_sources/kinesis.md +++ b/crowdsec-docs/docs/log_processor/data_sources/kinesis.md @@ -30,7 +30,7 @@ labels: If your stream is written to by a [Cloudwatch subscription filter](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/SubscriptionFilters.html), you will need to pass the `from_subscription` parameter, or the Security Engine won't be able to parse the content of the message. ::: -Look at the `configuration parameters` to view all supported options. +See [Parameters](#parameters) for all supported options. ## Parameters diff --git a/crowdsec-docs/docs/log_processor/data_sources/kubernetes.md b/crowdsec-docs/docs/log_processor/data_sources/kubernetes.md index b4ee215c5..2deca5427 100644 --- a/crowdsec-docs/docs/log_processor/data_sources/kubernetes.md +++ b/crowdsec-docs/docs/log_processor/data_sources/kubernetes.md @@ -29,7 +29,7 @@ labels: type: nginx ``` -Look at the `configuration parameters` to view all supported options. +See [Parameters](#parameters) for all supported options. ## Parameters diff --git a/crowdsec-docs/docs/log_processor/data_sources/kubernetes_audit.md b/crowdsec-docs/docs/log_processor/data_sources/kubernetes_audit.md index 865d3e182..7afe36614 100644 --- a/crowdsec-docs/docs/log_processor/data_sources/kubernetes_audit.md +++ b/crowdsec-docs/docs/log_processor/data_sources/kubernetes_audit.md @@ -16,7 +16,7 @@ labels: type: k8s-audit ``` -Look at the `configuration parameters` to view all supported options. +See [Parameters](#parameters) for all supported options. ## Parameters diff --git a/crowdsec-docs/docs/log_processor/data_sources/loki.md b/crowdsec-docs/docs/log_processor/data_sources/loki.md index 42410132d..0cb2a2441 100644 --- a/crowdsec-docs/docs/log_processor/data_sources/loki.md +++ b/crowdsec-docs/docs/log_processor/data_sources/loki.md @@ -26,7 +26,7 @@ labels: The reader will always start at "now". ::: -Look at the `configuration parameters` to view all supported options. +See [Parameters](#parameters) for all supported options. ## Parameters diff --git a/crowdsec-docs/docs/log_processor/data_sources/s3.md b/crowdsec-docs/docs/log_processor/data_sources/s3.md index 29bd26a7c..35d138cfa 100644 --- a/crowdsec-docs/docs/log_processor/data_sources/s3.md +++ b/crowdsec-docs/docs/log_processor/data_sources/s3.md @@ -44,7 +44,7 @@ When using the `sqs` polling method, make sure the Security Engine is the only r If other processes read from the queue, then the Security Engine will miss some events. ::: -Look at the `configuration parameters` to view all supported options. +See [Parameters](#parameters) for all supported options. ## Parameters diff --git a/crowdsec-docs/docs/log_processor/data_sources/victorialogs.md b/crowdsec-docs/docs/log_processor/data_sources/victorialogs.md index 611ab83fc..b17dd143c 100644 --- a/crowdsec-docs/docs/log_processor/data_sources/victorialogs.md +++ b/crowdsec-docs/docs/log_processor/data_sources/victorialogs.md @@ -27,7 +27,7 @@ labels: The reader will always start at "now" for `tail` mode. ::: -Look at the `configuration parameters` to view all supported options. +See [Parameters](#parameters) for all supported options. ## Parameters diff --git a/crowdsec-docs/docs/log_processor/scenarios/create.md b/crowdsec-docs/docs/log_processor/scenarios/create.md index ec0cbde6f..6f88a54f6 100644 --- a/crowdsec-docs/docs/log_processor/scenarios/create.md +++ b/crowdsec-docs/docs/log_processor/scenarios/create.md @@ -129,7 +129,7 @@ We have the following fields: - a [type](/log_processor/scenarios/format.md#type): the type of bucket to use (trigger or leaky). - a [name](/log_processor/scenarios/format.md#name) - a [description](/log_processor/scenarios/format.md#description) -- a [filter](/log_processor/scenarios/format.md#type): the filter to apply on events to be filled in this bucket. +- a [filter](/log_processor/scenarios/format.md#filter): the filter to apply on events to be filled in this bucket. - a [leakspeed](/log_processor/scenarios/format.md#leakspeed) - a [capacity](/log_processor/scenarios/format.md#capacity): the number of events in the bucket before it overflows. - a [groupby](/log_processor/scenarios/format.md#groupby): a field from the event to partition the bucket. It is often the `source_ip` of the event. diff --git a/crowdsec-docs/docs/log_processor/scenarios/format.md b/crowdsec-docs/docs/log_processor/scenarios/format.md index 5f6624827..8f9d350e9 100644 --- a/crowdsec-docs/docs/log_processor/scenarios/format.md +++ b/crowdsec-docs/docs/log_processor/scenarios/format.md @@ -240,7 +240,7 @@ duration: 10m Only applies to `counter` buckets. A duration after which the bucket will overflow. -The format must be compatible with [golang ParseDuration format](https://golang.org/pkg/time/#ParseDuration) +The format must be compatible with [golang ParseDuration format](https://pkg.go.dev/time#ParseDuration) Examples : @@ -349,7 +349,7 @@ Only applies to `leaky` and `conditional` buckets. A duration that represents how often an event will be leaking from the bucket. -Must be compatible with [golang ParseDuration format](https://golang.org/pkg/time/#ParseDuration). +Must be compatible with [golang ParseDuration format](https://pkg.go.dev/time#ParseDuration). --- ### `condition` @@ -515,7 +515,7 @@ This is intended to limit / avoid spam of buckets that might be very rapidly tri The blackhole only applies to the individual bucket rather than the whole scenario. -Must be compatible with [golang ParseDuration format](https://golang.org/pkg/time/#ParseDuration). +Must be compatible with [golang ParseDuration format](https://pkg.go.dev/time#ParseDuration). #### Example diff --git a/crowdsec-docs/docs/observability/cscli.md b/crowdsec-docs/docs/observability/cscli.md index bf3947e2e..328f89605 100644 --- a/crowdsec-docs/docs/observability/cscli.md +++ b/crowdsec-docs/docs/observability/cscli.md @@ -7,7 +7,7 @@ sidebar_position: 2 # Crowdsec Metrics CrowdSec is instrumented using [Prometheus](https://prometheus.io/) to provide detailed metrics and traceability about what is going on. -The `cscli metrics` allows you to see a subset of the metrics exposed by crowdsec. For a more industrial solution, look into the [Grafana](/docs/next/observability/prometheus) integration. +The `cscli metrics` allows you to see a subset of the metrics exposed by crowdsec. For a more industrial solution, look into the [Grafana](/observability/prometheus.md) integration. The best way to get an overview of the available metrics is to use `cscli metrics list`: Type | Title | Description diff --git a/crowdsec-docs/src/pages/blocklists.tsx b/crowdsec-docs/src/pages/blocklists.tsx index 9e6558ceb..d571a49b4 100644 --- a/crowdsec-docs/src/pages/blocklists.tsx +++ b/crowdsec-docs/src/pages/blocklists.tsx @@ -65,7 +65,7 @@ const BlocklistsPage = () => { icon="/img/icons/shield.webp" description="Subscribe to curated threat intelligence feeds to block known malicious IPs across your infrastructure. Deploy in minutes to firewalls or alongside the Security Engine." heroButtons={[ - { label: "Get Started", link: "/u/blocklists/intro" }, + { label: "Get Started", link: "/u/blocklists/getting_started" }, { label: "Browse Catalog", link: "/u/console/blocklists/catalog", variant: "outline" }, ]} helpDescription="Get help in Discord or dive into Console docs for setup and monitoring." diff --git a/crowdsec-docs/static/img/blaas/logo-rawiplist.png b/crowdsec-docs/static/img/blaas/logo-rawiplist.png new file mode 100644 index 0000000000000000000000000000000000000000..468cf5f4fb2686a287772a4dcd0bab1d1245622f GIT binary patch literal 20632 zcmeFYRa9Kv6FrD)upk}Wf&_PWcL)&NH67gDB{&3kmjJAGTKg1P)wBneW2Zogk7PaR0L%uMAh9h&$51cVQb#qZ@!ykH4IzS4O8pJ zuN&4bD^ejNW2S#8zTXh1&AZ?5Vl|4g`M`DFz9q&w-fprMZL?;h_gP-;Hv3oCr=yAQ z90b}myg7#g&u0H16IuNCzK3hB=kM%fNP$|H@0nT9aH77kxg2CjVo*iUqL?tWXh?yW zB482BU?@4*Kr%QL0!%n^{~3QWB8_N!rODxV56BiM}Vea0M^MxMy9@#7NX;QdBnYqd6E;v2J4I!~YtL#~!r3wT?FW ziT>He8Il#Bc56j3##ZNN7pOGIL&YAZlgn|#>b`+VtZlS_)6HcQ_T$GK50yOXp+5WQ zSXka6WzTh1JiY`Y(BG%qTjI!r3~tHlZ}ehTIe+=7VX+N0nqR{295L+tX;Sk&jjvb0E2ek^tv=B3V4SU!vn z7(TvMXa@UrnFRmXMA^}+UQ!CTyczgtr)y*KV?GM7rlBuwI^j}Ct~5n$_fAQ_zB2wQ z`qewZZ)J~DgPj;E)a!BIIx_>c9=$P%yQa>kN#5PuoBeMI zr(v;k<=vSq*s!n1@2{m%cC>v9i%rb*)91iLRQ;xnyPGtK-MC@asQ z^ZeeI222aBauB3#6F|5qJ#0O1W5dThIS23bIw% zK>d{Gqa4cv4NM4X)N#Y0R702SuWH4DXM(NWBJolRZG#ZZ2T!I9E{Wk~Qh26;HeO#1 zcGuG(G|mXN3=I*S)ygJ3Z}XK5$#( zeBnYRI--kODNCFIOi>=j)YMe7Z^bQB`|793_#LUE!jISy6~(hQY54OqrQPr!H>4XG zb&2Mdk22AA!%Y6`h?CQ%lc{c_=%>chmT%D!4afMw{=$>~FptmGo%zMzsHh*am)*&V ztXDq!{uRP4~OFWZmcB>bstE{9A_3HLX<@*dB(A5rCq zpKVv{eNG{YyhkF+h_!pCsuI?)z{FGxHW=Ey@>g9iq7FUYnq(rA*v-CMs8K&+zQ2y_ zJKHNP{6SAi7_yEFeL}ZPp)er?T+M$ZBKgtD%mZz!Ww2jIyZKK<0HNc(Qvc1DlxZtS z6<}3pz`_wBV3xX?0;Z3qOuRh|DUvdJ%QJzdXg(hR9uC}oZJ*sDHqNzTTT~(M zB>it{QKR(82wgt@s6lgo(!|KZ?rj_9plKG!tYRW8hJVWs+fObqSl z+a1wJt4r-f%n;m_lk|wJ8~yMVNiOJzeY9Kips2TI)~;>dw940C@M_dLo2L-x4Bl~W zuHvb@LzPQ)dQIH1d8!^izH_E323oYTE_VFRBiJ`6sea#X&T?V0$?H)14t!HR~Wi$ehBT)J_l(1Tx>tCBwim&zD@1zu-3MbT#hBQ$?E--+wP0hvQnW-G-}Jp7B?gO z^SAbq?A4;DIK}KOpL?Z{mt04-?ez1LpiN(m15rD+G^-Cpm1U~fi3ncX1hyx=8-5zn ziljA(Uye8OAz#IF2>nmN>?O|&>g58ThLfM~7@XoPD(TeMb=!7;E)geLO63j83dqp7 z_2%1UwPdnqGa3cCOd!pPtLDea$j^{qkDASNsP+#o7guyaGe#i2U45USRtuNJhj_xfAq&H>&fpt9?CR(PCj6m5 zXUK!@w5l(@ghIF*SEbBJvdtlli**E&^6TTFj*W#;-e5LDT*Hp~S;F4Ww)D@8cX;9=^jlDb_E(`(>y~mqn9~ zWbe1JWl5}Ho7u<&n$rTQLBrlmOKE`anu#lh;)*cjE-!$()#Y;Vp*<+5p+#Sd-Dz^i zP*Z7>&1(&M(fFKA_i72NWcz8;!gi(A{jtbpR;)2rX^H#cuA7vUh#1QC@DfAz*)L*) z^JV40;k^9tRJYc9K5875<}6#_X=x}gzfr43;4}Soe-mt#9pE>${g(K&!5=Xyk2(Ts zJ75AY%93ckX_brYa6O>qg2a|omA`<0qo=%ZPBvOhH`1h6B<1J7#V(?Z7Z)};95~l@ zvViAm&QLX;?Xu%Mb|O(?I~(=h63){jC6qjMes1c{XOk9_zS9|vHr>`OPTKQx^icRb zq<~E^>@w@n3A{Is-n(uII=Rh@H~%yFq!-npkdpA5dEdmZ^Kwh(%%;UFEWC+UibLJ}}Sk!hjS$4P~8_BfEK<)STVi5&IK@M1=us|%Di@=&mFxHEJ;|8&S+63aMMKHE zm`wPc)f4Z_`iT+u^~<9se)-k~03Yfs^{^5`#XB(%uKgORsnO)|;M0i^dq$`dLf+s# z(M%+V@JN#4Lx20ZxQ%1>=W@^nckoK(y9R2$obpMbl8R6}F(x!7ST(^bLF=9}-O)Gf zpuFsCtfPdJoew56+j|Bz8WIe|w0y$Pw!?JIU7JIU7sR3VN(h)1*$nV;hbzP*syRPP znrTr8c}=o&8giY~L`g&lnUWPR`eFGXJ*9iVKML`xyUnA{S%!Z?wccjsGmluRYSJOs z(1|k(Ug~}Av4T3gzQTFJ@wRFZ+EdP5^AX?N z%{ky}_Py~@A;6)i`MvGI->I~jX7TTWi8;C@?X}Q=r*UJDUQvv|mGP8v@pBB@CD8-J)TR1d z$dAd`WaU++9nMVdthLd4vo@qwvdQ2y;v*}u_dtW7S77xe@(pvBmVW+38@Q~tEhx(8 zwMlO^IAMNVPAo;;_G2eJ24;97{`P02E-~x<@NbQDABpiw;wZ*BDrLxlF=&p3Zim!c zI^3yDQWywqKqRw1X0jre)@O}X9{%w8>U*r_o+0OH*>@8~0u}y0nFu<2f zGs(^VND}oUfy6k;v;`_9NIoUP+&8Lxup*;J%(0_g1s9*q@2~Ez!*IfXlM7xHz#G7s zuUr7k95n5q)ybtQMlkR}c=m{fFY`;UUehs4jkKw}z^Qix-li~PR;{@6XBTM!N#sc4 zv@y;y5ZR}Dp5OP!qVN9&RfPkcTPxQkL~rTR?%(LTTvGDC#h?CF;cSLPJXZAuQgqZs zMZ7F!m$>h}T_9J|3@20}CJ++xqfw`jKg0rU`B);Hx2ePbcTQ+GKtABU<+UVbM7;EI z+z&W-180#|*OF7`xP~_>wNutj&@ylQPQ5LHF~p%(*+lHu5rUpR1@3k8NDJnbCACdj zz&!t3f9FSFjz1R{s{7B?$KL1OZkk0#IeeZzR)WIM>U20w%X@Bu-iE$O>v;S<_)sGm zp`m#4{?rrx%)l;S8)YfwnH0w-J?&;$rvE*#kZn0bK?r0b46Ofl&H+}VOsP>oRb4FX zhXK>mf!OxX3wid$t_`Pc@se^k;||5ISu<0}!e2)H?uOsPC$yFBz&6ta!R}KfM5@kG z0hj{>pSf)*9Dy?;?1s&^mG1tU5lYjWy|9FZxiYKNh*llRvP;{JS78Cc{IT<|ZMsDE z?k>r{wg9V^5)7ZoukfF4?F7a~0DPX|WbwA-t*fvRcLh2B)$;K?>^L8#sMB zBsJFDDw)2D9#{zo6A8x)K!Iyty|7nSUA!$l?rWT5SQ_>MgUUtT5sO5T^XM!uK_~Sp+7akzeB8`_~_v&fK}` zqUd~DeX?RzZ$OHJ$mqVZA~~xu7hwL_P@;dndN**6uXFa8cS8`N)X6PB`OfZm7zU4B z0fAXMQv1@vly1kIztiE8$pKilT@~wzofa*^$VH=3^GoBFn?iuH-RBf78!$B?>&==% zV~{-cg&w=r?j3x&@=MFs&I-OJmlDz%8^uEC&n-79r^T3u z#MS+8u{o|T?SFr$6y$A@CVZ54wT_I8W)g5XO+I0{U*1LklUcJr#2o3vtrUEh(_}Xl z4J%A_N{G{8nz-0fikQr#%W2B)Z1Z_Xv;(u&_|VA-et!1{1yK$9Ra%Ho7iS4?iOCJ6 z3W0T~UpnF&o%bs7!?c(CkWmzeuwRV&o))|-W%G@c>Tuyd0|4?cXn%6QdN_l6{{tEN z$@&!ow$hxG-y8dF`mYqfa1|2+hh0?poD{RJ&3uGP^8TqIw{gGNrs+&FD!-h^yvb^3 zAb{;)3e0CTb@Y1|UCt`_s_y9pgud{;gKMVgnBVHU4}G$l8tp84%1Z8}?R$%*#!Imq zzX`OI<#i5-==Z# zD%w2QNs|4jym2&%y8cd?SaScYzxd~Y*!c>{U~}(OZdOwi9EUMk$XNHs4>;h<1%*fW zZbK$ROZo9Cvd&%g7`!u9huF(4&zt_*N=*#E3pL+p) z5cv4aApeKi6uT6`|!Bd^sB@- zt>N{w%%c$<-FxqinKmE-^_`aI8oZWm?1fjAD(sN+a?KV>sJx%L?dtw-PhTIJ`Pn(3 zswQM`UulF)Py`%@xQ?){IeMYHyMGT-q#&v{65qvl@LXAAn@@nlpH1H9&lPu z4{LR!%dHT@&fs5F{ueExL6&un7#Qj)*ztX@`kMJ9aPYQCTJVs0#{}ifqs1@yvN}pJXsQDA?oKM>cGHt+-X>3!pfcfNER}0LTsnl229Qji!@jhT6@SAsWO$;sF zhp!=bvOz={!h@twIC0TaaeDnRu+G>m?N7ENqv;su%53`8PF^nw1lI`#BzSYNBu9BX zhf_)Z5@luCN@;t$5Y>+f2$#1C-4<9GK(is3WgHL0^5E}xK6b;2>#hqH-_K^yNIK3e zC)Wb3|2CfN{RyHVcu^^*x@l1(RZn9I3#a@0V&#;8&;m7b&f^lVygJJy(|5fCiyvZd zu&mEe7{DSkCK&GEjCSOg%P|yaH~e|PfBvDf#%Wrv|Mrv65NKk3bl5lEz5P3|55ws# z6+83iRi;Y9!hL^Ri#c4J!|m|?Ju035I0Kax=@KDDG1#gf5sOW&O+d(BqHvSkhH??zr*Fr1!xFH+}8zFxT_pcHU#3bPyM~g-qxU>tA3b=zP_a z86xB#T*ENPMkEv8mqg|f5`wmVKO$3=&9z_423``dv#9`yc9dRXJh}!Rlg|Lt4JznI zSDSt6^mTvy2>;FFc|pq_&U524Kt=3$Hco?PRm&CR9G^AP6cv$LKBwXDMK8fWx>WWC zyI>E??$M5gFGkvURz5nt*lp07e==^yGF!4PoE>BGD!IKe=ZO(^xJhOMH#L|Gc({nq zsKBo0X-K-e09Hhsm6d!Yt+|@_^xLB|O|w@HQi8srWU#9R`y}2}^@v?Xp`xJS^b0i^ zBCkKRw^k_=Fz?r3fMBTfDod$Jl?-158eU($_M9lT1HWKb@O;4@^s?C`a9XAzuDucP zQfR90PXu_rlWeN9;`}zr7FaQ+wCxfnWgjJXe&dVlvwqk1drjO#1i~!>wLYaRZPqMr zyvWpw7tUZFTK5x+v>S|V$~Hecle2`o>`on)$&vJasz@0AmEm90bo4q3Bk?)X=u-xU zo5n8Nvvabbh{$Y3%s^}vwONF;zdA_JZ^7)vA`FGkWD>e8VCDA4exd0tVaIRe4eh3T zytHTy-SuXeh{OUC=x#W5^eMxl*doluqmVCSnFn4^>T>g@#%#3(;&v`noII4to0izQ zZ0yA-tOs=TVvQk-0_Bz$pj%XNIiCweVQS5p3|K;R z{vLn#*Ke~oJazpqAX8T+TQENU@(}OhEXDTh_IN@7IL{NH~sy-tA&$G zAu@{Sn51>poAQr6pM_8S+I@tU|BMkK06k5-OVB%oTcYDy<1e~83S(TemKf#a)2W-V zl36nFhooCse_fxuRTvNvGV)1agagMR(jvqq|LZn@kdboJ;Gn;BxB;pl}oWOAjy)9(K3@XK#c`#OS)izZAk*CxymOSwcrcC5IN} z;xgU&X5ynio0+DGHsFF-uBj7_&8_E61noc2=I8-=s7d);o0z0cnf2yoXqU}-rX~He zx=VIK>I&eFBn*J+4I*w~M=)B?^Nq2uE#LQ4PM-f9 zpHz$$WeMY3ak7mpjQ5~)o}c^wou7}`zy0iDnwXfo!#jA_}2zt9MXg+C@SOZ$2zH=U z9=GRja~_#kkJS8pO89aU(O(=6V#l!~{C*`vV*+f_RU`V>eTk6M8?W-=!}cGO7^BQD zb&$2e*frrVj_(iu`a1(GMK?dmTV~CA`jvLp1XL(+u?&bJLWrKj%wf|6ur>B1F_l0g<`{; zuAf)=f*od-Z=jXOjRF;Ky46tL`RSYiiOBlKL}A4gVXyI=*L%_48qH(LJ1iB{-Q`$` z3iWu(I|JV3PQO-fJMVG(qb52Kos4f47CifD_ybsZS05W3&yq;_V&A*JSGi<+G+xh< z=DcqTt9;>qh*72M87WOD-oDrJ$S7v^Dv=jZn=TlTi&RWo_x}M9aWbEU9tL}=US6LecXB1P}T>k4ykZD!Tce3uDU=e$Qg9boo?M=VbCA;p{;gN9i=D&s0Wn zlZBV7cKFrzTGmREM!O_>519>2tZZiD+U=hguBnB_%R5ed#5P;BK5^>yo_roSda&R+ zm!ov~95)iTqpwIz`T+$G=)2RY3N%@#Kdk=M#wwNF`WiX_cQ8tC5~@|G?I8SD?RyC2 z=KL7W!;kh(9Et6*9OqxN%jvD_;ZF6cw!FB{A=}Gs1#|apC5+miw2Y%3zGKIt5Lzg9 zQe<8ES8=Bm8m|=g?wbeli^yiD44c_`{7bdLeaax@w0x()>FIwjI6vR!H?(FnuH{;$ zMPt&7R9{5?g&`NDKlLTSrmS@=sOaF!o(J-4Sh?`!Q_A4Xk*iPc_dc_yVnV%{mHhe^ zul$mVXGSs4vYrod@#BO=cj1I*r;Ub{?6SR|76mcRLERW>b49A8cUR@i>!GHtF!~{) z$%u&KY+cEQ4T>I=!mN*!VE}Qk1i$%BzTbzk@f@LJVxBs+s0-%_b!O{5Az&f(HTT1MK3zg=gkBaOHA>Ye)>Jko>jD<6naXK(a7sg7V+`0n+!;)zC(T;55Wa zsUZKIviw}i+nV4z1X&FSr6T`iCC;)gRq*|@uLh^CGYZqtWO=;{Vf-=IW$XI-4AgmV zDRvJT{i3_H^~awb?2(IU7oehI#zzOcNQS;PG+bn?3(35`YEyITFLQ&(D6stBB7UD?+b4rf3H<} zDP(deUjy6bvG8eCHxDyaI=FvD;egLUdE2z|oH|>1pG<{dt`7o*Z8DP)HN0&6h+SC< zr4zzrAw;uhR_Xh1N|SiPkax3{#9IBa^lX3)g-@~bi!NSV4JtxHJt7QjlVVQ8?Ho_K3s%J zmhsa6sXkaCrT5Yfu!uh&O`qdIm9Jx7Ec%F!Ff@S7>+w z^b_;HwyC}95}5?pL3i6&C*Z%Rb_>CF`PChBp0s3;WI3ktyv~BERMe&=CKQk zJ|bX|21GnXS+&vY!}JW9rE%j*B9Ys%orNssz<2&5&K)@s9|L$kv`50frI7cj`vcbH z3=zdKMkit)(?lVexo4x9WWp#K4c@Py(DzfN%nXRZZQ&74%ZHmR{Ez53xX)+_Z-jYp zT{9Y5>ytl@6;s9Z<6ti-?gD0V31&>=e&DOwL!Ey!V8Y#5p0>~ojE(1DGCib^=ekl%(mX&$ewT1_}RHf|elBh~?WRh9H(G&vDU^ zsr_pm4DbW2X3qZU;{RSjG}xR&ZOQc`k>TU3?FyeE@Jie_$Ay9w<8Wn!cUwi5~VD_S2Ge;A%*mOXV4TZH6gf9DGZq4 zJK0;@Bn1YASV`9eDh!Bt3BJI&BLgz^kk4TI_w7|1fH>T4o5i7$D9)pJtMuj7b2=gk z;z)Zt@VrWA?L!B4TL2^9I^hiFbI1|gPe3%1MS&)cm_u|qFI7In;u$82e1aPH=i{Wmqa{4KW=@C%r>j%Cq0XN!u!3Q#^xDBK}mxA`Y;u?{Bx zkdQ)xz07o*j8PGYq5!`EQIJF#np_Zy{Vg|91**}?wcX`kmQ%ky6~_yCSk@1P!C7vd zwk!kHDm8E|rW{)7LLSj|R-%5eMWXPZCmhtSgFN1Un5DpR( zyfT3X;iMj9{^md$^sD(KtfBbdIcynXGl!mp;0HS61?fNFH0c5wfi>;+mfyyZ++D|H z-n8Yw=8{{_-N2#L$!}laAd26W!sUYQM(+Fk=l+vioJzeEQr9cEX{XlA(o_Vt3O2kt zTl4FOlJ*xg$SmCqOXmpTN=ZTXu*z`6+_Y$FIrN^QE`GbZeuHQNa0j)j;+KbNgUPG` zW=HZ|P>_9VPtVha-o?#zF7~Exvq1nyQ}l|a?lTUX!e&Of6nT?#c6>a-_+xAnUe7O& z|MeeY$6VMW?3~LX5L>2nhq5kMH_r3cflos39ep03=~yr`~OMg>@z;P&aFr zVd08ZF9NOx0a;ifh~l8E_&o*bodeq%QyGYo6A1GnX`@hg>x+bSb#x!-Yy{Y|q$q8y z&GVhC#Drmsx(%9WYS5kWE89OM9}-+|xoR?%+{Z8h(BZDNikp5Go@FXA*qyxhZqRe) zvDrDhIv>?YVVl!(F~k>ME~vel3Pc29)AOt`_g_TTzc-b(y@}y?xp_6{Z!uzvy&jG; zuKX91we$P7`kW2PlodRfsfYUnqD8yw*}HJa!O^d{(LmL}t%pF)6l7zS z$zZdHzFS7~j3-DkO{*Xa^NNAS?oc85 zhh6K(KUOW3?p=O!e0cj8x1){B{`{6PZet^+Kv!e>=g(5TB`Tj;`oe{@f!f6>%CsL~ z98`cP0kT`iEk@0>T7F*iYn6Zhf?u={vn{#zN_t^CRHZ=*8V1yve&dCVY7{Xk*7o>t z;LEo_t07m{XoxW2S|LjwQ?BWEJEMl933ll_SbK-_E$E$FEMT7N^+gTz)arRQb`tT1 zv_M!CJ%n&#Y>8RD7q}Fz-+&@TA8Ak-uCt(alq_nvQ}1Z(T~)zESN($MW2ADYs0OXN!g2(-%98 zBu=MoaCF^?q%Z*Cc=hC4+Gn=x^g&&zGcry33eLsaz0cdL6+wuBBAK<+D3(88oZWLV zcWUk>w$nJg+dGP-!VX6EY_ZRz-OIO_oe38W_D?;hl>w}R{>&qGQS~xKXG~t5sk}eT zy}W{G-zpEn?$_A@aI4tp`_XfI5CRDi$K}*kz)w*&gxBi#!3$SWM2Q2@B=p*~OoE^# zhN{lUg8u^{c=E52EYSv|# zg2$Y`cz%{fijiGyYF!m`im0Mv}*u{SdUUUNkz`--76%n3{Kb^|wOyJCkou z{kN_&u0Pifp8T3dq5%WF%!Fz;0aa-N@L5&%e?lX&!m_0fJ^30nZU}+9dO@V&iz=be zS-v1M4;G)HD9p`U74pF$%zH)aY5pyTlK7I)QgQnW=O)#uVW#k5;_PZOjFWHzRNA4A zlZ&t4wC5*HzOt1d7WU(FTg$~rUjXMiwusTh(L<0y0JtecE~Vmsy91DVwLhq=`zuFAEoa^HX1`)>fJ zYk**uNYI3P&1A1S%f8h(sIj*K5n~Nz8LIQ(*^VoIIo*3 zNpVS%g=Ny=fjZuvFq5~|>+kB8!ls78!iKg#9r^jt&V^-VrNu4ye<~a1&Ct+nq9-d# zOWTW@#e23~qXjFgs=R*4?a4;RS-5<|Udyk|hql$!QAKR@z4?t$3!OGRS}`_UIW$Jw z>URIt(Ztr;S;}22-J#-dz?ZgSWu1yh{oj$9=xlknq=mO{IR`JB00~xM!J6$2Yc@2T zRA30~Va&>+Fm+CS4$Dm-G)tWD=hEB5-FUgwT<3YHeOWD?>vc}%*WVh&`B|G3ZauDF z$(mxtxXo`BGP|igvW&5(&O_iyq=K_H%T~!6>*JW?li8OTJd5!PIlWe2VLhHezsz=a zh;+f472&Se>{v8-Qr~^^Jwz5`q1D4I1+={=0iFtno@|ojr@LmALXlSVARV5c-4kB; z*(EE@4RTZ34ad}K1fqxfJN!93{F<--UkcU%R)i;}gf`i{d83na#%^01HkMOPk%%5G zE9(i6g?hQsw+X0mSH`CEpByiJ1+^;MyAnGXA2@FUYHH;ixn>eWb@jO=KvAH`D)sA4 z(&cv6$Lr(WX^X7|+AT3xN&ol9JF!ZxnBi5)&1{K&AH|T@Z=^TLLS2%iFX(`-%g2i% zp*6Z3{V?a?>d698V4ObSX$DHMwWfyswtJWIr!9jn5eK;KJ}hrWx=on9ku@9j;OSxs zFT=haGMvEWO#g)azoZqjR>w^(+p=Pc?e1|x+UdCZjuG99xG2(}YyqMt65M+i12`QYhtTX99h-_$uW&`S*PUmi%>6-i#j>0`kU?|dn79kbV z7wHV8&lko_PgD0tgq3=;J|E8LvF8h+Geh%BBy*&~IqW%f z58$(4k|egxQJ?)8`OJ-6+O-gTK6n)c7&qy1%Yzt^?BkeHt&czF3|)Gk8s6wzCnIDV zlal072s?x^r84a4Kb5q2A@^rPqYm6 zz)E2nv6FE*`+XcQ2ls&51?`|WA}aZ!Y+tu-SydT0s>^4(3Yj>opA6_ighIr?M)*v$ zES7y!*E5VB2hN7dvCqxT^;?EAg$RD*;~p?QuxK8Kgfw1L#64wKQY!m3-2;4s@Amc+ z|Cjyig9q(mUeCh8i8BX%eV*$%nqSOl3U4H}OmH0&W)CH_wdZ;gn5LpB7H}u3p*s6=N zkM~0kU80YR7VK&ifk0r$GHIwl00Ue5Z8C>WtYBVMJB@S8)7`+^{sl5Fju=0YtyEf` zP+wEh(Lu>yPR&)!LQD1xC^m{BF}!_dwmYi^LHmb`_4P*v^~eb^=stjhsNhW5tThS! zxQ(c;@01ilyc{dVp)JanM(cy7P6IrkicAi6(_l__k_HtMRJl#9d(e+ZWK_!y2&3Uf zmq+kOEa|HPE_S=LF{A*wUzh%tfxkui=>)KsvXWy7fBEE1%rYqMP*{W98_zU-7Ii5pV z7Borv@-nhdKK1!W&fiEdoMIh)@=qZ6n1KbItdho}ewa`gflFieORx#zpGQAB^4;z{ zljVtPYH0yi@7j5DhRc6pv0igCSMl%6Y6Otg1c|~tl{Z+v5BA*0&BrWs+cYQi)PWoM z7n9fvYNaz6Fc8tF)%%W=_Adj+mhzFU+xnUeA{)(4N*`p0@&Y{>)&kj3YCz9(a za-nd}V)l=>h7R2aNW?2mu$LiKRRm15?O1>hMD4$IbM-}S@ixrlM7*gdwa&U(uC{!Z zsN{e+kBu0LhhJ=bVG0tJATUc$<0uqz7qF>KB7x%&wnxcDh00MWAMF**mXk~OJa8R9 zw%4j`{xZ%o4Oi7Uuz6?u8|CaCfRVWh3O8Q!ZU@rK~LRcu#~1A=+bqu zO2OEu`u8~7Yp)D(SX|u@Xsd;iP&ODaLEjlw$HbxCi z1<=vnfD#YT!~C72dytiNFf}&z(K+7D?aEXn%%_gN$9pD!AiJzTov=|igLcs8y}9I_ zh^UjE{j*5rm~hSoK{+yGz+G<=ig>uD{2A|MurM|CWm`Oe$lr2rH!0b%^$%HRWz+8( z$XD1K?gC0wC6Z1~znIPQ1&&dAP&1ZkTQ>lG*zM zu~Co{G!Vv@1B3MRVK&oy8wK}PQOGp)6h8y_LypM$gN*c(@g;wtm!0`rpk?HQ$}iFc zH6+i37NNM|jiGNp9mc^uKHKLN%X+3Ly3TT8VW2neuf{E$N^iBS%`K#`VHp~Bu>C|=&lp&?I%9HX8Ie5M`buw7YN`cjN~$$E1u`xCWK3I#tjDBb5t zJt9L!(;HB2omVEOHU#b;2>kM$Nk8Ta4?su|4f;cC_e-gyKwO$ACFDgM^`hg0v++Di z?N21(%?2uJ_5vM>4kf2LAQamV=Zo;_UNC^{FMxwH~`ePEtyhI@U;6fV!t`08GEEz|2GB^MerI*cYz#?!Yubs2^E zLhVE4aRI(uos#{fjo?_c?YTy|Q+|7|#@3XN;#dgH*Af7|JU_1-{^fgp;$XFd4|4t3&w;nm1`N%6OGH9`nKD&W`gTRLSZpDY)s8x z4R+Hhye~Y&F6|n7&`$Ovj&hM;X0*FM|VgC6l~Yn^12?0!Hw%OxN5rO`Y^ zBFn?k)GMch`zIr>o!+G>sI4RXGy$=_Ur4}gRf4P>_6zw4(O$B>ptPu4ID_mkCAle= zV3Na4%BQg4Y%^iOBw-9NAQdcl}O){ALV_@9z(Re`JaJ2s8C?2A$_e{ShhlvAJxYWy)8q=8xdS++ka#D{!~iK7h&C(3rc+%b!H|G0AjxW zX6tjye33+>Z8BEpH2@$-u3#k{9*o#ng^LlUrt@gf@kMe3gwB6y)%H=ho9bp3(L?7i zIBm^F0p~}b!SEQkqh2}t$O{a{u2BFo?lTL;Q>LJk2%RK^2O;ssv<`OSHMyv9WZBPQlX_3rfBBT-~4#BrZ*HOtL>Z|Z?jFTDuV=l1 zPtA2m*w}rz0atn8WFG#e@1p)kFpz#s8c$#CkDsY!I|`}wwX`;;^Xd|#W@+rOv7zBN z8$wR+*W1;meej)S8JM-&*%S^u=~!oG%lbmU?vs4&J#H#9GB%h!R__c$-p)gb)mfhI zV(%+eQ=#H-6!U);C*m`f7ig*4K28W%9u!2cJzR+RMUS@H5Err;Zk!S}1NE)?P$2VD zO8acs?CB$$FTG-0*t?$gqxFl)EJC1b6yYwoL1H9WL%!m5TraWJ%|Pq!O2mYK0Ezy` z7HN2-gym$@OvTyR8Q+exsY-4;xiSX<3Y$d=hk*2wipn<480yO3l)RrJEbxeZc*OtG z2i51^wcjF!^-L|1p?a);7fHvl)vw~`kup$t;9c<1<0R>Up<+`Weo);V^AhB9jAeU# zn_!KQC~_j)m0cq;$DS%7i@9^b*bNDdd&cR*OHKP~leV%vJISR65M8WRV_PrSDUv9o zsxm=HG+twhd%qS`g60B$np>tpNu#f;ND{Pc-;SU5imUg;qDWD6agv>19i*RQr_edf z8{Y}GLnU;^l6`a73|zv``ANxC4CE;5-xo%Jo5JDR#YaOM+sdJvKf73~;^c$B$j=)# zY8WTp^y(YFhl@9~x(#G>On!^i4JWk(BHi7DciYSuAK8?KD6@iJNa0v07umjPq0lsd z|N0i)E^H<5ITv>$8JJT!Un9o4@MeO49+c9fP3Eq4YXYa+l$#|gsdw6XGypvzlfjJP z%(G4n7gUX%YbjQ3rX{S8UdS_;|CBol=8V>)BwOlH6YBaauWDeMfmEU|9&xGt(t+G@Y7A3v8HTXo z(Cg!b|5a!s%o+vn8wPC}%QKg$2{lk^5^T+X>~xXF*tGxt_L)qscVqp)sXtkyDnLuo z{9L7Wgi~0RQ1{6s7pr5tuZLq4N|H5MH=gTH9uYwhK8Y%O+ZNTN zxZC*6_|C2N!+?XKNvsqn7y?~YVIj{1Fo?R^96&T&P$PzTIeF?5z!-8f+QT&lk{N81 zI)2M5ONmw3lM5=k_`zl@GbS5ANF~-R18Zn!qUK@WshSiO5`vj|n4Pl;L^hzBtfuW? zDxfg?$jnS#*TCs^L_XutcAcTFZNQrO&t}qxQLD89_jC_$l0)Q)i6>61vP9$|>}fTp zU=C;4ju!hwCI|Yy>*Qr8r)0 zm$&jhM&dWDxL+C2ObmJ}GK$K~7--3KSFHTs$tE0_QV%!lxZ#M2>QJT7`R$4gi;5I? z*T))_GAdFxYNAzCB0&hL6|ocpyZ$86bn==gs3+mqDL`7!zeHylMVQXlziF4H!0VC4 z$4#Tk3$04YVGyzOih0xybx-A8U$o`~xl?p9u^SpAGs(JnA%KQe`9ld!2hyTF zb?C5`u8L|yT`FKmFl#XOzk^x2-881|53w{AzGC@-8te$Lh^>%3<+VCbkpMEq4)+J~ zrh!b8-B6A?T9FMQmxPC$5*@j%6pZxraVWgBQ7i|KNqYjaitLVW0`aPeSAzt^3;SNW zWQ~bkA4+jWwNs-Ci5;~G228^5Ijd^&<45+{Y6Yzw`H!jSy^nR7(o#5D2E2YTeol2L zUxoXVQeqU<=llE-&%5XC{qDYx`eIYt zZ7hqr%NShhO4>visGMc~5op@bb{wN<*9_NmsSY~=Fp*_A2uOPzqa?h^?Yn)pK`J(RQV`7W>O~3Pd>Pg zF{|g~Kj1wPlCGVpm75KsAY~D4pP%83B)^I+5oFh_QTf!>>4ooMPyyv$fAhHq-$&r> zmhLnS+8FFuTs2LTEoM9CDtgsV29JAOuk`u#VshQfH_i0?_TB>W_gfywrp`K zjrbEna#Z@OD>JV!BF%pgeUXkFOA3B$00C(rCBUF@CS+$L&wXVm;?EJ)$F?-h(yo-U zr!=2K5NPc6gdcTjsg*@-ej3`_&V?(812d}AvLZdtMGx<-tx;nN+eCk!u*q_wWHPT3 zQV*lkBA@T>^h$G_MBk7FwD9VTlg5%HFrDvTRg)XOBAuujRk|quRjQqJq2t&dzlX`R zDLH98O}fF(=p-Dw>SBv=8n`XO9l07xCr$qO5R^#;sM{I#Ur{mX?drz8B*$na0apee zM>mpnL84~H8bNz3-FJ!!_F&K!@=am8BjcyxV&36=1M&6G|RhvWv_*id}08>NwB8G3GH7rcezw$DjO` zsS?hYGQ=fe!r7DJNGUX~>9yJ#pcar7p7YcM42>5tOf`Wpd4tAaZB@;J5L7S6k zP;bFS--r2uohN`OHEy^ZXVFk;=Qx&m&VuaMlbQ zqZWfX_+d;HR0+z$H`f&2Qx&2PA3_ipo}OYw67vN^3Xo47TIW1L17oP1dE+Ry&RF<7b-UoKe5{kUgr9rL4`-9+U#v!f}E*}@;Bb2MAr?rablQV(c* zh`3*19Ka9(K@!txzJYMsUO={esu0A|1~4cVK2u*6e)N(PaK<7?760rl%*Zf=gz(@< zM9~~T`i5=lf?u3Fc7EQ@ob`#?W?}C`oV!XAg>~%^W1zOX89*7pJv))NHQooSnYWIz z@?W!GmEjTuvfsMq<|-Y?Kcd~sqFT8W;lYU$H7`zuN)NiN4YIBBHqRTPL|m1c%5tM( zsZ*pZT>0_^9Qm#qmb<^I$0kpI2b_`);&HmRg7;vNx(GpH#mzJ$lzivz+1kk1-WmyX z#@Ni%07joExf{bRNcXAB$sXZ)U-l7%*Fy9+kRCzCMtRQ~<{(w71Hc~T{TRa1asui_ z$Bjplmg;a`@5bSRUoOZ|m^aB?QJ3$bfKIAdnOo`MST_3{yny!yg9>(+By~oA5qu=&oapK2W|`9qUo4?E6|#33=8gKUDle3|nrV&0kcQ zJRxrJBe}wQ7FnE(pVdi>7J6s*6=eeE9CALfygFM)(FoqHLs8nMVD=PM8! zaMn+Q3)$zM7gpQhC(1z=%gl!J;GIDpp!%66^`2Cpo~mwj~?%r2JYBMe|}LUp=D%Stb44E)y6}D&856aI@RwUNbGx82}*Z1 z-kN6*2q@~eeRb#kodIpUo+P>g!)QQ{9i5n}PW@6a@S?Wvd6IF{Fqg)bQs#f`w4iWhgP_eCY$xO7z2qnLXPtCld%pbyD6uerubLitw_BguL=h<0-rE$Ya{Xn zq)A3qY3krWAnysVLUUhOglISmq511m4b--=?4F(@ArHlU#ZsHmi3Z}3RVEdaDuE}- zuujZe&P!BzA2d8tjX2k5ROx$@g}6yH6*8O9@}Fo15i<1Rf|7DgAyLr9z|V;;)Pi=> z;j1U6-S9VZe?!pH3D>=0X$Uq$6EC#s*;Xe0G|zcyt@yC(MQo$Y8KtaU!!ilhpj<;f zUvXX)`h3k7x#y(zqkGMg=-H58{Cy&B zsn|b_`R1G2kP~LZV_!-lCUC%IJ;y}Vp_QO&_9JR1Lv7rN%x)TJ2Y{d6F_3KlRZQy2F==qBiZ)KEe6V>J-GPzU-YlO38vHNY zHqCyWj`3O_XC^C=x;!!JFH>?b<4y@2X{AjaIxeuTDG|D7fw_4*e%QX2xJxt|9``z< zablB=7mdo;uN$#FK8o?&^@F%}@aOdMtlOY366- zf_>_FQL3;T?Fk+r`wWOgv$UFAVOXOq;-SOur3v(9z`FTSTMOH1f(HIUbzEd>Xp5US z^_eK%(S*boiKMZ~gg({)gX`}`4Zf!WpU?re&a0;ufKpeO14sk3r*pOhe67Ku^X2Dv z)Bl!Cih1$sF{0X)Vx>;Llt8&w!cEyOw{GR1*PXOOXQ+w!+xAvT&kI+#l~;srG7Z!) zR?c&2eB9NRZJKLdGZ*^@>b+(3qK@hUuinrbXQI=R_>eq*2f!-`q_;K4$+h%Hc|A-{ zp0&z4E#%P1j99utgJ!c;vS=<bd{t9xa&JV$9{B98c)c&c2q-P8x zCHC#Itv)-EBU?o*2;oWA5~Z2^`%w*q6#NUO1D$%!As zpsdwp>vMd%>MP(E4xCp@X-}N-@d1;6B>oocp;d}VbK|BmF8pr?~$B0J`g+ literal 0 HcmV?d00001 diff --git a/crowdsec-docs/static/img/blaas/logo-remediationcomponent.png b/crowdsec-docs/static/img/blaas/logo-remediationcomponent.png new file mode 100644 index 0000000000000000000000000000000000000000..468cf5f4fb2686a287772a4dcd0bab1d1245622f GIT binary patch literal 20632 zcmeFYRa9Kv6FrD)upk}Wf&_PWcL)&NH67gDB{&3kmjJAGTKg1P)wBneW2Zogk7PaR0L%uMAh9h&$51cVQb#qZ@!ykH4IzS4O8pJ zuN&4bD^ejNW2S#8zTXh1&AZ?5Vl|4g`M`DFz9q&w-fprMZL?;h_gP-;Hv3oCr=yAQ z90b}myg7#g&u0H16IuNCzK3hB=kM%fNP$|H@0nT9aH77kxg2CjVo*iUqL?tWXh?yW zB482BU?@4*Kr%QL0!%n^{~3QWB8_N!rODxV56BiM}Vea0M^MxMy9@#7NX;QdBnYqd6E;v2J4I!~YtL#~!r3wT?FW ziT>He8Il#Bc56j3##ZNN7pOGIL&YAZlgn|#>b`+VtZlS_)6HcQ_T$GK50yOXp+5WQ zSXka6WzTh1JiY`Y(BG%qTjI!r3~tHlZ}ehTIe+=7VX+N0nqR{295L+tX;Sk&jjvb0E2ek^tv=B3V4SU!vn z7(TvMXa@UrnFRmXMA^}+UQ!CTyczgtr)y*KV?GM7rlBuwI^j}Ct~5n$_fAQ_zB2wQ z`qewZZ)J~DgPj;E)a!BIIx_>c9=$P%yQa>kN#5PuoBeMI zr(v;k<=vSq*s!n1@2{m%cC>v9i%rb*)91iLRQ;xnyPGtK-MC@asQ z^ZeeI222aBauB3#6F|5qJ#0O1W5dThIS23bIw% zK>d{Gqa4cv4NM4X)N#Y0R702SuWH4DXM(NWBJolRZG#ZZ2T!I9E{Wk~Qh26;HeO#1 zcGuG(G|mXN3=I*S)ygJ3Z}XK5$#( zeBnYRI--kODNCFIOi>=j)YMe7Z^bQB`|793_#LUE!jISy6~(hQY54OqrQPr!H>4XG zb&2Mdk22AA!%Y6`h?CQ%lc{c_=%>chmT%D!4afMw{=$>~FptmGo%zMzsHh*am)*&V ztXDq!{uRP4~OFWZmcB>bstE{9A_3HLX<@*dB(A5rCq zpKVv{eNG{YyhkF+h_!pCsuI?)z{FGxHW=Ey@>g9iq7FUYnq(rA*v-CMs8K&+zQ2y_ zJKHNP{6SAi7_yEFeL}ZPp)er?T+M$ZBKgtD%mZz!Ww2jIyZKK<0HNc(Qvc1DlxZtS z6<}3pz`_wBV3xX?0;Z3qOuRh|DUvdJ%QJzdXg(hR9uC}oZJ*sDHqNzTTT~(M zB>it{QKR(82wgt@s6lgo(!|KZ?rj_9plKG!tYRW8hJVWs+fObqSl z+a1wJt4r-f%n;m_lk|wJ8~yMVNiOJzeY9Kips2TI)~;>dw940C@M_dLo2L-x4Bl~W zuHvb@LzPQ)dQIH1d8!^izH_E323oYTE_VFRBiJ`6sea#X&T?V0$?H)14t!HR~Wi$ehBT)J_l(1Tx>tCBwim&zD@1zu-3MbT#hBQ$?E--+wP0hvQnW-G-}Jp7B?gO z^SAbq?A4;DIK}KOpL?Z{mt04-?ez1LpiN(m15rD+G^-Cpm1U~fi3ncX1hyx=8-5zn ziljA(Uye8OAz#IF2>nmN>?O|&>g58ThLfM~7@XoPD(TeMb=!7;E)geLO63j83dqp7 z_2%1UwPdnqGa3cCOd!pPtLDea$j^{qkDASNsP+#o7guyaGe#i2U45USRtuNJhj_xfAq&H>&fpt9?CR(PCj6m5 zXUK!@w5l(@ghIF*SEbBJvdtlli**E&^6TTFj*W#;-e5LDT*Hp~S;F4Ww)D@8cX;9=^jlDb_E(`(>y~mqn9~ zWbe1JWl5}Ho7u<&n$rTQLBrlmOKE`anu#lh;)*cjE-!$()#Y;Vp*<+5p+#Sd-Dz^i zP*Z7>&1(&M(fFKA_i72NWcz8;!gi(A{jtbpR;)2rX^H#cuA7vUh#1QC@DfAz*)L*) z^JV40;k^9tRJYc9K5875<}6#_X=x}gzfr43;4}Soe-mt#9pE>${g(K&!5=Xyk2(Ts zJ75AY%93ckX_brYa6O>qg2a|omA`<0qo=%ZPBvOhH`1h6B<1J7#V(?Z7Z)};95~l@ zvViAm&QLX;?Xu%Mb|O(?I~(=h63){jC6qjMes1c{XOk9_zS9|vHr>`OPTKQx^icRb zq<~E^>@w@n3A{Is-n(uII=Rh@H~%yFq!-npkdpA5dEdmZ^Kwh(%%;UFEWC+UibLJ}}Sk!hjS$4P~8_BfEK<)STVi5&IK@M1=us|%Di@=&mFxHEJ;|8&S+63aMMKHE zm`wPc)f4Z_`iT+u^~<9se)-k~03Yfs^{^5`#XB(%uKgORsnO)|;M0i^dq$`dLf+s# z(M%+V@JN#4Lx20ZxQ%1>=W@^nckoK(y9R2$obpMbl8R6}F(x!7ST(^bLF=9}-O)Gf zpuFsCtfPdJoew56+j|Bz8WIe|w0y$Pw!?JIU7JIU7sR3VN(h)1*$nV;hbzP*syRPP znrTr8c}=o&8giY~L`g&lnUWPR`eFGXJ*9iVKML`xyUnA{S%!Z?wccjsGmluRYSJOs z(1|k(Ug~}Av4T3gzQTFJ@wRFZ+EdP5^AX?N z%{ky}_Py~@A;6)i`MvGI->I~jX7TTWi8;C@?X}Q=r*UJDUQvv|mGP8v@pBB@CD8-J)TR1d z$dAd`WaU++9nMVdthLd4vo@qwvdQ2y;v*}u_dtW7S77xe@(pvBmVW+38@Q~tEhx(8 zwMlO^IAMNVPAo;;_G2eJ24;97{`P02E-~x<@NbQDABpiw;wZ*BDrLxlF=&p3Zim!c zI^3yDQWywqKqRw1X0jre)@O}X9{%w8>U*r_o+0OH*>@8~0u}y0nFu<2f zGs(^VND}oUfy6k;v;`_9NIoUP+&8Lxup*;J%(0_g1s9*q@2~Ez!*IfXlM7xHz#G7s zuUr7k95n5q)ybtQMlkR}c=m{fFY`;UUehs4jkKw}z^Qix-li~PR;{@6XBTM!N#sc4 zv@y;y5ZR}Dp5OP!qVN9&RfPkcTPxQkL~rTR?%(LTTvGDC#h?CF;cSLPJXZAuQgqZs zMZ7F!m$>h}T_9J|3@20}CJ++xqfw`jKg0rU`B);Hx2ePbcTQ+GKtABU<+UVbM7;EI z+z&W-180#|*OF7`xP~_>wNutj&@ylQPQ5LHF~p%(*+lHu5rUpR1@3k8NDJnbCACdj zz&!t3f9FSFjz1R{s{7B?$KL1OZkk0#IeeZzR)WIM>U20w%X@Bu-iE$O>v;S<_)sGm zp`m#4{?rrx%)l;S8)YfwnH0w-J?&;$rvE*#kZn0bK?r0b46Ofl&H+}VOsP>oRb4FX zhXK>mf!OxX3wid$t_`Pc@se^k;||5ISu<0}!e2)H?uOsPC$yFBz&6ta!R}KfM5@kG z0hj{>pSf)*9Dy?;?1s&^mG1tU5lYjWy|9FZxiYKNh*llRvP;{JS78Cc{IT<|ZMsDE z?k>r{wg9V^5)7ZoukfF4?F7a~0DPX|WbwA-t*fvRcLh2B)$;K?>^L8#sMB zBsJFDDw)2D9#{zo6A8x)K!Iyty|7nSUA!$l?rWT5SQ_>MgUUtT5sO5T^XM!uK_~Sp+7akzeB8`_~_v&fK}` zqUd~DeX?RzZ$OHJ$mqVZA~~xu7hwL_P@;dndN**6uXFa8cS8`N)X6PB`OfZm7zU4B z0fAXMQv1@vly1kIztiE8$pKilT@~wzofa*^$VH=3^GoBFn?iuH-RBf78!$B?>&==% zV~{-cg&w=r?j3x&@=MFs&I-OJmlDz%8^uEC&n-79r^T3u z#MS+8u{o|T?SFr$6y$A@CVZ54wT_I8W)g5XO+I0{U*1LklUcJr#2o3vtrUEh(_}Xl z4J%A_N{G{8nz-0fikQr#%W2B)Z1Z_Xv;(u&_|VA-et!1{1yK$9Ra%Ho7iS4?iOCJ6 z3W0T~UpnF&o%bs7!?c(CkWmzeuwRV&o))|-W%G@c>Tuyd0|4?cXn%6QdN_l6{{tEN z$@&!ow$hxG-y8dF`mYqfa1|2+hh0?poD{RJ&3uGP^8TqIw{gGNrs+&FD!-h^yvb^3 zAb{;)3e0CTb@Y1|UCt`_s_y9pgud{;gKMVgnBVHU4}G$l8tp84%1Z8}?R$%*#!Imq zzX`OI<#i5-==Z# zD%w2QNs|4jym2&%y8cd?SaScYzxd~Y*!c>{U~}(OZdOwi9EUMk$XNHs4>;h<1%*fW zZbK$ROZo9Cvd&%g7`!u9huF(4&zt_*N=*#E3pL+p) z5cv4aApeKi6uT6`|!Bd^sB@- zt>N{w%%c$<-FxqinKmE-^_`aI8oZWm?1fjAD(sN+a?KV>sJx%L?dtw-PhTIJ`Pn(3 zswQM`UulF)Py`%@xQ?){IeMYHyMGT-q#&v{65qvl@LXAAn@@nlpH1H9&lPu z4{LR!%dHT@&fs5F{ueExL6&un7#Qj)*ztX@`kMJ9aPYQCTJVs0#{}ifqs1@yvN}pJXsQDA?oKM>cGHt+-X>3!pfcfNER}0LTsnl229Qji!@jhT6@SAsWO$;sF zhp!=bvOz={!h@twIC0TaaeDnRu+G>m?N7ENqv;su%53`8PF^nw1lI`#BzSYNBu9BX zhf_)Z5@luCN@;t$5Y>+f2$#1C-4<9GK(is3WgHL0^5E}xK6b;2>#hqH-_K^yNIK3e zC)Wb3|2CfN{RyHVcu^^*x@l1(RZn9I3#a@0V&#;8&;m7b&f^lVygJJy(|5fCiyvZd zu&mEe7{DSkCK&GEjCSOg%P|yaH~e|PfBvDf#%Wrv|Mrv65NKk3bl5lEz5P3|55ws# z6+83iRi;Y9!hL^Ri#c4J!|m|?Ju035I0Kax=@KDDG1#gf5sOW&O+d(BqHvSkhH??zr*Fr1!xFH+}8zFxT_pcHU#3bPyM~g-qxU>tA3b=zP_a z86xB#T*ENPMkEv8mqg|f5`wmVKO$3=&9z_423``dv#9`yc9dRXJh}!Rlg|Lt4JznI zSDSt6^mTvy2>;FFc|pq_&U524Kt=3$Hco?PRm&CR9G^AP6cv$LKBwXDMK8fWx>WWC zyI>E??$M5gFGkvURz5nt*lp07e==^yGF!4PoE>BGD!IKe=ZO(^xJhOMH#L|Gc({nq zsKBo0X-K-e09Hhsm6d!Yt+|@_^xLB|O|w@HQi8srWU#9R`y}2}^@v?Xp`xJS^b0i^ zBCkKRw^k_=Fz?r3fMBTfDod$Jl?-158eU($_M9lT1HWKb@O;4@^s?C`a9XAzuDucP zQfR90PXu_rlWeN9;`}zr7FaQ+wCxfnWgjJXe&dVlvwqk1drjO#1i~!>wLYaRZPqMr zyvWpw7tUZFTK5x+v>S|V$~Hecle2`o>`on)$&vJasz@0AmEm90bo4q3Bk?)X=u-xU zo5n8Nvvabbh{$Y3%s^}vwONF;zdA_JZ^7)vA`FGkWD>e8VCDA4exd0tVaIRe4eh3T zytHTy-SuXeh{OUC=x#W5^eMxl*doluqmVCSnFn4^>T>g@#%#3(;&v`noII4to0izQ zZ0yA-tOs=TVvQk-0_Bz$pj%XNIiCweVQS5p3|K;R z{vLn#*Ke~oJazpqAX8T+TQENU@(}OhEXDTh_IN@7IL{NH~sy-tA&$G zAu@{Sn51>poAQr6pM_8S+I@tU|BMkK06k5-OVB%oTcYDy<1e~83S(TemKf#a)2W-V zl36nFhooCse_fxuRTvNvGV)1agagMR(jvqq|LZn@kdboJ;Gn;BxB;pl}oWOAjy)9(K3@XK#c`#OS)izZAk*CxymOSwcrcC5IN} z;xgU&X5ynio0+DGHsFF-uBj7_&8_E61noc2=I8-=s7d);o0z0cnf2yoXqU}-rX~He zx=VIK>I&eFBn*J+4I*w~M=)B?^Nq2uE#LQ4PM-f9 zpHz$$WeMY3ak7mpjQ5~)o}c^wou7}`zy0iDnwXfo!#jA_}2zt9MXg+C@SOZ$2zH=U z9=GRja~_#kkJS8pO89aU(O(=6V#l!~{C*`vV*+f_RU`V>eTk6M8?W-=!}cGO7^BQD zb&$2e*frrVj_(iu`a1(GMK?dmTV~CA`jvLp1XL(+u?&bJLWrKj%wf|6ur>B1F_l0g<`{; zuAf)=f*od-Z=jXOjRF;Ky46tL`RSYiiOBlKL}A4gVXyI=*L%_48qH(LJ1iB{-Q`$` z3iWu(I|JV3PQO-fJMVG(qb52Kos4f47CifD_ybsZS05W3&yq;_V&A*JSGi<+G+xh< z=DcqTt9;>qh*72M87WOD-oDrJ$S7v^Dv=jZn=TlTi&RWo_x}M9aWbEU9tL}=US6LecXB1P}T>k4ykZD!Tce3uDU=e$Qg9boo?M=VbCA;p{;gN9i=D&s0Wn zlZBV7cKFrzTGmREM!O_>519>2tZZiD+U=hguBnB_%R5ed#5P;BK5^>yo_roSda&R+ zm!ov~95)iTqpwIz`T+$G=)2RY3N%@#Kdk=M#wwNF`WiX_cQ8tC5~@|G?I8SD?RyC2 z=KL7W!;kh(9Et6*9OqxN%jvD_;ZF6cw!FB{A=}Gs1#|apC5+miw2Y%3zGKIt5Lzg9 zQe<8ES8=Bm8m|=g?wbeli^yiD44c_`{7bdLeaax@w0x()>FIwjI6vR!H?(FnuH{;$ zMPt&7R9{5?g&`NDKlLTSrmS@=sOaF!o(J-4Sh?`!Q_A4Xk*iPc_dc_yVnV%{mHhe^ zul$mVXGSs4vYrod@#BO=cj1I*r;Ub{?6SR|76mcRLERW>b49A8cUR@i>!GHtF!~{) z$%u&KY+cEQ4T>I=!mN*!VE}Qk1i$%BzTbzk@f@LJVxBs+s0-%_b!O{5Az&f(HTT1MK3zg=gkBaOHA>Ye)>Jko>jD<6naXK(a7sg7V+`0n+!;)zC(T;55Wa zsUZKIviw}i+nV4z1X&FSr6T`iCC;)gRq*|@uLh^CGYZqtWO=;{Vf-=IW$XI-4AgmV zDRvJT{i3_H^~awb?2(IU7oehI#zzOcNQS;PG+bn?3(35`YEyITFLQ&(D6stBB7UD?+b4rf3H<} zDP(deUjy6bvG8eCHxDyaI=FvD;egLUdE2z|oH|>1pG<{dt`7o*Z8DP)HN0&6h+SC< zr4zzrAw;uhR_Xh1N|SiPkax3{#9IBa^lX3)g-@~bi!NSV4JtxHJt7QjlVVQ8?Ho_K3s%J zmhsa6sXkaCrT5Yfu!uh&O`qdIm9Jx7Ec%F!Ff@S7>+w z^b_;HwyC}95}5?pL3i6&C*Z%Rb_>CF`PChBp0s3;WI3ktyv~BERMe&=CKQk zJ|bX|21GnXS+&vY!}JW9rE%j*B9Ys%orNssz<2&5&K)@s9|L$kv`50frI7cj`vcbH z3=zdKMkit)(?lVexo4x9WWp#K4c@Py(DzfN%nXRZZQ&74%ZHmR{Ez53xX)+_Z-jYp zT{9Y5>ytl@6;s9Z<6ti-?gD0V31&>=e&DOwL!Ey!V8Y#5p0>~ojE(1DGCib^=ekl%(mX&$ewT1_}RHf|elBh~?WRh9H(G&vDU^ zsr_pm4DbW2X3qZU;{RSjG}xR&ZOQc`k>TU3?FyeE@Jie_$Ay9w<8Wn!cUwi5~VD_S2Ge;A%*mOXV4TZH6gf9DGZq4 zJK0;@Bn1YASV`9eDh!Bt3BJI&BLgz^kk4TI_w7|1fH>T4o5i7$D9)pJtMuj7b2=gk z;z)Zt@VrWA?L!B4TL2^9I^hiFbI1|gPe3%1MS&)cm_u|qFI7In;u$82e1aPH=i{Wmqa{4KW=@C%r>j%Cq0XN!u!3Q#^xDBK}mxA`Y;u?{Bx zkdQ)xz07o*j8PGYq5!`EQIJF#np_Zy{Vg|91**}?wcX`kmQ%ky6~_yCSk@1P!C7vd zwk!kHDm8E|rW{)7LLSj|R-%5eMWXPZCmhtSgFN1Un5DpR( zyfT3X;iMj9{^md$^sD(KtfBbdIcynXGl!mp;0HS61?fNFH0c5wfi>;+mfyyZ++D|H z-n8Yw=8{{_-N2#L$!}laAd26W!sUYQM(+Fk=l+vioJzeEQr9cEX{XlA(o_Vt3O2kt zTl4FOlJ*xg$SmCqOXmpTN=ZTXu*z`6+_Y$FIrN^QE`GbZeuHQNa0j)j;+KbNgUPG` zW=HZ|P>_9VPtVha-o?#zF7~Exvq1nyQ}l|a?lTUX!e&Of6nT?#c6>a-_+xAnUe7O& z|MeeY$6VMW?3~LX5L>2nhq5kMH_r3cflos39ep03=~yr`~OMg>@z;P&aFr zVd08ZF9NOx0a;ifh~l8E_&o*bodeq%QyGYo6A1GnX`@hg>x+bSb#x!-Yy{Y|q$q8y z&GVhC#Drmsx(%9WYS5kWE89OM9}-+|xoR?%+{Z8h(BZDNikp5Go@FXA*qyxhZqRe) zvDrDhIv>?YVVl!(F~k>ME~vel3Pc29)AOt`_g_TTzc-b(y@}y?xp_6{Z!uzvy&jG; zuKX91we$P7`kW2PlodRfsfYUnqD8yw*}HJa!O^d{(LmL}t%pF)6l7zS z$zZdHzFS7~j3-DkO{*Xa^NNAS?oc85 zhh6K(KUOW3?p=O!e0cj8x1){B{`{6PZet^+Kv!e>=g(5TB`Tj;`oe{@f!f6>%CsL~ z98`cP0kT`iEk@0>T7F*iYn6Zhf?u={vn{#zN_t^CRHZ=*8V1yve&dCVY7{Xk*7o>t z;LEo_t07m{XoxW2S|LjwQ?BWEJEMl933ll_SbK-_E$E$FEMT7N^+gTz)arRQb`tT1 zv_M!CJ%n&#Y>8RD7q}Fz-+&@TA8Ak-uCt(alq_nvQ}1Z(T~)zESN($MW2ADYs0OXN!g2(-%98 zBu=MoaCF^?q%Z*Cc=hC4+Gn=x^g&&zGcry33eLsaz0cdL6+wuBBAK<+D3(88oZWLV zcWUk>w$nJg+dGP-!VX6EY_ZRz-OIO_oe38W_D?;hl>w}R{>&qGQS~xKXG~t5sk}eT zy}W{G-zpEn?$_A@aI4tp`_XfI5CRDi$K}*kz)w*&gxBi#!3$SWM2Q2@B=p*~OoE^# zhN{lUg8u^{c=E52EYSv|# zg2$Y`cz%{fijiGyYF!m`im0Mv}*u{SdUUUNkz`--76%n3{Kb^|wOyJCkou z{kN_&u0Pifp8T3dq5%WF%!Fz;0aa-N@L5&%e?lX&!m_0fJ^30nZU}+9dO@V&iz=be zS-v1M4;G)HD9p`U74pF$%zH)aY5pyTlK7I)QgQnW=O)#uVW#k5;_PZOjFWHzRNA4A zlZ&t4wC5*HzOt1d7WU(FTg$~rUjXMiwusTh(L<0y0JtecE~Vmsy91DVwLhq=`zuFAEoa^HX1`)>fJ zYk**uNYI3P&1A1S%f8h(sIj*K5n~Nz8LIQ(*^VoIIo*3 zNpVS%g=Ny=fjZuvFq5~|>+kB8!ls78!iKg#9r^jt&V^-VrNu4ye<~a1&Ct+nq9-d# zOWTW@#e23~qXjFgs=R*4?a4;RS-5<|Udyk|hql$!QAKR@z4?t$3!OGRS}`_UIW$Jw z>URIt(Ztr;S;}22-J#-dz?ZgSWu1yh{oj$9=xlknq=mO{IR`JB00~xM!J6$2Yc@2T zRA30~Va&>+Fm+CS4$Dm-G)tWD=hEB5-FUgwT<3YHeOWD?>vc}%*WVh&`B|G3ZauDF z$(mxtxXo`BGP|igvW&5(&O_iyq=K_H%T~!6>*JW?li8OTJd5!PIlWe2VLhHezsz=a zh;+f472&Se>{v8-Qr~^^Jwz5`q1D4I1+={=0iFtno@|ojr@LmALXlSVARV5c-4kB; z*(EE@4RTZ34ad}K1fqxfJN!93{F<--UkcU%R)i;}gf`i{d83na#%^01HkMOPk%%5G zE9(i6g?hQsw+X0mSH`CEpByiJ1+^;MyAnGXA2@FUYHH;ixn>eWb@jO=KvAH`D)sA4 z(&cv6$Lr(WX^X7|+AT3xN&ol9JF!ZxnBi5)&1{K&AH|T@Z=^TLLS2%iFX(`-%g2i% zp*6Z3{V?a?>d698V4ObSX$DHMwWfyswtJWIr!9jn5eK;KJ}hrWx=on9ku@9j;OSxs zFT=haGMvEWO#g)azoZqjR>w^(+p=Pc?e1|x+UdCZjuG99xG2(}YyqMt65M+i12`QYhtTX99h-_$uW&`S*PUmi%>6-i#j>0`kU?|dn79kbV z7wHV8&lko_PgD0tgq3=;J|E8LvF8h+Geh%BBy*&~IqW%f z58$(4k|egxQJ?)8`OJ-6+O-gTK6n)c7&qy1%Yzt^?BkeHt&czF3|)Gk8s6wzCnIDV zlal072s?x^r84a4Kb5q2A@^rPqYm6 zz)E2nv6FE*`+XcQ2ls&51?`|WA}aZ!Y+tu-SydT0s>^4(3Yj>opA6_ighIr?M)*v$ zES7y!*E5VB2hN7dvCqxT^;?EAg$RD*;~p?QuxK8Kgfw1L#64wKQY!m3-2;4s@Amc+ z|Cjyig9q(mUeCh8i8BX%eV*$%nqSOl3U4H}OmH0&W)CH_wdZ;gn5LpB7H}u3p*s6=N zkM~0kU80YR7VK&ifk0r$GHIwl00Ue5Z8C>WtYBVMJB@S8)7`+^{sl5Fju=0YtyEf` zP+wEh(Lu>yPR&)!LQD1xC^m{BF}!_dwmYi^LHmb`_4P*v^~eb^=stjhsNhW5tThS! zxQ(c;@01ilyc{dVp)JanM(cy7P6IrkicAi6(_l__k_HtMRJl#9d(e+ZWK_!y2&3Uf zmq+kOEa|HPE_S=LF{A*wUzh%tfxkui=>)KsvXWy7fBEE1%rYqMP*{W98_zU-7Ii5pV z7Borv@-nhdKK1!W&fiEdoMIh)@=qZ6n1KbItdho}ewa`gflFieORx#zpGQAB^4;z{ zljVtPYH0yi@7j5DhRc6pv0igCSMl%6Y6Otg1c|~tl{Z+v5BA*0&BrWs+cYQi)PWoM z7n9fvYNaz6Fc8tF)%%W=_Adj+mhzFU+xnUeA{)(4N*`p0@&Y{>)&kj3YCz9(a za-nd}V)l=>h7R2aNW?2mu$LiKRRm15?O1>hMD4$IbM-}S@ixrlM7*gdwa&U(uC{!Z zsN{e+kBu0LhhJ=bVG0tJATUc$<0uqz7qF>KB7x%&wnxcDh00MWAMF**mXk~OJa8R9 zw%4j`{xZ%o4Oi7Uuz6?u8|CaCfRVWh3O8Q!ZU@rK~LRcu#~1A=+bqu zO2OEu`u8~7Yp)D(SX|u@Xsd;iP&ODaLEjlw$HbxCi z1<=vnfD#YT!~C72dytiNFf}&z(K+7D?aEXn%%_gN$9pD!AiJzTov=|igLcs8y}9I_ zh^UjE{j*5rm~hSoK{+yGz+G<=ig>uD{2A|MurM|CWm`Oe$lr2rH!0b%^$%HRWz+8( z$XD1K?gC0wC6Z1~znIPQ1&&dAP&1ZkTQ>lG*zM zu~Co{G!Vv@1B3MRVK&oy8wK}PQOGp)6h8y_LypM$gN*c(@g;wtm!0`rpk?HQ$}iFc zH6+i37NNM|jiGNp9mc^uKHKLN%X+3Ly3TT8VW2neuf{E$N^iBS%`K#`VHp~Bu>C|=&lp&?I%9HX8Ie5M`buw7YN`cjN~$$E1u`xCWK3I#tjDBb5t zJt9L!(;HB2omVEOHU#b;2>kM$Nk8Ta4?su|4f;cC_e-gyKwO$ACFDgM^`hg0v++Di z?N21(%?2uJ_5vM>4kf2LAQamV=Zo;_UNC^{FMxwH~`ePEtyhI@U;6fV!t`08GEEz|2GB^MerI*cYz#?!Yubs2^E zLhVE4aRI(uos#{fjo?_c?YTy|Q+|7|#@3XN;#dgH*Af7|JU_1-{^fgp;$XFd4|4t3&w;nm1`N%6OGH9`nKD&W`gTRLSZpDY)s8x z4R+Hhye~Y&F6|n7&`$Ovj&hM;X0*FM|VgC6l~Yn^12?0!Hw%OxN5rO`Y^ zBFn?k)GMch`zIr>o!+G>sI4RXGy$=_Ur4}gRf4P>_6zw4(O$B>ptPu4ID_mkCAle= zV3Na4%BQg4Y%^iOBw-9NAQdcl}O){ALV_@9z(Re`JaJ2s8C?2A$_e{ShhlvAJxYWy)8q=8xdS++ka#D{!~iK7h&C(3rc+%b!H|G0AjxW zX6tjye33+>Z8BEpH2@$-u3#k{9*o#ng^LlUrt@gf@kMe3gwB6y)%H=ho9bp3(L?7i zIBm^F0p~}b!SEQkqh2}t$O{a{u2BFo?lTL;Q>LJk2%RK^2O;ssv<`OSHMyv9WZBPQlX_3rfBBT-~4#BrZ*HOtL>Z|Z?jFTDuV=l1 zPtA2m*w}rz0atn8WFG#e@1p)kFpz#s8c$#CkDsY!I|`}wwX`;;^Xd|#W@+rOv7zBN z8$wR+*W1;meej)S8JM-&*%S^u=~!oG%lbmU?vs4&J#H#9GB%h!R__c$-p)gb)mfhI zV(%+eQ=#H-6!U);C*m`f7ig*4K28W%9u!2cJzR+RMUS@H5Err;Zk!S}1NE)?P$2VD zO8acs?CB$$FTG-0*t?$gqxFl)EJC1b6yYwoL1H9WL%!m5TraWJ%|Pq!O2mYK0Ezy` z7HN2-gym$@OvTyR8Q+exsY-4;xiSX<3Y$d=hk*2wipn<480yO3l)RrJEbxeZc*OtG z2i51^wcjF!^-L|1p?a);7fHvl)vw~`kup$t;9c<1<0R>Up<+`Weo);V^AhB9jAeU# zn_!KQC~_j)m0cq;$DS%7i@9^b*bNDdd&cR*OHKP~leV%vJISR65M8WRV_PrSDUv9o zsxm=HG+twhd%qS`g60B$np>tpNu#f;ND{Pc-;SU5imUg;qDWD6agv>19i*RQr_edf z8{Y}GLnU;^l6`a73|zv``ANxC4CE;5-xo%Jo5JDR#YaOM+sdJvKf73~;^c$B$j=)# zY8WTp^y(YFhl@9~x(#G>On!^i4JWk(BHi7DciYSuAK8?KD6@iJNa0v07umjPq0lsd z|N0i)E^H<5ITv>$8JJT!Un9o4@MeO49+c9fP3Eq4YXYa+l$#|gsdw6XGypvzlfjJP z%(G4n7gUX%YbjQ3rX{S8UdS_;|CBol=8V>)BwOlH6YBaauWDeMfmEU|9&xGt(t+G@Y7A3v8HTXo z(Cg!b|5a!s%o+vn8wPC}%QKg$2{lk^5^T+X>~xXF*tGxt_L)qscVqp)sXtkyDnLuo z{9L7Wgi~0RQ1{6s7pr5tuZLq4N|H5MH=gTH9uYwhK8Y%O+ZNTN zxZC*6_|C2N!+?XKNvsqn7y?~YVIj{1Fo?R^96&T&P$PzTIeF?5z!-8f+QT&lk{N81 zI)2M5ONmw3lM5=k_`zl@GbS5ANF~-R18Zn!qUK@WshSiO5`vj|n4Pl;L^hzBtfuW? zDxfg?$jnS#*TCs^L_XutcAcTFZNQrO&t}qxQLD89_jC_$l0)Q)i6>61vP9$|>}fTp zU=C;4ju!hwCI|Yy>*Qr8r)0 zm$&jhM&dWDxL+C2ObmJ}GK$K~7--3KSFHTs$tE0_QV%!lxZ#M2>QJT7`R$4gi;5I? z*T))_GAdFxYNAzCB0&hL6|ocpyZ$86bn==gs3+mqDL`7!zeHylMVQXlziF4H!0VC4 z$4#Tk3$04YVGyzOih0xybx-A8U$o`~xl?p9u^SpAGs(JnA%KQe`9ld!2hyTF zb?C5`u8L|yT`FKmFl#XOzk^x2-881|53w{AzGC@-8te$Lh^>%3<+VCbkpMEq4)+J~ zrh!b8-B6A?T9FMQmxPC$5*@j%6pZxraVWgBQ7i|KNqYjaitLVW0`aPeSAzt^3;SNW zWQ~bkA4+jWwNs-Ci5;~G228^5Ijd^&<45+{Y6Yzw`H!jSy^nR7(o#5D2E2YTeol2L zUxoXVQeqU<=llE-&%5XC{qDYx`eIYt zZ7hqr%NShhO4>visGMc~5op@bb{wN<*9_NmsSY~=Fp*_A2uOPzqa?h^?Yn)pK`J(RQV`7W>O~3Pd>Pg zF{|g~Kj1wPlCGVpm75KsAY~D4pP%83B)^I+5oFh_QTf!>>4ooMPyyv$fAhHq-$&r> zmhLnS+8FFuTs2LTEoM9CDtgsV29JAOuk`u#VshQfH_i0?_TB>W_gfywrp`K zjrbEna#Z@OD>JV!BF%pgeUXkFOA3B$00C(rCBUF@CS+$L&wXVm;?EJ)$F?-h(yo-U zr!=2K5NPc6gdcTjsg*@-ej3`_&V?(812d}AvLZdtMGx<-tx;nN+eCk!u*q_wWHPT3 zQV*lkBA@T>^h$G_MBk7FwD9VTlg5%HFrDvTRg)XOBAuujRk|quRjQqJq2t&dzlX`R zDLH98O}fF(=p-Dw>SBv=8n`XO9l07xCr$qO5R^#;sM{I#Ur{mX?drz8B*$na0apee zM>mpnL84~H8bNz3-FJ!!_F&K!@=am8BjcyxV&36=1M&6G|RhvWv_*id}08>NwB8G3GH7rcezw$DjO` zsS?hYGQ=fe!r7DJNGUX~>9yJ#pcar7p7YcM42>5tOf`Wpd4tAaZB@;J5L7S6k zP;bFS--r2uohN`OHEy^ZXVFk;=Qx&m&VuaMlbQ zqZWfX_+d;HR0+z$H`f&2Qx&2PA3_ipo}OYw67vN^3Xo47TIW1L17oP1dE+Ry&RF<7b-UoKe5{kUgr9rL4`-9+U#v!f}E*}@;Bb2MAr?rablQV(c* zh`3*19Ka9(K@!txzJYMsUO={esu0A|1~4cVK2u*6e)N(PaK<7?760rl%*Zf=gz(@< zM9~~T`i5=lf?u3Fc7EQ@ob`#?W?}C`oV!XAg>~%^W1zOX89*7pJv))NHQooSnYWIz z@?W!GmEjTuvfsMq<|-Y?Kcd~sqFT8W;lYU$H7`zuN)NiN4YIBBHqRTPL|m1c%5tM( zsZ*pZT>0_^9Qm#qmb<^I$0kpI2b_`);&HmRg7;vNx(GpH#mzJ$lzivz+1kk1-WmyX z#@Ni%07joExf{bRNcXAB$sXZ)U-l7%*Fy9+kRCzCMtRQ~<{(w71Hc~T{TRa1asui_ z$Bjplmg;a`@5bSRUoOZ|m^aB?QJ3$bfKIAdnOo`MST_3{yny!yg9>(+By~oA5qu=&oapK2W|`9qUo4?E6|#33=8gKUDle3|nrV&0kcQ zJRxrJBe}wQ7FnE(pVdi>7J6s*6=eeE9CALfygFM)(FoqHLs8nMVD=PM8! zaMn+Q3)$zM7gpQhC(1z=%gl!J;GIDpp!%66^`2Cpo~mwj~?%r2JYBMe|}LUp=D%Stb44E)y6}D&856aI@RwUNbGx82}*Z1 z-kN6*2q@~eeRb#kodIpUo+P>g!)QQ{9i5n}PW@6a@S?Wvd6IF{Fqg)bQs#f`w4iWhgP_eCY$xO7z2qnLXPtCld%pbyD6uerubLitw_BguL=h<0-rE$Ya{Xn zq)A3qY3krWAnysVLUUhOglISmq511m4b--=?4F(@ArHlU#ZsHmi3Z}3RVEdaDuE}- zuujZe&P!BzA2d8tjX2k5ROx$@g}6yH6*8O9@}Fo15i<1Rf|7DgAyLr9z|V;;)Pi=> z;j1U6-S9VZe?!pH3D>=0X$Uq$6EC#s*;Xe0G|zcyt@yC(MQo$Y8KtaU!!ilhpj<;f zUvXX)`h3k7x#y(zqkGMg=-H58{Cy&B zsn|b_`R1G2kP~LZV_!-lCUC%IJ;y}Vp_QO&_9JR1Lv7rN%x)TJ2Y{d6F_3KlRZQy2F==qBiZ)KEe6V>J-GPzU-YlO38vHNY zHqCyWj`3O_XC^C=x;!!JFH>?b<4y@2X{AjaIxeuTDG|D7fw_4*e%QX2xJxt|9``z< zablB=7mdo;uN$#FK8o?&^@F%}@aOdMtlOY366- zf_>_FQL3;T?Fk+r`wWOgv$UFAVOXOq;-SOur3v(9z`FTSTMOH1f(HIUbzEd>Xp5US z^_eK%(S*boiKMZ~gg({)gX`}`4Zf!WpU?re&a0;ufKpeO14sk3r*pOhe67Ku^X2Dv z)Bl!Cih1$sF{0X)Vx>;Llt8&w!cEyOw{GR1*PXOOXQ+w!+xAvT&kI+#l~;srG7Z!) zR?c&2eB9NRZJKLdGZ*^@>b+(3qK@hUuinrbXQI=R_>eq*2f!-`q_;K4$+h%Hc|A-{ zp0&z4E#%P1j99utgJ!c;vS=<bd{t9xa&JV$9{B98c)c&c2q-P8x zCHC#Itv)-EBU?o*2;oWA5~Z2^`%w*q6#NUO1D$%!As zpsdwp>vMd%>MP(E4xCp@X-}N-@d1;6B>oocp;d}VbK|BmF8pr?~$B0J`g+ literal 0 HcmV?d00001 diff --git a/crowdsec-docs/static/img/cti-integrations/logo-ipdex.png b/crowdsec-docs/static/img/cti-integrations/logo-ipdex.png new file mode 100644 index 0000000000000000000000000000000000000000..468cf5f4fb2686a287772a4dcd0bab1d1245622f GIT binary patch literal 20632 zcmeFYRa9Kv6FrD)upk}Wf&_PWcL)&NH67gDB{&3kmjJAGTKg1P)wBneW2Zogk7PaR0L%uMAh9h&$51cVQb#qZ@!ykH4IzS4O8pJ zuN&4bD^ejNW2S#8zTXh1&AZ?5Vl|4g`M`DFz9q&w-fprMZL?;h_gP-;Hv3oCr=yAQ z90b}myg7#g&u0H16IuNCzK3hB=kM%fNP$|H@0nT9aH77kxg2CjVo*iUqL?tWXh?yW zB482BU?@4*Kr%QL0!%n^{~3QWB8_N!rODxV56BiM}Vea0M^MxMy9@#7NX;QdBnYqd6E;v2J4I!~YtL#~!r3wT?FW ziT>He8Il#Bc56j3##ZNN7pOGIL&YAZlgn|#>b`+VtZlS_)6HcQ_T$GK50yOXp+5WQ zSXka6WzTh1JiY`Y(BG%qTjI!r3~tHlZ}ehTIe+=7VX+N0nqR{295L+tX;Sk&jjvb0E2ek^tv=B3V4SU!vn z7(TvMXa@UrnFRmXMA^}+UQ!CTyczgtr)y*KV?GM7rlBuwI^j}Ct~5n$_fAQ_zB2wQ z`qewZZ)J~DgPj;E)a!BIIx_>c9=$P%yQa>kN#5PuoBeMI zr(v;k<=vSq*s!n1@2{m%cC>v9i%rb*)91iLRQ;xnyPGtK-MC@asQ z^ZeeI222aBauB3#6F|5qJ#0O1W5dThIS23bIw% zK>d{Gqa4cv4NM4X)N#Y0R702SuWH4DXM(NWBJolRZG#ZZ2T!I9E{Wk~Qh26;HeO#1 zcGuG(G|mXN3=I*S)ygJ3Z}XK5$#( zeBnYRI--kODNCFIOi>=j)YMe7Z^bQB`|793_#LUE!jISy6~(hQY54OqrQPr!H>4XG zb&2Mdk22AA!%Y6`h?CQ%lc{c_=%>chmT%D!4afMw{=$>~FptmGo%zMzsHh*am)*&V ztXDq!{uRP4~OFWZmcB>bstE{9A_3HLX<@*dB(A5rCq zpKVv{eNG{YyhkF+h_!pCsuI?)z{FGxHW=Ey@>g9iq7FUYnq(rA*v-CMs8K&+zQ2y_ zJKHNP{6SAi7_yEFeL}ZPp)er?T+M$ZBKgtD%mZz!Ww2jIyZKK<0HNc(Qvc1DlxZtS z6<}3pz`_wBV3xX?0;Z3qOuRh|DUvdJ%QJzdXg(hR9uC}oZJ*sDHqNzTTT~(M zB>it{QKR(82wgt@s6lgo(!|KZ?rj_9plKG!tYRW8hJVWs+fObqSl z+a1wJt4r-f%n;m_lk|wJ8~yMVNiOJzeY9Kips2TI)~;>dw940C@M_dLo2L-x4Bl~W zuHvb@LzPQ)dQIH1d8!^izH_E323oYTE_VFRBiJ`6sea#X&T?V0$?H)14t!HR~Wi$ehBT)J_l(1Tx>tCBwim&zD@1zu-3MbT#hBQ$?E--+wP0hvQnW-G-}Jp7B?gO z^SAbq?A4;DIK}KOpL?Z{mt04-?ez1LpiN(m15rD+G^-Cpm1U~fi3ncX1hyx=8-5zn ziljA(Uye8OAz#IF2>nmN>?O|&>g58ThLfM~7@XoPD(TeMb=!7;E)geLO63j83dqp7 z_2%1UwPdnqGa3cCOd!pPtLDea$j^{qkDASNsP+#o7guyaGe#i2U45USRtuNJhj_xfAq&H>&fpt9?CR(PCj6m5 zXUK!@w5l(@ghIF*SEbBJvdtlli**E&^6TTFj*W#;-e5LDT*Hp~S;F4Ww)D@8cX;9=^jlDb_E(`(>y~mqn9~ zWbe1JWl5}Ho7u<&n$rTQLBrlmOKE`anu#lh;)*cjE-!$()#Y;Vp*<+5p+#Sd-Dz^i zP*Z7>&1(&M(fFKA_i72NWcz8;!gi(A{jtbpR;)2rX^H#cuA7vUh#1QC@DfAz*)L*) z^JV40;k^9tRJYc9K5875<}6#_X=x}gzfr43;4}Soe-mt#9pE>${g(K&!5=Xyk2(Ts zJ75AY%93ckX_brYa6O>qg2a|omA`<0qo=%ZPBvOhH`1h6B<1J7#V(?Z7Z)};95~l@ zvViAm&QLX;?Xu%Mb|O(?I~(=h63){jC6qjMes1c{XOk9_zS9|vHr>`OPTKQx^icRb zq<~E^>@w@n3A{Is-n(uII=Rh@H~%yFq!-npkdpA5dEdmZ^Kwh(%%;UFEWC+UibLJ}}Sk!hjS$4P~8_BfEK<)STVi5&IK@M1=us|%Di@=&mFxHEJ;|8&S+63aMMKHE zm`wPc)f4Z_`iT+u^~<9se)-k~03Yfs^{^5`#XB(%uKgORsnO)|;M0i^dq$`dLf+s# z(M%+V@JN#4Lx20ZxQ%1>=W@^nckoK(y9R2$obpMbl8R6}F(x!7ST(^bLF=9}-O)Gf zpuFsCtfPdJoew56+j|Bz8WIe|w0y$Pw!?JIU7JIU7sR3VN(h)1*$nV;hbzP*syRPP znrTr8c}=o&8giY~L`g&lnUWPR`eFGXJ*9iVKML`xyUnA{S%!Z?wccjsGmluRYSJOs z(1|k(Ug~}Av4T3gzQTFJ@wRFZ+EdP5^AX?N z%{ky}_Py~@A;6)i`MvGI->I~jX7TTWi8;C@?X}Q=r*UJDUQvv|mGP8v@pBB@CD8-J)TR1d z$dAd`WaU++9nMVdthLd4vo@qwvdQ2y;v*}u_dtW7S77xe@(pvBmVW+38@Q~tEhx(8 zwMlO^IAMNVPAo;;_G2eJ24;97{`P02E-~x<@NbQDABpiw;wZ*BDrLxlF=&p3Zim!c zI^3yDQWywqKqRw1X0jre)@O}X9{%w8>U*r_o+0OH*>@8~0u}y0nFu<2f zGs(^VND}oUfy6k;v;`_9NIoUP+&8Lxup*;J%(0_g1s9*q@2~Ez!*IfXlM7xHz#G7s zuUr7k95n5q)ybtQMlkR}c=m{fFY`;UUehs4jkKw}z^Qix-li~PR;{@6XBTM!N#sc4 zv@y;y5ZR}Dp5OP!qVN9&RfPkcTPxQkL~rTR?%(LTTvGDC#h?CF;cSLPJXZAuQgqZs zMZ7F!m$>h}T_9J|3@20}CJ++xqfw`jKg0rU`B);Hx2ePbcTQ+GKtABU<+UVbM7;EI z+z&W-180#|*OF7`xP~_>wNutj&@ylQPQ5LHF~p%(*+lHu5rUpR1@3k8NDJnbCACdj zz&!t3f9FSFjz1R{s{7B?$KL1OZkk0#IeeZzR)WIM>U20w%X@Bu-iE$O>v;S<_)sGm zp`m#4{?rrx%)l;S8)YfwnH0w-J?&;$rvE*#kZn0bK?r0b46Ofl&H+}VOsP>oRb4FX zhXK>mf!OxX3wid$t_`Pc@se^k;||5ISu<0}!e2)H?uOsPC$yFBz&6ta!R}KfM5@kG z0hj{>pSf)*9Dy?;?1s&^mG1tU5lYjWy|9FZxiYKNh*llRvP;{JS78Cc{IT<|ZMsDE z?k>r{wg9V^5)7ZoukfF4?F7a~0DPX|WbwA-t*fvRcLh2B)$;K?>^L8#sMB zBsJFDDw)2D9#{zo6A8x)K!Iyty|7nSUA!$l?rWT5SQ_>MgUUtT5sO5T^XM!uK_~Sp+7akzeB8`_~_v&fK}` zqUd~DeX?RzZ$OHJ$mqVZA~~xu7hwL_P@;dndN**6uXFa8cS8`N)X6PB`OfZm7zU4B z0fAXMQv1@vly1kIztiE8$pKilT@~wzofa*^$VH=3^GoBFn?iuH-RBf78!$B?>&==% zV~{-cg&w=r?j3x&@=MFs&I-OJmlDz%8^uEC&n-79r^T3u z#MS+8u{o|T?SFr$6y$A@CVZ54wT_I8W)g5XO+I0{U*1LklUcJr#2o3vtrUEh(_}Xl z4J%A_N{G{8nz-0fikQr#%W2B)Z1Z_Xv;(u&_|VA-et!1{1yK$9Ra%Ho7iS4?iOCJ6 z3W0T~UpnF&o%bs7!?c(CkWmzeuwRV&o))|-W%G@c>Tuyd0|4?cXn%6QdN_l6{{tEN z$@&!ow$hxG-y8dF`mYqfa1|2+hh0?poD{RJ&3uGP^8TqIw{gGNrs+&FD!-h^yvb^3 zAb{;)3e0CTb@Y1|UCt`_s_y9pgud{;gKMVgnBVHU4}G$l8tp84%1Z8}?R$%*#!Imq zzX`OI<#i5-==Z# zD%w2QNs|4jym2&%y8cd?SaScYzxd~Y*!c>{U~}(OZdOwi9EUMk$XNHs4>;h<1%*fW zZbK$ROZo9Cvd&%g7`!u9huF(4&zt_*N=*#E3pL+p) z5cv4aApeKi6uT6`|!Bd^sB@- zt>N{w%%c$<-FxqinKmE-^_`aI8oZWm?1fjAD(sN+a?KV>sJx%L?dtw-PhTIJ`Pn(3 zswQM`UulF)Py`%@xQ?){IeMYHyMGT-q#&v{65qvl@LXAAn@@nlpH1H9&lPu z4{LR!%dHT@&fs5F{ueExL6&un7#Qj)*ztX@`kMJ9aPYQCTJVs0#{}ifqs1@yvN}pJXsQDA?oKM>cGHt+-X>3!pfcfNER}0LTsnl229Qji!@jhT6@SAsWO$;sF zhp!=bvOz={!h@twIC0TaaeDnRu+G>m?N7ENqv;su%53`8PF^nw1lI`#BzSYNBu9BX zhf_)Z5@luCN@;t$5Y>+f2$#1C-4<9GK(is3WgHL0^5E}xK6b;2>#hqH-_K^yNIK3e zC)Wb3|2CfN{RyHVcu^^*x@l1(RZn9I3#a@0V&#;8&;m7b&f^lVygJJy(|5fCiyvZd zu&mEe7{DSkCK&GEjCSOg%P|yaH~e|PfBvDf#%Wrv|Mrv65NKk3bl5lEz5P3|55ws# z6+83iRi;Y9!hL^Ri#c4J!|m|?Ju035I0Kax=@KDDG1#gf5sOW&O+d(BqHvSkhH??zr*Fr1!xFH+}8zFxT_pcHU#3bPyM~g-qxU>tA3b=zP_a z86xB#T*ENPMkEv8mqg|f5`wmVKO$3=&9z_423``dv#9`yc9dRXJh}!Rlg|Lt4JznI zSDSt6^mTvy2>;FFc|pq_&U524Kt=3$Hco?PRm&CR9G^AP6cv$LKBwXDMK8fWx>WWC zyI>E??$M5gFGkvURz5nt*lp07e==^yGF!4PoE>BGD!IKe=ZO(^xJhOMH#L|Gc({nq zsKBo0X-K-e09Hhsm6d!Yt+|@_^xLB|O|w@HQi8srWU#9R`y}2}^@v?Xp`xJS^b0i^ zBCkKRw^k_=Fz?r3fMBTfDod$Jl?-158eU($_M9lT1HWKb@O;4@^s?C`a9XAzuDucP zQfR90PXu_rlWeN9;`}zr7FaQ+wCxfnWgjJXe&dVlvwqk1drjO#1i~!>wLYaRZPqMr zyvWpw7tUZFTK5x+v>S|V$~Hecle2`o>`on)$&vJasz@0AmEm90bo4q3Bk?)X=u-xU zo5n8Nvvabbh{$Y3%s^}vwONF;zdA_JZ^7)vA`FGkWD>e8VCDA4exd0tVaIRe4eh3T zytHTy-SuXeh{OUC=x#W5^eMxl*doluqmVCSnFn4^>T>g@#%#3(;&v`noII4to0izQ zZ0yA-tOs=TVvQk-0_Bz$pj%XNIiCweVQS5p3|K;R z{vLn#*Ke~oJazpqAX8T+TQENU@(}OhEXDTh_IN@7IL{NH~sy-tA&$G zAu@{Sn51>poAQr6pM_8S+I@tU|BMkK06k5-OVB%oTcYDy<1e~83S(TemKf#a)2W-V zl36nFhooCse_fxuRTvNvGV)1agagMR(jvqq|LZn@kdboJ;Gn;BxB;pl}oWOAjy)9(K3@XK#c`#OS)izZAk*CxymOSwcrcC5IN} z;xgU&X5ynio0+DGHsFF-uBj7_&8_E61noc2=I8-=s7d);o0z0cnf2yoXqU}-rX~He zx=VIK>I&eFBn*J+4I*w~M=)B?^Nq2uE#LQ4PM-f9 zpHz$$WeMY3ak7mpjQ5~)o}c^wou7}`zy0iDnwXfo!#jA_}2zt9MXg+C@SOZ$2zH=U z9=GRja~_#kkJS8pO89aU(O(=6V#l!~{C*`vV*+f_RU`V>eTk6M8?W-=!}cGO7^BQD zb&$2e*frrVj_(iu`a1(GMK?dmTV~CA`jvLp1XL(+u?&bJLWrKj%wf|6ur>B1F_l0g<`{; zuAf)=f*od-Z=jXOjRF;Ky46tL`RSYiiOBlKL}A4gVXyI=*L%_48qH(LJ1iB{-Q`$` z3iWu(I|JV3PQO-fJMVG(qb52Kos4f47CifD_ybsZS05W3&yq;_V&A*JSGi<+G+xh< z=DcqTt9;>qh*72M87WOD-oDrJ$S7v^Dv=jZn=TlTi&RWo_x}M9aWbEU9tL}=US6LecXB1P}T>k4ykZD!Tce3uDU=e$Qg9boo?M=VbCA;p{;gN9i=D&s0Wn zlZBV7cKFrzTGmREM!O_>519>2tZZiD+U=hguBnB_%R5ed#5P;BK5^>yo_roSda&R+ zm!ov~95)iTqpwIz`T+$G=)2RY3N%@#Kdk=M#wwNF`WiX_cQ8tC5~@|G?I8SD?RyC2 z=KL7W!;kh(9Et6*9OqxN%jvD_;ZF6cw!FB{A=}Gs1#|apC5+miw2Y%3zGKIt5Lzg9 zQe<8ES8=Bm8m|=g?wbeli^yiD44c_`{7bdLeaax@w0x()>FIwjI6vR!H?(FnuH{;$ zMPt&7R9{5?g&`NDKlLTSrmS@=sOaF!o(J-4Sh?`!Q_A4Xk*iPc_dc_yVnV%{mHhe^ zul$mVXGSs4vYrod@#BO=cj1I*r;Ub{?6SR|76mcRLERW>b49A8cUR@i>!GHtF!~{) z$%u&KY+cEQ4T>I=!mN*!VE}Qk1i$%BzTbzk@f@LJVxBs+s0-%_b!O{5Az&f(HTT1MK3zg=gkBaOHA>Ye)>Jko>jD<6naXK(a7sg7V+`0n+!;)zC(T;55Wa zsUZKIviw}i+nV4z1X&FSr6T`iCC;)gRq*|@uLh^CGYZqtWO=;{Vf-=IW$XI-4AgmV zDRvJT{i3_H^~awb?2(IU7oehI#zzOcNQS;PG+bn?3(35`YEyITFLQ&(D6stBB7UD?+b4rf3H<} zDP(deUjy6bvG8eCHxDyaI=FvD;egLUdE2z|oH|>1pG<{dt`7o*Z8DP)HN0&6h+SC< zr4zzrAw;uhR_Xh1N|SiPkax3{#9IBa^lX3)g-@~bi!NSV4JtxHJt7QjlVVQ8?Ho_K3s%J zmhsa6sXkaCrT5Yfu!uh&O`qdIm9Jx7Ec%F!Ff@S7>+w z^b_;HwyC}95}5?pL3i6&C*Z%Rb_>CF`PChBp0s3;WI3ktyv~BERMe&=CKQk zJ|bX|21GnXS+&vY!}JW9rE%j*B9Ys%orNssz<2&5&K)@s9|L$kv`50frI7cj`vcbH z3=zdKMkit)(?lVexo4x9WWp#K4c@Py(DzfN%nXRZZQ&74%ZHmR{Ez53xX)+_Z-jYp zT{9Y5>ytl@6;s9Z<6ti-?gD0V31&>=e&DOwL!Ey!V8Y#5p0>~ojE(1DGCib^=ekl%(mX&$ewT1_}RHf|elBh~?WRh9H(G&vDU^ zsr_pm4DbW2X3qZU;{RSjG}xR&ZOQc`k>TU3?FyeE@Jie_$Ay9w<8Wn!cUwi5~VD_S2Ge;A%*mOXV4TZH6gf9DGZq4 zJK0;@Bn1YASV`9eDh!Bt3BJI&BLgz^kk4TI_w7|1fH>T4o5i7$D9)pJtMuj7b2=gk z;z)Zt@VrWA?L!B4TL2^9I^hiFbI1|gPe3%1MS&)cm_u|qFI7In;u$82e1aPH=i{Wmqa{4KW=@C%r>j%Cq0XN!u!3Q#^xDBK}mxA`Y;u?{Bx zkdQ)xz07o*j8PGYq5!`EQIJF#np_Zy{Vg|91**}?wcX`kmQ%ky6~_yCSk@1P!C7vd zwk!kHDm8E|rW{)7LLSj|R-%5eMWXPZCmhtSgFN1Un5DpR( zyfT3X;iMj9{^md$^sD(KtfBbdIcynXGl!mp;0HS61?fNFH0c5wfi>;+mfyyZ++D|H z-n8Yw=8{{_-N2#L$!}laAd26W!sUYQM(+Fk=l+vioJzeEQr9cEX{XlA(o_Vt3O2kt zTl4FOlJ*xg$SmCqOXmpTN=ZTXu*z`6+_Y$FIrN^QE`GbZeuHQNa0j)j;+KbNgUPG` zW=HZ|P>_9VPtVha-o?#zF7~Exvq1nyQ}l|a?lTUX!e&Of6nT?#c6>a-_+xAnUe7O& z|MeeY$6VMW?3~LX5L>2nhq5kMH_r3cflos39ep03=~yr`~OMg>@z;P&aFr zVd08ZF9NOx0a;ifh~l8E_&o*bodeq%QyGYo6A1GnX`@hg>x+bSb#x!-Yy{Y|q$q8y z&GVhC#Drmsx(%9WYS5kWE89OM9}-+|xoR?%+{Z8h(BZDNikp5Go@FXA*qyxhZqRe) zvDrDhIv>?YVVl!(F~k>ME~vel3Pc29)AOt`_g_TTzc-b(y@}y?xp_6{Z!uzvy&jG; zuKX91we$P7`kW2PlodRfsfYUnqD8yw*}HJa!O^d{(LmL}t%pF)6l7zS z$zZdHzFS7~j3-DkO{*Xa^NNAS?oc85 zhh6K(KUOW3?p=O!e0cj8x1){B{`{6PZet^+Kv!e>=g(5TB`Tj;`oe{@f!f6>%CsL~ z98`cP0kT`iEk@0>T7F*iYn6Zhf?u={vn{#zN_t^CRHZ=*8V1yve&dCVY7{Xk*7o>t z;LEo_t07m{XoxW2S|LjwQ?BWEJEMl933ll_SbK-_E$E$FEMT7N^+gTz)arRQb`tT1 zv_M!CJ%n&#Y>8RD7q}Fz-+&@TA8Ak-uCt(alq_nvQ}1Z(T~)zESN($MW2ADYs0OXN!g2(-%98 zBu=MoaCF^?q%Z*Cc=hC4+Gn=x^g&&zGcry33eLsaz0cdL6+wuBBAK<+D3(88oZWLV zcWUk>w$nJg+dGP-!VX6EY_ZRz-OIO_oe38W_D?;hl>w}R{>&qGQS~xKXG~t5sk}eT zy}W{G-zpEn?$_A@aI4tp`_XfI5CRDi$K}*kz)w*&gxBi#!3$SWM2Q2@B=p*~OoE^# zhN{lUg8u^{c=E52EYSv|# zg2$Y`cz%{fijiGyYF!m`im0Mv}*u{SdUUUNkz`--76%n3{Kb^|wOyJCkou z{kN_&u0Pifp8T3dq5%WF%!Fz;0aa-N@L5&%e?lX&!m_0fJ^30nZU}+9dO@V&iz=be zS-v1M4;G)HD9p`U74pF$%zH)aY5pyTlK7I)QgQnW=O)#uVW#k5;_PZOjFWHzRNA4A zlZ&t4wC5*HzOt1d7WU(FTg$~rUjXMiwusTh(L<0y0JtecE~Vmsy91DVwLhq=`zuFAEoa^HX1`)>fJ zYk**uNYI3P&1A1S%f8h(sIj*K5n~Nz8LIQ(*^VoIIo*3 zNpVS%g=Ny=fjZuvFq5~|>+kB8!ls78!iKg#9r^jt&V^-VrNu4ye<~a1&Ct+nq9-d# zOWTW@#e23~qXjFgs=R*4?a4;RS-5<|Udyk|hql$!QAKR@z4?t$3!OGRS}`_UIW$Jw z>URIt(Ztr;S;}22-J#-dz?ZgSWu1yh{oj$9=xlknq=mO{IR`JB00~xM!J6$2Yc@2T zRA30~Va&>+Fm+CS4$Dm-G)tWD=hEB5-FUgwT<3YHeOWD?>vc}%*WVh&`B|G3ZauDF z$(mxtxXo`BGP|igvW&5(&O_iyq=K_H%T~!6>*JW?li8OTJd5!PIlWe2VLhHezsz=a zh;+f472&Se>{v8-Qr~^^Jwz5`q1D4I1+={=0iFtno@|ojr@LmALXlSVARV5c-4kB; z*(EE@4RTZ34ad}K1fqxfJN!93{F<--UkcU%R)i;}gf`i{d83na#%^01HkMOPk%%5G zE9(i6g?hQsw+X0mSH`CEpByiJ1+^;MyAnGXA2@FUYHH;ixn>eWb@jO=KvAH`D)sA4 z(&cv6$Lr(WX^X7|+AT3xN&ol9JF!ZxnBi5)&1{K&AH|T@Z=^TLLS2%iFX(`-%g2i% zp*6Z3{V?a?>d698V4ObSX$DHMwWfyswtJWIr!9jn5eK;KJ}hrWx=on9ku@9j;OSxs zFT=haGMvEWO#g)azoZqjR>w^(+p=Pc?e1|x+UdCZjuG99xG2(}YyqMt65M+i12`QYhtTX99h-_$uW&`S*PUmi%>6-i#j>0`kU?|dn79kbV z7wHV8&lko_PgD0tgq3=;J|E8LvF8h+Geh%BBy*&~IqW%f z58$(4k|egxQJ?)8`OJ-6+O-gTK6n)c7&qy1%Yzt^?BkeHt&czF3|)Gk8s6wzCnIDV zlal072s?x^r84a4Kb5q2A@^rPqYm6 zz)E2nv6FE*`+XcQ2ls&51?`|WA}aZ!Y+tu-SydT0s>^4(3Yj>opA6_ighIr?M)*v$ zES7y!*E5VB2hN7dvCqxT^;?EAg$RD*;~p?QuxK8Kgfw1L#64wKQY!m3-2;4s@Amc+ z|Cjyig9q(mUeCh8i8BX%eV*$%nqSOl3U4H}OmH0&W)CH_wdZ;gn5LpB7H}u3p*s6=N zkM~0kU80YR7VK&ifk0r$GHIwl00Ue5Z8C>WtYBVMJB@S8)7`+^{sl5Fju=0YtyEf` zP+wEh(Lu>yPR&)!LQD1xC^m{BF}!_dwmYi^LHmb`_4P*v^~eb^=stjhsNhW5tThS! zxQ(c;@01ilyc{dVp)JanM(cy7P6IrkicAi6(_l__k_HtMRJl#9d(e+ZWK_!y2&3Uf zmq+kOEa|HPE_S=LF{A*wUzh%tfxkui=>)KsvXWy7fBEE1%rYqMP*{W98_zU-7Ii5pV z7Borv@-nhdKK1!W&fiEdoMIh)@=qZ6n1KbItdho}ewa`gflFieORx#zpGQAB^4;z{ zljVtPYH0yi@7j5DhRc6pv0igCSMl%6Y6Otg1c|~tl{Z+v5BA*0&BrWs+cYQi)PWoM z7n9fvYNaz6Fc8tF)%%W=_Adj+mhzFU+xnUeA{)(4N*`p0@&Y{>)&kj3YCz9(a za-nd}V)l=>h7R2aNW?2mu$LiKRRm15?O1>hMD4$IbM-}S@ixrlM7*gdwa&U(uC{!Z zsN{e+kBu0LhhJ=bVG0tJATUc$<0uqz7qF>KB7x%&wnxcDh00MWAMF**mXk~OJa8R9 zw%4j`{xZ%o4Oi7Uuz6?u8|CaCfRVWh3O8Q!ZU@rK~LRcu#~1A=+bqu zO2OEu`u8~7Yp)D(SX|u@Xsd;iP&ODaLEjlw$HbxCi z1<=vnfD#YT!~C72dytiNFf}&z(K+7D?aEXn%%_gN$9pD!AiJzTov=|igLcs8y}9I_ zh^UjE{j*5rm~hSoK{+yGz+G<=ig>uD{2A|MurM|CWm`Oe$lr2rH!0b%^$%HRWz+8( z$XD1K?gC0wC6Z1~znIPQ1&&dAP&1ZkTQ>lG*zM zu~Co{G!Vv@1B3MRVK&oy8wK}PQOGp)6h8y_LypM$gN*c(@g;wtm!0`rpk?HQ$}iFc zH6+i37NNM|jiGNp9mc^uKHKLN%X+3Ly3TT8VW2neuf{E$N^iBS%`K#`VHp~Bu>C|=&lp&?I%9HX8Ie5M`buw7YN`cjN~$$E1u`xCWK3I#tjDBb5t zJt9L!(;HB2omVEOHU#b;2>kM$Nk8Ta4?su|4f;cC_e-gyKwO$ACFDgM^`hg0v++Di z?N21(%?2uJ_5vM>4kf2LAQamV=Zo;_UNC^{FMxwH~`ePEtyhI@U;6fV!t`08GEEz|2GB^MerI*cYz#?!Yubs2^E zLhVE4aRI(uos#{fjo?_c?YTy|Q+|7|#@3XN;#dgH*Af7|JU_1-{^fgp;$XFd4|4t3&w;nm1`N%6OGH9`nKD&W`gTRLSZpDY)s8x z4R+Hhye~Y&F6|n7&`$Ovj&hM;X0*FM|VgC6l~Yn^12?0!Hw%OxN5rO`Y^ zBFn?k)GMch`zIr>o!+G>sI4RXGy$=_Ur4}gRf4P>_6zw4(O$B>ptPu4ID_mkCAle= zV3Na4%BQg4Y%^iOBw-9NAQdcl}O){ALV_@9z(Re`JaJ2s8C?2A$_e{ShhlvAJxYWy)8q=8xdS++ka#D{!~iK7h&C(3rc+%b!H|G0AjxW zX6tjye33+>Z8BEpH2@$-u3#k{9*o#ng^LlUrt@gf@kMe3gwB6y)%H=ho9bp3(L?7i zIBm^F0p~}b!SEQkqh2}t$O{a{u2BFo?lTL;Q>LJk2%RK^2O;ssv<`OSHMyv9WZBPQlX_3rfBBT-~4#BrZ*HOtL>Z|Z?jFTDuV=l1 zPtA2m*w}rz0atn8WFG#e@1p)kFpz#s8c$#CkDsY!I|`}wwX`;;^Xd|#W@+rOv7zBN z8$wR+*W1;meej)S8JM-&*%S^u=~!oG%lbmU?vs4&J#H#9GB%h!R__c$-p)gb)mfhI zV(%+eQ=#H-6!U);C*m`f7ig*4K28W%9u!2cJzR+RMUS@H5Err;Zk!S}1NE)?P$2VD zO8acs?CB$$FTG-0*t?$gqxFl)EJC1b6yYwoL1H9WL%!m5TraWJ%|Pq!O2mYK0Ezy` z7HN2-gym$@OvTyR8Q+exsY-4;xiSX<3Y$d=hk*2wipn<480yO3l)RrJEbxeZc*OtG z2i51^wcjF!^-L|1p?a);7fHvl)vw~`kup$t;9c<1<0R>Up<+`Weo);V^AhB9jAeU# zn_!KQC~_j)m0cq;$DS%7i@9^b*bNDdd&cR*OHKP~leV%vJISR65M8WRV_PrSDUv9o zsxm=HG+twhd%qS`g60B$np>tpNu#f;ND{Pc-;SU5imUg;qDWD6agv>19i*RQr_edf z8{Y}GLnU;^l6`a73|zv``ANxC4CE;5-xo%Jo5JDR#YaOM+sdJvKf73~;^c$B$j=)# zY8WTp^y(YFhl@9~x(#G>On!^i4JWk(BHi7DciYSuAK8?KD6@iJNa0v07umjPq0lsd z|N0i)E^H<5ITv>$8JJT!Un9o4@MeO49+c9fP3Eq4YXYa+l$#|gsdw6XGypvzlfjJP z%(G4n7gUX%YbjQ3rX{S8UdS_;|CBol=8V>)BwOlH6YBaauWDeMfmEU|9&xGt(t+G@Y7A3v8HTXo z(Cg!b|5a!s%o+vn8wPC}%QKg$2{lk^5^T+X>~xXF*tGxt_L)qscVqp)sXtkyDnLuo z{9L7Wgi~0RQ1{6s7pr5tuZLq4N|H5MH=gTH9uYwhK8Y%O+ZNTN zxZC*6_|C2N!+?XKNvsqn7y?~YVIj{1Fo?R^96&T&P$PzTIeF?5z!-8f+QT&lk{N81 zI)2M5ONmw3lM5=k_`zl@GbS5ANF~-R18Zn!qUK@WshSiO5`vj|n4Pl;L^hzBtfuW? zDxfg?$jnS#*TCs^L_XutcAcTFZNQrO&t}qxQLD89_jC_$l0)Q)i6>61vP9$|>}fTp zU=C;4ju!hwCI|Yy>*Qr8r)0 zm$&jhM&dWDxL+C2ObmJ}GK$K~7--3KSFHTs$tE0_QV%!lxZ#M2>QJT7`R$4gi;5I? z*T))_GAdFxYNAzCB0&hL6|ocpyZ$86bn==gs3+mqDL`7!zeHylMVQXlziF4H!0VC4 z$4#Tk3$04YVGyzOih0xybx-A8U$o`~xl?p9u^SpAGs(JnA%KQe`9ld!2hyTF zb?C5`u8L|yT`FKmFl#XOzk^x2-881|53w{AzGC@-8te$Lh^>%3<+VCbkpMEq4)+J~ zrh!b8-B6A?T9FMQmxPC$5*@j%6pZxraVWgBQ7i|KNqYjaitLVW0`aPeSAzt^3;SNW zWQ~bkA4+jWwNs-Ci5;~G228^5Ijd^&<45+{Y6Yzw`H!jSy^nR7(o#5D2E2YTeol2L zUxoXVQeqU<=llE-&%5XC{qDYx`eIYt zZ7hqr%NShhO4>visGMc~5op@bb{wN<*9_NmsSY~=Fp*_A2uOPzqa?h^?Yn)pK`J(RQV`7W>O~3Pd>Pg zF{|g~Kj1wPlCGVpm75KsAY~D4pP%83B)^I+5oFh_QTf!>>4ooMPyyv$fAhHq-$&r> zmhLnS+8FFuTs2LTEoM9CDtgsV29JAOuk`u#VshQfH_i0?_TB>W_gfywrp`K zjrbEna#Z@OD>JV!BF%pgeUXkFOA3B$00C(rCBUF@CS+$L&wXVm;?EJ)$F?-h(yo-U zr!=2K5NPc6gdcTjsg*@-ej3`_&V?(812d}AvLZdtMGx<-tx;nN+eCk!u*q_wWHPT3 zQV*lkBA@T>^h$G_MBk7FwD9VTlg5%HFrDvTRg)XOBAuujRk|quRjQqJq2t&dzlX`R zDLH98O}fF(=p-Dw>SBv=8n`XO9l07xCr$qO5R^#;sM{I#Ur{mX?drz8B*$na0apee zM>mpnL84~H8bNz3-FJ!!_F&K!@=am8BjcyxV&36=1M&6G|RhvWv_*id}08>NwB8G3GH7rcezw$DjO` zsS?hYGQ=fe!r7DJNGUX~>9yJ#pcar7p7YcM42>5tOf`Wpd4tAaZB@;J5L7S6k zP;bFS--r2uohN`OHEy^ZXVFk;=Qx&m&VuaMlbQ zqZWfX_+d;HR0+z$H`f&2Qx&2PA3_ipo}OYw67vN^3Xo47TIW1L17oP1dE+Ry&RF<7b-UoKe5{kUgr9rL4`-9+U#v!f}E*}@;Bb2MAr?rablQV(c* zh`3*19Ka9(K@!txzJYMsUO={esu0A|1~4cVK2u*6e)N(PaK<7?760rl%*Zf=gz(@< zM9~~T`i5=lf?u3Fc7EQ@ob`#?W?}C`oV!XAg>~%^W1zOX89*7pJv))NHQooSnYWIz z@?W!GmEjTuvfsMq<|-Y?Kcd~sqFT8W;lYU$H7`zuN)NiN4YIBBHqRTPL|m1c%5tM( zsZ*pZT>0_^9Qm#qmb<^I$0kpI2b_`);&HmRg7;vNx(GpH#mzJ$lzivz+1kk1-WmyX z#@Ni%07joExf{bRNcXAB$sXZ)U-l7%*Fy9+kRCzCMtRQ~<{(w71Hc~T{TRa1asui_ z$Bjplmg;a`@5bSRUoOZ|m^aB?QJ3$bfKIAdnOo`MST_3{yny!yg9>(+By~oA5qu=&oapK2W|`9qUo4?E6|#33=8gKUDle3|nrV&0kcQ zJRxrJBe}wQ7FnE(pVdi>7J6s*6=eeE9CALfygFM)(FoqHLs8nMVD=PM8! zaMn+Q3)$zM7gpQhC(1z=%gl!J;GIDpp!%66^`2Cpo~mwj~?%r2JYBMe|}LUp=D%Stb44E)y6}D&856aI@RwUNbGx82}*Z1 z-kN6*2q@~eeRb#kodIpUo+P>g!)QQ{9i5n}PW@6a@S?Wvd6IF{Fqg)bQs#f`w4iWhgP_eCY$xO7z2qnLXPtCld%pbyD6uerubLitw_BguL=h<0-rE$Ya{Xn zq)A3qY3krWAnysVLUUhOglISmq511m4b--=?4F(@ArHlU#ZsHmi3Z}3RVEdaDuE}- zuujZe&P!BzA2d8tjX2k5ROx$@g}6yH6*8O9@}Fo15i<1Rf|7DgAyLr9z|V;;)Pi=> z;j1U6-S9VZe?!pH3D>=0X$Uq$6EC#s*;Xe0G|zcyt@yC(MQo$Y8KtaU!!ilhpj<;f zUvXX)`h3k7x#y(zqkGMg=-H58{Cy&B zsn|b_`R1G2kP~LZV_!-lCUC%IJ;y}Vp_QO&_9JR1Lv7rN%x)TJ2Y{d6F_3KlRZQy2F==qBiZ)KEe6V>J-GPzU-YlO38vHNY zHqCyWj`3O_XC^C=x;!!JFH>?b<4y@2X{AjaIxeuTDG|D7fw_4*e%QX2xJxt|9``z< zablB=7mdo;uN$#FK8o?&^@F%}@aOdMtlOY366- zf_>_FQL3;T?Fk+r`wWOgv$UFAVOXOq;-SOur3v(9z`FTSTMOH1f(HIUbzEd>Xp5US z^_eK%(S*boiKMZ~gg({)gX`}`4Zf!WpU?re&a0;ufKpeO14sk3r*pOhe67Ku^X2Dv z)Bl!Cih1$sF{0X)Vx>;Llt8&w!cEyOw{GR1*PXOOXQ+w!+xAvT&kI+#l~;srG7Z!) zR?c&2eB9NRZJKLdGZ*^@>b+(3qK@hUuinrbXQI=R_>eq*2f!-`q_;K4$+h%Hc|A-{ zp0&z4E#%P1j99utgJ!c;vS=<bd{t9xa&JV$9{B98c)c&c2q-P8x zCHC#Itv)-EBU?o*2;oWA5~Z2^`%w*q6#NUO1D$%!As zpsdwp>vMd%>MP(E4xCp@X-}N-@d1;6B>oocp;d}VbK|BmF8pr?~$B0J`g+ literal 0 HcmV?d00001 diff --git a/crowdsec-docs/unversioned/beta_program.mdx b/crowdsec-docs/unversioned/beta_program.mdx index f632af95a..7fc2bf25c 100644 --- a/crowdsec-docs/unversioned/beta_program.mdx +++ b/crowdsec-docs/unversioned/beta_program.mdx @@ -52,7 +52,7 @@ The **Console Notifications** feature allows you to set up custom notification r - Targeted notifications for different types of security events - Direct management from the CrowdSec Console -**Now available:** Navigate to your [Console Settings](/u/console/notification_integrations/overview) to configure notifications. +**Now available:** See the [Console notifications documentation](/u/console/notification_integrations/overview) to configure notifications. ### Centralized Allow Lists - Beta completed March 31, 2025 diff --git a/crowdsec-docs/unversioned/bouncers/aws-waf.mdx b/crowdsec-docs/unversioned/bouncers/aws-waf.mdx index 0216b135c..6fbb80cd7 100644 --- a/crowdsec-docs/unversioned/bouncers/aws-waf.mdx +++ b/crowdsec-docs/unversioned/bouncers/aws-waf.mdx @@ -143,7 +143,7 @@ URL of LAPI EG `http://127.0.0.1:8080` ### `update_frequency` -> string (That is parseable by [time.ParseDuration](https://golang.org/pkg/time/#ParseDuration)) +> string (That is parseable by [time.ParseDuration](https://pkg.go.dev/time#ParseDuration)) > Environment variable: `BOUNCER_UPDATE_FREQUENCY` diff --git a/crowdsec-docs/unversioned/bouncers/blocklist-mirror.mdx b/crowdsec-docs/unversioned/bouncers/blocklist-mirror.mdx index 37e3a8aa5..cfd6f418b 100644 --- a/crowdsec-docs/unversioned/bouncers/blocklist-mirror.mdx +++ b/crowdsec-docs/unversioned/bouncers/blocklist-mirror.mdx @@ -140,7 +140,7 @@ Path to the key file used to authenticate with the LAPI. Path to the CA file used to trust the LAPI certificate. #### `update_frequency` -> string (That is parseable by [time.ParseDuration](https://golang.org/pkg/time/#ParseDuration)) +> string (That is parseable by [time.ParseDuration](https://pkg.go.dev/time#ParseDuration)) The component will poll the CrowdSec LAPI every `update_frequency` interval. diff --git a/crowdsec-docs/unversioned/bouncers/cloudflare-deprecated.mdx b/crowdsec-docs/unversioned/bouncers/cloudflare-deprecated.mdx index 0a4653af2..47e2db6e8 100644 --- a/crowdsec-docs/unversioned/bouncers/cloudflare-deprecated.mdx +++ b/crowdsec-docs/unversioned/bouncers/cloudflare-deprecated.mdx @@ -322,7 +322,7 @@ Path to the key file used to authenticate with the LAPI. Path to the CA file used to trust the LAPI certificate. ### `crowdsec_update_frequency` -> string (That is parseable by [time.ParseDuration](https://golang.org/pkg/time/#ParseDuration)) +> string (That is parseable by [time.ParseDuration](https://pkg.go.dev/time#ParseDuration)) The component will poll the CrowdSec every `update_frequency` interval. @@ -359,7 +359,7 @@ only_include_decisions_from: ["cscli", "crowdsec"] This block contains cloudflare specific config. #### `update_frequency` -> string (That is parseable by [time.ParseDuration](https://golang.org/pkg/time/#ParseDuration)) +> string (That is parseable by [time.ParseDuration](https://pkg.go.dev/time#ParseDuration)) The frequency at which to update the cloudflare resources. diff --git a/crowdsec-docs/unversioned/bouncers/cloudflare.mdx b/crowdsec-docs/unversioned/bouncers/cloudflare.mdx index 89828e5ec..5ceade3c4 100644 --- a/crowdsec-docs/unversioned/bouncers/cloudflare.mdx +++ b/crowdsec-docs/unversioned/bouncers/cloudflare.mdx @@ -53,7 +53,7 @@ This **Remediation Component** uses **Cloudflare Workers** to block or challenge The source of those decisions - A **[Blocklist Integration Endpoint](/u/integrations/remediationcomponent)**: a URL served by CrowdSec, no infrastructure required on your side. This is the simplest option. -- A **[Security Engine](/u/bouncers/intro)** you run in your own infrastructure: the Sync Worker connects to your LAPI to pull decisions directly. +- A **[Security Engine](/docs/next/intro)** you run in your own infrastructure: the Sync Worker connects to your LAPI to pull decisions directly. :::warning This Remediation Component relies on Cloudflare Workers and the KV store. It works best on a paid Workers subscription. See [Appendix: Cloudflare Free Plan](#appendix-test-with-cloudflare-free-plan) for details. @@ -641,7 +641,7 @@ sudo cscli -oraw bouncers add cloudflarebouncer ``` #### `crowdsec_config.update_frequency` -> string (parseable by [time.ParseDuration](https://golang.org/pkg/time/#ParseDuration)) +> string (parseable by [time.ParseDuration](https://pkg.go.dev/time#ParseDuration)) How often the bouncer polls CrowdSec. Default: `10s`. @@ -720,7 +720,7 @@ Enable Turnstile (CAPTCHA) for this zone. Automatically rotate the Turnstile secret key. #### `accounts[].zones[].turnstile.rotate_secret_key_every` -> string (parseable by [time.ParseDuration](https://golang.org/pkg/time/#ParseDuration)) +> string (parseable by [time.ParseDuration](https://pkg.go.dev/time#ParseDuration)) Rotation interval. Example: `168h0m0s` (7 days). diff --git a/crowdsec-docs/unversioned/bouncers/custom.mdx b/crowdsec-docs/unversioned/bouncers/custom.mdx index 3072b7fb3..3ace8be6d 100644 --- a/crowdsec-docs/unversioned/bouncers/custom.mdx +++ b/crowdsec-docs/unversioned/bouncers/custom.mdx @@ -314,7 +314,7 @@ This field has been deprecated and is ignored by the component. Directory to drop the PID file ### `update_frequency` -> string (That is parseable by [time.ParseDuration](https://golang.org/pkg/time/#ParseDuration)) +> string (That is parseable by [time.ParseDuration](https://pkg.go.dev/time#ParseDuration)) controls how often the component is going to query the local API diff --git a/crowdsec-docs/unversioned/bouncers/firewall.mdx b/crowdsec-docs/unversioned/bouncers/firewall.mdx index ff2044de6..68f5a5e67 100644 --- a/crowdsec-docs/unversioned/bouncers/firewall.mdx +++ b/crowdsec-docs/unversioned/bouncers/firewall.mdx @@ -291,7 +291,7 @@ This field has now been deprecated and is ignored within the component Firewall mode to use ### `update_frequency` -> string (That is parseable by [time.ParseDuration](https://golang.org/pkg/time/#ParseDuration)) +> string (That is parseable by [time.ParseDuration](https://pkg.go.dev/time#ParseDuration)) Frequency to contact the API for new/deleted decisions @@ -601,8 +601,7 @@ table persist table persist ``` - You can refer to the step-by-step instructions of the [user tutorial on - FreeBSD in the [pf setup section](#pf-setup-freebsd). + You can refer to the step-by-step instructions for FreeBSD in the [pf setup section](#pf-setup-freebsd). ### ipset diff --git a/crowdsec-docs/unversioned/bouncers/haproxy.mdx b/crowdsec-docs/unversioned/bouncers/haproxy.mdx index a8db88579..ccefa0deb 100644 --- a/crowdsec-docs/unversioned/bouncers/haproxy.mdx +++ b/crowdsec-docs/unversioned/bouncers/haproxy.mdx @@ -284,7 +284,7 @@ API_KEY= CrowdSec Local API key. -Generated with [`sudo cscli bouncers add`](/u/getting_started/installation/linux) command. +Generated with the [`sudo cscli bouncers add`](/docs/next/cscli/cscli_bouncers_add) command. ### `BOUNCING_ON_TYPE` > all | ban | captcha diff --git a/crowdsec-docs/unversioned/bouncers/ingress-nginx.mdx b/crowdsec-docs/unversioned/bouncers/ingress-nginx.mdx index ff9ac6b53..6bba00d26 100644 --- a/crowdsec-docs/unversioned/bouncers/ingress-nginx.mdx +++ b/crowdsec-docs/unversioned/bouncers/ingress-nginx.mdx @@ -260,7 +260,7 @@ API_KEY= CrowdSec Local API key. -Generated with [`sudo cscli bouncers add`](/u/getting_started/installation/linux) command. +Generated with the [`sudo cscli bouncers add`](/u/bouncers/intro#generate-an-api-key-for-your-bouncer) command. ### `API_URL` diff --git a/crowdsec-docs/unversioned/bouncers/nginx.mdx b/crowdsec-docs/unversioned/bouncers/nginx.mdx index 694205a1d..44f2cfe0b 100644 --- a/crowdsec-docs/unversioned/bouncers/nginx.mdx +++ b/crowdsec-docs/unversioned/bouncers/nginx.mdx @@ -385,7 +385,7 @@ API_KEY= CrowdSec Local API key. -Generated with [`sudo cscli bouncers add`](/u/getting_started/installation/linux) command. +Generated with the [`sudo cscli bouncers add`](/u/bouncers/intro#generate-an-api-key-for-your-bouncer) command. ### `API_URL` diff --git a/crowdsec-docs/unversioned/bouncers/openresty.mdx b/crowdsec-docs/unversioned/bouncers/openresty.mdx index 79ee9f3b8..38ee3f420 100644 --- a/crowdsec-docs/unversioned/bouncers/openresty.mdx +++ b/crowdsec-docs/unversioned/bouncers/openresty.mdx @@ -372,7 +372,7 @@ API_KEY= CrowdSec Local API key. -Generated with [`sudo cscli bouncers add`](/u/getting_started/installation/linux) command. +Generated with the [`sudo cscli bouncers add`](/u/bouncers/intro#generate-an-api-key-for-your-bouncer) command. ### `API_URL` diff --git a/crowdsec-docs/unversioned/console/blocklists/details.md b/crowdsec-docs/unversioned/console/blocklists/details.md index 83fe272f4..487821e2f 100644 --- a/crowdsec-docs/unversioned/console/blocklists/details.md +++ b/crowdsec-docs/unversioned/console/blocklists/details.md @@ -21,7 +21,7 @@ The following insights use two main approaches to demonstrate the overall qualit * The frequency and impact of updates * The quality of the content can be composed of 4 different metrics: * For curated third-party blocklists, the number of IPs removed due to being identified as [false positives](/cti_api/taxonomy/false_positives.mdx) by CrowdSec. - * The quantity of IPs that are also present in the CrowdSec Intelligence blocklist (LINK to CSI explanation). + * The quantity of IPs that are also present in the CrowdSec Intelligence blocklist. * The number of IPs that have been reportedly seen by CrowdSec agents. * The amount of IPs unique to this blocklist, not present in any other blocklist. diff --git a/crowdsec-docs/unversioned/console/ip_reputation/search_ui.mdx b/crowdsec-docs/unversioned/console/ip_reputation/search_ui.mdx index 078a15b9a..9500cbfe8 100644 --- a/crowdsec-docs/unversioned/console/ip_reputation/search_ui.mdx +++ b/crowdsec-docs/unversioned/console/ip_reputation/search_ui.mdx @@ -51,7 +51,7 @@ A dynamic leaderboard displays the top 10 most aggressive IPs observed by CrowdS - The geographical location of the IP. - The IP range - The AS -- The background noise level (More info [here](https://doc.crowdsec.net/u/console/alerts/background_noise)) +- The background noise level (More info [here](/u/console/alerts/background_noise)) Clicking on an IP in the list takes you to its detail page, where you can explore its full profile. diff --git a/crowdsec-docs/unversioned/console/premium_upgrade/optimal_setup.mdx b/crowdsec-docs/unversioned/console/premium_upgrade/optimal_setup.mdx index bd7e29769..5274aab25 100644 --- a/crowdsec-docs/unversioned/console/premium_upgrade/optimal_setup.mdx +++ b/crowdsec-docs/unversioned/console/premium_upgrade/optimal_setup.mdx @@ -208,7 +208,7 @@ You may want **all** engines in a single Premium organization if: - You need extended retention across **all environments** for compliance - Your team investigates attacks in staging/dev environments regularly - You want centralized allowlists and blocklists everywhere -- You're an MSP managing multiple client environments (use [Multi-Organization](/u/console/premium_upgrade/features_overview) instead) +- You're an MSP managing multiple client environments (use [Multi-Organization](/u/console/premium_upgrade) instead) --- diff --git a/crowdsec-docs/unversioned/console/service_api/allowlists.mdx b/crowdsec-docs/unversioned/console/service_api/allowlists.mdx index db2c3fe01..3665dfffc 100644 --- a/crowdsec-docs/unversioned/console/service_api/allowlists.mdx +++ b/crowdsec-docs/unversioned/console/service_api/allowlists.mdx @@ -414,7 +414,7 @@ print(response) When [subscribing to allowlists](https://admin.api.crowdsec.net/v1/docs#tag/Allowlists/operation/subscribeAllowlist), you can use various `entity_type` : - - A [Security Engine](/u/getting_started/intro) (entity_type `engine`). [Remediation Components (Bouncers)](https://doc.crowdsec.net/u/bouncers/intro) connected to it will benefit from the allowlist. + - A [Security Engine](/u/getting_started/intro) (entity_type `engine`). [Remediation Components (Bouncers)](/u/bouncers/intro) connected to it will benefit from the allowlist. - A [Firewall Integration](/u/integrations/intro) (entity_type `firewall_integration`). This lets you benefit from allowlists directly on your existing firewall appliances (CISCO, F5, Palo Alto etc.) without having to install a Security Engine or "Bouncer". - A [Remediation Component Integration](/u/bouncers/intro) (entity_type `remediation_component_integration`). This allows to use a "Bouncer" directly without having to deploy a Security Engine. - You can as well subscribe via a `tag` (entity_type `tag`). This means that future Security Engines associated to this tag will **automatically** be subscribed to the allowlist. diff --git a/crowdsec-docs/unversioned/console/service_api/blocklists.mdx b/crowdsec-docs/unversioned/console/service_api/blocklists.mdx index 8b80892b9..93b35ee39 100644 --- a/crowdsec-docs/unversioned/console/service_api/blocklists.mdx +++ b/crowdsec-docs/unversioned/console/service_api/blocklists.mdx @@ -181,9 +181,9 @@ print(response) Subscribing an entity to a blocklist makes that entity pull and enforce the list. The `entity_type` field selects what you target: -- A [Security Engine](https://doc.crowdsec.net/docs/next/intro) (`engine`). [Remediation Components (Bouncers)](https://doc.crowdsec.net/u/bouncers/intro) connected to it enforce the blocklist. +- A [Security Engine](/docs/next/intro) (`engine`). [Remediation Components (Bouncers)](/u/bouncers/intro) connected to it enforce the blocklist. - A [Firewall Integration](/u/integrations/intro) (`firewall_integration`): use blocklists directly on existing firewall appliances (Cisco, F5, Palo Alto…) without a Security Engine or bouncer. -- A [Remediation Component](https://doc.crowdsec.net/u/bouncers/intro) (`remediation_component_integration`): use a bouncer directly without a Security Engine. +- A [Remediation Component](/u/bouncers/intro) (`remediation_component_integration`): use a bouncer directly without a Security Engine. - A `tag`: every Security Engine carrying that tag is subscribed **automatically**, including future ones. - An `org`: every Security Engine enrolled in the org is subscribed **automatically**, including future ones. diff --git a/crowdsec-docs/unversioned/cti_api/api_integration/integration_ms_sentinel.md b/crowdsec-docs/unversioned/cti_api/api_integration/integration_ms_sentinel.md index 5bb1ba8c2..b4c793c5d 100644 --- a/crowdsec-docs/unversioned/cti_api/api_integration/integration_ms_sentinel.md +++ b/crowdsec-docs/unversioned/cti_api/api_integration/integration_ms_sentinel.md @@ -11,7 +11,7 @@ This documentation will guide you through deploying the playbook, configuring th ## Prerequisites: Get Your CTI API Key Before configuring the Logic App, you'll need a CrowdSec CTI API key. -For detailed instructions on obtaining your API key, check out the [CTI API Getting Started guide](/u/console/ip_reputation/api_keys). +For detailed instructions on obtaining your API key, check out the [CTI API Keys guide](/u/console/ip_reputation/api_keys). :::info If you need higher quotas for your CTI API key to handle larger volumes of queries, please [contact us](https://www.crowdsec.net/contact-crowdsec) to discuss custom quotas. ::: diff --git a/crowdsec-docs/unversioned/cti_api/api_integration/integration_paloalto_xsoar.md b/crowdsec-docs/unversioned/cti_api/api_integration/integration_paloalto_xsoar.md index 4b4d8b168..b0134833b 100644 --- a/crowdsec-docs/unversioned/cti_api/api_integration/integration_paloalto_xsoar.md +++ b/crowdsec-docs/unversioned/cti_api/api_integration/integration_paloalto_xsoar.md @@ -11,7 +11,7 @@ The **PaloAlto XSOAR/XSIAM - Cortex Plugin** allows you to obtain a detailed rep The integration is available directly from within Cortex XSOAR. * Find and add an instance of the CrowdSec data enrichment. -* Fill in the API key you generated from the [console interface](https://docs.crowdsec.net/u/console/ip_reputation/api_keys/). +* Fill in the API key you generated in the Console (see [how to create a CTI API key](https://docs.crowdsec.net/u/console/ip_reputation/api_keys/)). ![Cortex XSOAR integration](/img/cortex-XSOAR-find-integration.png) If you need to download it you can find it [here](https://cortex.marketplace.pan.dev/marketplace/details/CrowdSec/). You can also refer to the [integration documentation](https://xsoar.pan.dev/docs/reference/integrations/crowd-sec). diff --git a/crowdsec-docs/unversioned/cti_api/api_integration/integration_splunk_siem.md b/crowdsec-docs/unversioned/cti_api/api_integration/integration_splunk_siem.md index 8d193ebb5..7b743cb0f 100644 --- a/crowdsec-docs/unversioned/cti_api/api_integration/integration_splunk_siem.md +++ b/crowdsec-docs/unversioned/cti_api/api_integration/integration_splunk_siem.md @@ -174,7 +174,7 @@ The first time you setup the local dump feature, you need to download manually t After that, you can look up IPs using the local databases. -If an IP address is not found in the local CrowdSec CTI database, the app automatically falls back to the bundled **CIRCL** ([circl.lu](https://data.public.lu/en/datasets/)) MMDB dataset to enrich the event with at least country and AS/ASN information. This ensures that Offline replication always returns basic geolocation and network owner context, even when CrowdSec CTI has no match for a given IP. +If an IP address is not found in the local CrowdSec CTI database, the app automatically falls back to the bundled **CIRCL** ([data.public.lu](https://data.public.lu/en/datasets/)) MMDB dataset to enrich the event with at least country and AS/ASN information. This ensures that Offline replication always returns basic geolocation and network owner context, even when CrowdSec CTI has no match for a given IP. :::warning diff --git a/crowdsec-docs/unversioned/cti_api/intro.mdx b/crowdsec-docs/unversioned/cti_api/intro.mdx index 68a4bc799..2a6edb75d 100644 --- a/crowdsec-docs/unversioned/cti_api/intro.mdx +++ b/crowdsec-docs/unversioned/cti_api/intro.mdx @@ -59,7 +59,7 @@ export const GREEN = "var(--cs-teal)"; title="Enrich Alerts via API" desc="Use the CTI API to add CrowdSec IP context to SIEM alerts, SOAR workflows, TIPs, scripts, and internal tools." links={[ - { label: "API quickstart", href: "/u/cti_api/api_introduction" }, + { label: "APIs overview", href: "/u/cti_api/api_introduction" }, { label: "All integrations", href: "/u/cti_api/api_integration/integration_intro" }, ]} /> diff --git a/crowdsec-docs/unversioned/cti_api/taxonomy/cti_fields.md b/crowdsec-docs/unversioned/cti_api/taxonomy/cti_fields.md index feadef1c7..ef482a513 100644 --- a/crowdsec-docs/unversioned/cti_api/taxonomy/cti_fields.md +++ b/crowdsec-docs/unversioned/cti_api/taxonomy/cti_fields.md @@ -302,7 +302,7 @@ The possible values are: "ip_range_score" : 5 ``` -The malevolence score of the IP range the IP belongs to. 0 is unknown, 1 means a couple of reported IPs, 5 is the highest level for the most aggressive range. See "scoring" above. +The malevolence score of the IP range the IP belongs to. 0 is unknown, 1 means a couple of reported IPs, 5 is the highest level for the most aggressive range. See [`ip_range_24_score`](#ip_range_24_score) above. ## `as_name` diff --git a/crowdsec-docs/unversioned/cti_api/taxonomy/intro.md b/crowdsec-docs/unversioned/cti_api/taxonomy/intro.md index b0e840086..4a5bf4150 100644 --- a/crowdsec-docs/unversioned/cti_api/taxonomy/intro.md +++ b/crowdsec-docs/unversioned/cti_api/taxonomy/intro.md @@ -18,5 +18,5 @@ This section covers the following key aspects: - [**CTI Scores**](/u/cti_api/taxonomy/scores): Detailed assessments computed for an IP address over different periods (daily, weekly, monthly, and overall). - [**Behaviors**](/u/cti_api/taxonomy/behaviors): List of defined behaviors linked to an IP address, providing context for its activity. - [**Classifications**](/u/cti_api/taxonomy/classifications): Category of an IP address, helping to identify whether an IP is part of a known group, network or other defined role, providing important context to understand its potential behavior. -- [**False Positives**](/u/cti_api/taxonomy/false_positives): Categories of potential false positives, ensuring accurate analysis and interpretation of API results. +- [**Safe Classifications**](/u/cti_api/taxonomy/false_positives): Categories of potential false positives, ensuring accurate analysis and interpretation of API results. - [**Scenarios**](/u/cti_api/taxonomy/scenarios): A detailed view of the scenarios that triggered reports for an IP address, helping to identify patterns or threats. diff --git a/crowdsec-docs/unversioned/getting_started/installation/kubernetes.mdx b/crowdsec-docs/unversioned/getting_started/installation/kubernetes.mdx index 2939f9615..8db9b95df 100644 --- a/crowdsec-docs/unversioned/getting_started/installation/kubernetes.mdx +++ b/crowdsec-docs/unversioned/getting_started/installation/kubernetes.mdx @@ -172,7 +172,7 @@ For now, we support: - [Traefik Ingress](/bouncers/traefik.mdx) Please note that the [Traefik Kubernetes Ingress (third-party -development)](https://plugins.traefik.io/plugins/6335346ca4caa9ddeffda116/crowdsec-bouncer-traefik-plugin)) +development)](https://plugins.traefik.io/plugins/6335346ca4caa9ddeffda116/crowdsec-bouncer-traefik-plugin) is maintained outside CrowdSec. In the crowdsec helm `values.yaml` file: diff --git a/crowdsec-docs/unversioned/troubleshooting/intro.md b/crowdsec-docs/unversioned/troubleshooting/intro.md index 77328e220..76db18de8 100644 --- a/crowdsec-docs/unversioned/troubleshooting/intro.md +++ b/crowdsec-docs/unversioned/troubleshooting/intro.md @@ -11,7 +11,7 @@ This is to better reflect the role of each component within the CrowdSec ecosyst # Troubleshooting We have extended our troubleshooting documentation to cover more common issues and questions. -If you have suggestions, please open an [issue here](https://github.com/crowdsecurity/crowdsec-docs). +If you have suggestions, please open an [issue here](https://github.com/crowdsecurity/crowdsec-docs/issues). Also, check our 🩺 [**Stack Health-Check page**](/u/getting_started/health_check) to verify that **Detection**, **Community Sharing**, and **Remediation** are working properly. diff --git a/crowdsec-docs/unversioned/troubleshooting/issue_integration_rc_offline.md b/crowdsec-docs/unversioned/troubleshooting/issue_integration_rc_offline.md index 290207595..ad6513b81 100644 --- a/crowdsec-docs/unversioned/troubleshooting/issue_integration_rc_offline.md +++ b/crowdsec-docs/unversioned/troubleshooting/issue_integration_rc_offline.md @@ -112,7 +112,7 @@ For detailed setup, configuration, and troubleshooting specific to your bouncer ## Related Issues -- [Firewall Integration Offline](/u/troubleshooting/issue_integration_fw_offline) - Similar issue for firewall bouncers +- [Firewall Integration Offline](/u/troubleshooting/issue_integration_fw_offline) - Similar issue for firewall integrations - [Remediation Components Troubleshooting](/u/troubleshooting/remediation_components) - General bouncer issues ## Getting Help diff --git a/crowdsec-docs/unversioned/troubleshooting/issue_lp_no_logs_parsed.md b/crowdsec-docs/unversioned/troubleshooting/issue_lp_no_logs_parsed.md index 2e29c7cdf..1a03d4c11 100644 --- a/crowdsec-docs/unversioned/troubleshooting/issue_lp_no_logs_parsed.md +++ b/crowdsec-docs/unversioned/troubleshooting/issue_lp_no_logs_parsed.md @@ -15,7 +15,7 @@ This means the acquisition is working, but parsers can't interpret the log forma ## Common Root Causes - [**Missing collection or parsers**](#missing-collection-or-parsers): The required parser collection for your log format isn't installed. -- [**Custom or unexpected log format**](#acquisition-typeprogram-mismatch): Logs don't match the format expected by the parser (custom format, version mismatch, etc.). +- [**Acquisition type/program mismatch**](#acquisition-typeprogram-mismatch): Logs don't match the format expected by the parser (custom format, version mismatch, etc.). ## Diagnosis & Resolution diff --git a/crowdsec-docs/unversioned/troubleshooting/issue_se_no_active_rc.md b/crowdsec-docs/unversioned/troubleshooting/issue_se_no_active_rc.md index 4854cb3c2..fb719925c 100644 --- a/crowdsec-docs/unversioned/troubleshooting/issue_se_no_active_rc.md +++ b/crowdsec-docs/unversioned/troubleshooting/issue_se_no_active_rc.md @@ -41,7 +41,7 @@ Open the file and verify the following fields are present and correctly set: - `api_key`: a valid API key generated with `cscli bouncers add` :::warning -Properties may change slightly, check the specific [configuration for your bouncer](http://localhost:3000/u/bouncers/intro) +Property names may vary slightly; check the [configuration for your bouncer](/u/bouncers/intro). ::: #### 🛠️ Fix the configuration and restart the RC diff --git a/crowdsec-docs/unversioned/troubleshooting/security_engine.mdx b/crowdsec-docs/unversioned/troubleshooting/security_engine.mdx index 0cdded7d9..2b546e5fe 100644 --- a/crowdsec-docs/unversioned/troubleshooting/security_engine.mdx +++ b/crowdsec-docs/unversioned/troubleshooting/security_engine.mdx @@ -304,7 +304,7 @@ CrowdSec Security Engine is open-source security software. See the [overview](/d ### What language is it written in? -CrowdSec Security Engine is written in [Golang](https://golang.org/). +CrowdSec Security Engine is written in [Golang](https://go.dev/). ### What resources are needed to run Security Engine? diff --git a/crowdsec-docs/unversioned/troubleshooting/usecases.mdx b/crowdsec-docs/unversioned/troubleshooting/usecases.mdx index 9311dca94..f3f3c94d3 100644 --- a/crowdsec-docs/unversioned/troubleshooting/usecases.mdx +++ b/crowdsec-docs/unversioned/troubleshooting/usecases.mdx @@ -342,12 +342,12 @@ Quickly choose among qualified malicious actors regrouped by industry, behaviors -- [IP reputation lists / Blocklists Catalog doc ↗️](https://app.crowdsec.net/blocklists/search) +- [IP reputation lists / Blocklist Catalog ↗️](https://app.crowdsec.net/blocklists/search) - [Retrieving merged lists via HTTPS endpoints](/u/integrations/intro) - [Retrieving Blocklists via API](/u/console/service_api/blocklists#download-blocklist-content) - [MISP Feed from Security Engine's alerts](https://doc.crowdsec.net/u/bouncers/misp-feed-generator) - [Upcoming CrowdSec MISP Feeds ↗️](https://roadmap.crowdsec.net/c/48-misp-feed) -- [Contact Us for custom requests ↗️](https://www.crowdsec.net/business-requests?interest=CTI%20subscription)) +- [Contact Us for custom requests ↗️](https://www.crowdsec.net/business-requests?interest=CTI%20subscription) diff --git a/crowdsec-docs/versioned_docs/version-v1.6/appsec/configuration.md b/crowdsec-docs/versioned_docs/version-v1.6/appsec/configuration.md index cc671ff75..bac6192dc 100644 --- a/crowdsec-docs/versioned_docs/version-v1.6/appsec/configuration.md +++ b/crowdsec-docs/versioned_docs/version-v1.6/appsec/configuration.md @@ -33,7 +33,7 @@ Often you will want multiple AppSec configurations to define groups of rules tha Use the `appsec_configs` *(with an S)* parameter to load multiple configurations that work together. In the following example we have two configurations: -- One with [CrowdSec default AppSec rules ↗️](https://app.crowdsec.net/hub/author/crowdsecurity/appsec-configurations/appsec-default) running in in-band mode +- One with [CrowdSec default AppSec rules ↗️](https://app.crowdsec.net/hub/author/crowdsecurity/waf-configurations/appsec-default) running in in-band mode - The other for the [CRS rules ↗️](https://app.crowdsec.net/hub/author/crowdsecurity/collections/appsec-crs) that run in out-of-band mode by default. ```yaml title="/etc/crowdsec/acquis.d/appsec.yaml" diff --git a/crowdsec-docs/versioned_docs/version-v1.6/appsec/quickstart/nginxopenresty.mdx b/crowdsec-docs/versioned_docs/version-v1.6/appsec/quickstart/nginxopenresty.mdx index 0deba8135..e1737ff93 100644 --- a/crowdsec-docs/versioned_docs/version-v1.6/appsec/quickstart/nginxopenresty.mdx +++ b/crowdsec-docs/versioned_docs/version-v1.6/appsec/quickstart/nginxopenresty.mdx @@ -178,7 +178,7 @@ Content-Type: text/plain; charset=utf-8 3. Emit a malevolent request to the Appsec Component: :::info -We're trying to access a `.env` file, a [common way to retrieve credentials left by mistake](https://app.crowdsec.net/hub/author/crowdsecurity/appsec-rules/vpatch-env-access). +We're trying to access a `.env` file, a [common way to retrieve credentials left by mistake](https://app.crowdsec.net/hub/author/crowdsecurity/waf-rules/vpatch-env-access). ::: ```bash @@ -273,7 +273,7 @@ What happened in the test that we just did is: 1. We did a request (`localhost/.env`) to our local webserver 2. Thanks to the Remediation Component configuration, forwarded the request to `http://127.0.0.1:7422` 3. Our AppSec Component, listening on `http://127.0.0.1:7422` analyzed the request - 4. The request matches the [AppSec rule to detect .env access](https://app.crowdsec.net/hub/author/crowdsecurity/appsec-rules/vpatch-env-access) + 4. The request matches the [AppSec rule to detect .env access](https://app.crowdsec.net/hub/author/crowdsecurity/waf-rules/vpatch-env-access) 5. The AppSec Component thus answered with [HTTP 403](https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/403) to the Remediation Component, indicating that the request must be blocked 6. The web server then presented us with the default "request blocked" page. diff --git a/crowdsec-docs/versioned_docs/version-v1.6/appsec/quickstart/wordpress.mdx b/crowdsec-docs/versioned_docs/version-v1.6/appsec/quickstart/wordpress.mdx index d4a7c66cd..2889f286d 100644 --- a/crowdsec-docs/versioned_docs/version-v1.6/appsec/quickstart/wordpress.mdx +++ b/crowdsec-docs/versioned_docs/version-v1.6/appsec/quickstart/wordpress.mdx @@ -172,7 +172,7 @@ Content-Type: text/plain; charset=utf-8 3. Emit a malevolent request to the Appsec Component: :::info -We're trying to access a `.env` file, a [common way to retrieve credentials left by mistake](https://app.crowdsec.net/hub/author/crowdsecurity/appsec-rules/vpatch-env-access). +We're trying to access a `.env` file, a [common way to retrieve credentials left by mistake](https://app.crowdsec.net/hub/author/crowdsecurity/waf-rules/vpatch-env-access). ::: ```bash @@ -238,7 +238,7 @@ We're assuming WordPress is running on your local machine. Please adjust your te ::: To test the AppSec functionality, you need to make a request that will go through the WordPress loading process. Try accessing a WordPress page with a malicious payload in the URL parameters or body. -For example, we can post a request with a body that contains a malicious payload, such as a [Remote Code Execution (CVE-2022-22965)](https://app.crowdsec.net/hub/author/crowdsecurity/appsec-rules/vpatch-CVE-2022-22965) attempt. +For example, we can post a request with a body that contains a malicious payload, such as a [Remote Code Execution (CVE-2022-22965)](https://app.crowdsec.net/hub/author/crowdsecurity/waf-rules/vpatch-CVE-2022-22965) attempt. ```bash curl -X POST https:/// -d "class.module.classLoader.resources." -o /dev/null -s -w "%{http_code}" diff --git a/crowdsec-docs/versioned_docs/version-v1.6/appsec/troubleshooting.md b/crowdsec-docs/versioned_docs/version-v1.6/appsec/troubleshooting.md index c0a20e5e7..a02f95118 100644 --- a/crowdsec-docs/versioned_docs/version-v1.6/appsec/troubleshooting.md +++ b/crowdsec-docs/versioned_docs/version-v1.6/appsec/troubleshooting.md @@ -175,7 +175,7 @@ To test that the AppSec Component is working correctly, you can send requests di We are going to test that the AppSec Component detects correctly CVE-2023-42793, which is part of the [virtual patching collection](https://app.crowdsec.net/hub/author/crowdsecurity/collections/appsec-virtual-patching), that should be installed for this to work (see `cscli appsec-rules list`). -[This rule](https://app.crowdsec.net/hub/author/crowdsecurity/appsec-rules/vpatch-CVE-2023-42793) is pretty straightforward and detects requests to an URI ending with `/rpc2`: +[This rule](https://app.crowdsec.net/hub/author/crowdsecurity/waf-rules/vpatch-CVE-2023-42793) is pretty straightforward and detects requests to an URI ending with `/rpc2`: > cat /etc/crowdsec/appsec-rules/vpatch-CVE-2023-42793.yaml ```yaml diff --git a/crowdsec-docs/versioned_docs/version-v1.6/contributing/code.md b/crowdsec-docs/versioned_docs/version-v1.6/contributing/code.md index 3629664a2..75fe78e9e 100644 --- a/crowdsec-docs/versioned_docs/version-v1.6/contributing/code.md +++ b/crowdsec-docs/versioned_docs/version-v1.6/contributing/code.md @@ -39,7 +39,7 @@ Run with `make bats-build bats-fixture` once, then `make bats-test-hub`. We receive contributions on the _master_ branch (or _main_, in recent repositories). To contribute, fork the repository, commit the code in a dedicated branch and ask for a Pull Request. By default it will target the master branch on the upstream repository, so in most cases you don't have to change anything. It will be reviewed by the core team and merged when ready, possibly after some changes. It is recommended to open [an Issue linked to the PR](https://docs.github.com/en/issues/tracking-your-work-with-issues/linking-a-pull-request-to-an-issue) in order to discuss it and track its progression. -You may also receive feedback from the CI scripts (directory [.github/workflows](https://github.com/crowdsecurity/hub/tree/master/.github/workflows)) that run a series of linters and tests. You are encouraged to run these on your environment as well, before committing (see the "Testing" section above, and "Style guide" below). +You may also receive feedback from the CI scripts (directory [.github/workflows](https://github.com/crowdsecurity/crowdsec/tree/master/.github/workflows)) that run a series of linters and tests. You are encouraged to run these on your environment as well, before committing (see the "Testing" section above). ## Release branches diff --git a/crowdsec-docs/versioned_docs/version-v1.6/contributing/specs/bouncer_appsec_specs.mdx b/crowdsec-docs/versioned_docs/version-v1.6/contributing/specs/bouncer_appsec_specs.mdx index 19762ab97..f3bb50504 100644 --- a/crowdsec-docs/versioned_docs/version-v1.6/contributing/specs/bouncer_appsec_specs.mdx +++ b/crowdsec-docs/versioned_docs/version-v1.6/contributing/specs/bouncer_appsec_specs.mdx @@ -318,7 +318,7 @@ You can refer to the AppSec documentation to test request forwarding. * **startup:** set it to **TRUE** for the **initial call** to get all decisions *(when False you’ll get the delta from your last call)* * **scopes:** “ip,range” is the only relevant value when remediating on IPs -* **origins:** Leave blank to allow all origins, test your configurable origins with [those tests](#decision-example) +* **origins:** Leave blank to allow all origins, check your configurable origins against the [decision example](#decision-example) * **scenarios_containing:** leave blank by default, allow change in config * **scenarios_not_containing:** leave blank by default, allow change in config @@ -330,7 +330,7 @@ You can refer to the AppSec documentation to test request forwarding. * **ip:** ignore/leave blank: shortcut for scope:ip \+ value * **range:** ignore/leave blank: shortcut for scope:range \+ value * **contains:** leave blank by default, configurable by user -* **origins:** Leave blank to allow all origins, test your configurable origins with [those tests](#decision-example) +* **origins:** Leave blank to allow all origins, check your configurable origins against the [decision example](#decision-example) * **scenarios_containing:** leave blank by default, allow change in config * **scenarios_not_containing:** leave blank by default, allow change in config diff --git a/crowdsec-docs/versioned_docs/version-v1.6/expr/strings_helpers.md b/crowdsec-docs/versioned_docs/version-v1.6/expr/strings_helpers.md index 6dd4b5081..ea97a3ecc 100644 --- a/crowdsec-docs/versioned_docs/version-v1.6/expr/strings_helpers.md +++ b/crowdsec-docs/versioned_docs/version-v1.6/expr/strings_helpers.md @@ -94,8 +94,6 @@ If sep is empty, Split splits after each UTF-8 sequence. If both s and sep are e It is equivalent to SplitN with a count of -1. -To split around the first instance of a separator, see Cut. - ### `SplitAfter(s string, sep string) []string` SplitAfter slices s into all substrings after each instance of sep and returns a slice of those substrings. @@ -135,8 +133,6 @@ n < 0: all substrings Edge cases for s and sep (for example, empty strings) are handled as described in the documentation for Split. -To split around the first instance of a separator, see Cut. - ### `Replace(s string, old string, new string, n int) string` Replace returns a copy of the string s with the first n non-overlapping instances of old replaced by new. If old is empty, it matches at the beginning of the string and after each UTF-8 sequence, yielding up to k+1 replacements for a k-rune string. If n < 0, there is no limit on the number of replacements. diff --git a/crowdsec-docs/versioned_docs/version-v1.6/getting_started/crowdsec_tour.mdx b/crowdsec-docs/versioned_docs/version-v1.6/getting_started/crowdsec_tour.mdx index 253149320..cd89915f0 100644 --- a/crowdsec-docs/versioned_docs/version-v1.6/getting_started/crowdsec_tour.mdx +++ b/crowdsec-docs/versioned_docs/version-v1.6/getting_started/crowdsec_tour.mdx @@ -104,7 +104,7 @@ sudo cscli decisions list If you just deployed CrowdSec, the list might be empty, but don't worry, it simply means you haven't yet been attacked, congrats! Adding `-a` flag will as well list the decisions you received from the [community blocklist](/central_api/intro.md). -Check [decisions](/u/user_guides/hub_mgmt) management for more ! +Check [decisions management](/u/user_guides/decisions_mgmt) for more!
Listing decisions example diff --git a/crowdsec-docs/versioned_docs/version-v1.6/intro.mdx b/crowdsec-docs/versioned_docs/version-v1.6/intro.mdx index ad42d526f..ed3e7da13 100644 --- a/crowdsec-docs/versioned_docs/version-v1.6/intro.mdx +++ b/crowdsec-docs/versioned_docs/version-v1.6/intro.mdx @@ -10,7 +10,7 @@ import AcademyPromo from "@site/src/components/academy-promo" The [CrowdSec Security Engine](https://github.com/crowdsecurity/crowdsec) is an open-source, lightweight software that detects and blocks malicious actors from accessing your systems at various levels, using log and HTTP Requests analysis with threat patterns called scenarios. -CrowdSec is a modular security tool offering [behavior-based detection](https://app.crowdsec.net/hub/collections), including [AppSec rules](https://app.crowdsec.net/hub/appsec-rules), and optional components to block threats called [Remediation Components](https://app.crowdsec.net/hub/remediation-components) +CrowdSec is a modular security tool offering [behavior-based detection](https://app.crowdsec.net/hub/collections), including [AppSec rules](https://app.crowdsec.net/hub/waf-rules), and optional components to block threats called [Remediation Components](https://app.crowdsec.net/hub/remediation-components)
diff --git a/crowdsec-docs/versioned_docs/version-v1.6/log_processor/data_sources/appsec.md b/crowdsec-docs/versioned_docs/version-v1.6/log_processor/data_sources/appsec.md index ea438695c..be6c391b0 100644 --- a/crowdsec-docs/versioned_docs/version-v1.6/log_processor/data_sources/appsec.md +++ b/crowdsec-docs/versioned_docs/version-v1.6/log_processor/data_sources/appsec.md @@ -53,7 +53,7 @@ Number of routines to use to process the requests. Defaults to 1. ### `auth_cache_duration` -How long to cache the auth token for. Accepts values supported by [time.ParseDuration](https://golang.org/pkg/time/#ParseDuration). +How long to cache the auth token for. Accepts values supported by [time.ParseDuration](https://pkg.go.dev/time#ParseDuration). Defaults to 1m. ### `cert_file` diff --git a/crowdsec-docs/versioned_docs/version-v1.6/log_processor/data_sources/cloudwatch.md b/crowdsec-docs/versioned_docs/version-v1.6/log_processor/data_sources/cloudwatch.md index 32d014e39..f360f4f58 100644 --- a/crowdsec-docs/versioned_docs/version-v1.6/log_processor/data_sources/cloudwatch.md +++ b/crowdsec-docs/versioned_docs/version-v1.6/log_processor/data_sources/cloudwatch.md @@ -38,7 +38,7 @@ labels: type: apigateway ``` -Look at the `configuration parameters` to view all supported options. +See [Parameters](#parameters) for all supported options. ## Parameters diff --git a/crowdsec-docs/versioned_docs/version-v1.6/log_processor/data_sources/docker.md b/crowdsec-docs/versioned_docs/version-v1.6/log_processor/data_sources/docker.md index 9dcb13b0f..f358aae99 100644 --- a/crowdsec-docs/versioned_docs/version-v1.6/log_processor/data_sources/docker.md +++ b/crowdsec-docs/versioned_docs/version-v1.6/log_processor/data_sources/docker.md @@ -31,7 +31,7 @@ labels: type: log_type ``` -Look at the `configuration parameters` to view all supported options. +See [Parameters](#parameters) for all supported options. ## Parameters diff --git a/crowdsec-docs/versioned_docs/version-v1.6/log_processor/data_sources/kafka.md b/crowdsec-docs/versioned_docs/version-v1.6/log_processor/data_sources/kafka.md index 34f3d02f8..5fef13fc1 100644 --- a/crowdsec-docs/versioned_docs/version-v1.6/log_processor/data_sources/kafka.md +++ b/crowdsec-docs/versioned_docs/version-v1.6/log_processor/data_sources/kafka.md @@ -63,7 +63,7 @@ batch: The reader will always start from the latest offset. ::: -Look at the `configuration parameters` to view all supported options. +See [Parameters](#parameters) for all supported options. ## Parameters diff --git a/crowdsec-docs/versioned_docs/version-v1.6/log_processor/data_sources/kinesis.md b/crowdsec-docs/versioned_docs/version-v1.6/log_processor/data_sources/kinesis.md index d7c30ea91..79205a7e1 100644 --- a/crowdsec-docs/versioned_docs/version-v1.6/log_processor/data_sources/kinesis.md +++ b/crowdsec-docs/versioned_docs/version-v1.6/log_processor/data_sources/kinesis.md @@ -30,7 +30,7 @@ labels: If your stream is written to by a [Cloudwatch subscription filter](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/SubscriptionFilters.html), you will need to pass the `from_subscription` parameter, or the Security Engine won't be able to parse the content of the message. ::: -Look at the `configuration parameters` to view all supported options. +See [Parameters](#parameters) for all supported options. ## Parameters diff --git a/crowdsec-docs/versioned_docs/version-v1.6/log_processor/data_sources/kubernetes_audit.md b/crowdsec-docs/versioned_docs/version-v1.6/log_processor/data_sources/kubernetes_audit.md index 7cafaaefc..7822361c1 100644 --- a/crowdsec-docs/versioned_docs/version-v1.6/log_processor/data_sources/kubernetes_audit.md +++ b/crowdsec-docs/versioned_docs/version-v1.6/log_processor/data_sources/kubernetes_audit.md @@ -16,7 +16,7 @@ labels: type: k8s-audit ``` -Look at the `configuration parameters` to view all supported options. +See [Parameters](#parameters) for all supported options. ## Parameters diff --git a/crowdsec-docs/versioned_docs/version-v1.6/log_processor/data_sources/loki.md b/crowdsec-docs/versioned_docs/version-v1.6/log_processor/data_sources/loki.md index 42410132d..0cb2a2441 100644 --- a/crowdsec-docs/versioned_docs/version-v1.6/log_processor/data_sources/loki.md +++ b/crowdsec-docs/versioned_docs/version-v1.6/log_processor/data_sources/loki.md @@ -26,7 +26,7 @@ labels: The reader will always start at "now". ::: -Look at the `configuration parameters` to view all supported options. +See [Parameters](#parameters) for all supported options. ## Parameters diff --git a/crowdsec-docs/versioned_docs/version-v1.6/log_processor/data_sources/s3.md b/crowdsec-docs/versioned_docs/version-v1.6/log_processor/data_sources/s3.md index 29bd26a7c..35d138cfa 100644 --- a/crowdsec-docs/versioned_docs/version-v1.6/log_processor/data_sources/s3.md +++ b/crowdsec-docs/versioned_docs/version-v1.6/log_processor/data_sources/s3.md @@ -44,7 +44,7 @@ When using the `sqs` polling method, make sure the Security Engine is the only r If other processes read from the queue, then the Security Engine will miss some events. ::: -Look at the `configuration parameters` to view all supported options. +See [Parameters](#parameters) for all supported options. ## Parameters diff --git a/crowdsec-docs/versioned_docs/version-v1.6/log_processor/data_sources/victorialogs.md b/crowdsec-docs/versioned_docs/version-v1.6/log_processor/data_sources/victorialogs.md index 611ab83fc..b17dd143c 100644 --- a/crowdsec-docs/versioned_docs/version-v1.6/log_processor/data_sources/victorialogs.md +++ b/crowdsec-docs/versioned_docs/version-v1.6/log_processor/data_sources/victorialogs.md @@ -27,7 +27,7 @@ labels: The reader will always start at "now" for `tail` mode. ::: -Look at the `configuration parameters` to view all supported options. +See [Parameters](#parameters) for all supported options. ## Parameters diff --git a/crowdsec-docs/versioned_docs/version-v1.6/log_processor/scenarios/create.md b/crowdsec-docs/versioned_docs/version-v1.6/log_processor/scenarios/create.md index ec0cbde6f..6f88a54f6 100644 --- a/crowdsec-docs/versioned_docs/version-v1.6/log_processor/scenarios/create.md +++ b/crowdsec-docs/versioned_docs/version-v1.6/log_processor/scenarios/create.md @@ -129,7 +129,7 @@ We have the following fields: - a [type](/log_processor/scenarios/format.md#type): the type of bucket to use (trigger or leaky). - a [name](/log_processor/scenarios/format.md#name) - a [description](/log_processor/scenarios/format.md#description) -- a [filter](/log_processor/scenarios/format.md#type): the filter to apply on events to be filled in this bucket. +- a [filter](/log_processor/scenarios/format.md#filter): the filter to apply on events to be filled in this bucket. - a [leakspeed](/log_processor/scenarios/format.md#leakspeed) - a [capacity](/log_processor/scenarios/format.md#capacity): the number of events in the bucket before it overflows. - a [groupby](/log_processor/scenarios/format.md#groupby): a field from the event to partition the bucket. It is often the `source_ip` of the event. diff --git a/crowdsec-docs/versioned_docs/version-v1.6/log_processor/scenarios/format.md b/crowdsec-docs/versioned_docs/version-v1.6/log_processor/scenarios/format.md index 1230aa811..a144b139e 100644 --- a/crowdsec-docs/versioned_docs/version-v1.6/log_processor/scenarios/format.md +++ b/crowdsec-docs/versioned_docs/version-v1.6/log_processor/scenarios/format.md @@ -240,7 +240,7 @@ duration: 10m Only applies to `counter` buckets. A duration after which the bucket will overflow. -The format must be compatible with [golang ParseDuration format](https://golang.org/pkg/time/#ParseDuration) +The format must be compatible with [golang ParseDuration format](https://pkg.go.dev/time#ParseDuration) Examples : @@ -349,7 +349,7 @@ Only applies to `leaky` and `conditional` buckets. A duration that represents how often an event will be leaking from the bucket. -Must be compatible with [golang ParseDuration format](https://golang.org/pkg/time/#ParseDuration). +Must be compatible with [golang ParseDuration format](https://pkg.go.dev/time#ParseDuration). --- ### `condition` @@ -515,7 +515,7 @@ This is intended to limit / avoid spam of buckets that might be very rapidly tri The blackhole only applies to the individual bucket rather than the whole scenario. -Must be compatible with [golang ParseDuration format](https://golang.org/pkg/time/#ParseDuration). +Must be compatible with [golang ParseDuration format](https://pkg.go.dev/time#ParseDuration). #### Example diff --git a/crowdsec-docs/versioned_docs/version-v1.6/observability/cscli.md b/crowdsec-docs/versioned_docs/version-v1.6/observability/cscli.md index 6abb8292e..04c188795 100644 --- a/crowdsec-docs/versioned_docs/version-v1.6/observability/cscli.md +++ b/crowdsec-docs/versioned_docs/version-v1.6/observability/cscli.md @@ -7,7 +7,7 @@ sidebar_position: 2 # Crowdsec Metrics CrowdSec is instrumented using [Prometheus](https://prometheus.io/) to provide detailed metrics and traceability about what is going on. -The `cscli metrics` allows you to see a subset of the metrics exposed by crowdsec. For a more industrial solution, look into the [Grafana](/docs/next/observability/prometheus) integration. +The `cscli metrics` allows you to see a subset of the metrics exposed by crowdsec. For a more industrial solution, look into the [Grafana](/observability/prometheus.md) integration. The best way to get an overview of the available metrics is to use `cscli metrics list`: Type | Title | Description diff --git a/crowdsec-docs/versioned_docs/version-v1.7/appsec/configuration_creation_testing.md b/crowdsec-docs/versioned_docs/version-v1.7/appsec/configuration_creation_testing.md index 99be38f51..b0376f71c 100644 --- a/crowdsec-docs/versioned_docs/version-v1.7/appsec/configuration_creation_testing.md +++ b/crowdsec-docs/versioned_docs/version-v1.7/appsec/configuration_creation_testing.md @@ -19,7 +19,7 @@ Often you will want multiple AppSec configurations to define groups of rules tha Use the `appsec_configs` parameter to load multiple configurations that work together. In the following example we have two configurations: -- One with [CrowdSec default AppSec rules ↗️](https://app.crowdsec.net/hub/author/crowdsecurity/appsec-configurations/appsec-default) running in in-band mode +- One with [CrowdSec default AppSec rules ↗️](https://app.crowdsec.net/hub/author/crowdsecurity/waf-configurations/appsec-default) running in in-band mode - The other for the [CRS rules ↗️](https://app.crowdsec.net/hub/author/crowdsecurity/collections/appsec-crs) that run in out-of-band mode by default ```yaml title="/etc/crowdsec/acquis.d/appsec.yaml" @@ -92,7 +92,7 @@ When multiple AppSec configurations are loaded, they are processed in the order After updating AppSec configuration files: 1. Reload CrowdSec so it picks up the new configuration. -2. Validate behavior with your usual test traffic, or use the [generic AppSec test rule](https://app.crowdsec.net/hub/author/crowdsecurity/appsec-rules/appsec-generic-test). +2. Validate behavior with your usual test traffic, or use the [generic AppSec test rule](https://app.crowdsec.net/hub/author/crowdsecurity/waf-rules/appsec-generic-test). 3. Inspect results in logs or via `cscli metrics show appsec`. For more troubleshooting guidance, see [AppSec Troubleshooting](troubleshooting.md). diff --git a/crowdsec-docs/versioned_docs/version-v1.7/appsec/quickstart/general.mdx b/crowdsec-docs/versioned_docs/version-v1.7/appsec/quickstart/general.mdx index cdb60c0f1..2cb428ffe 100644 --- a/crowdsec-docs/versioned_docs/version-v1.7/appsec/quickstart/general.mdx +++ b/crowdsec-docs/versioned_docs/version-v1.7/appsec/quickstart/general.mdx @@ -145,7 +145,6 @@ Now that the AppSec Component is configured and running, you need to: For specific remediation component configuration, see: - [Nginx/OpenResty Setup](nginxopenresty.mdx) -- [OpenResty Setup](nginxopenresty.mdx) - [Traefik Setup](traefik.mdx) - [HAProxy (SPOA) Setup](haproxy_spoa.mdx) - [WordPress Setup](wordpress.mdx) diff --git a/crowdsec-docs/versioned_docs/version-v1.7/appsec/quickstart/haproxy_spoa.mdx b/crowdsec-docs/versioned_docs/version-v1.7/appsec/quickstart/haproxy_spoa.mdx index ac453a309..0d3ecf4df 100644 --- a/crowdsec-docs/versioned_docs/version-v1.7/appsec/quickstart/haproxy_spoa.mdx +++ b/crowdsec-docs/versioned_docs/version-v1.7/appsec/quickstart/haproxy_spoa.mdx @@ -93,7 +93,7 @@ sudo cscli metrics show appsec 1. `curl` hit HAProxy at `/.env`. 2. HAProxy forwarded the request to the SPOA remediation component. 3. The bouncer queried the AppSec Component at `appsec_url`. -4. The request matched the [`vpatch-env-access`](https://app.crowdsec.net/hub/author/crowdsecurity/appsec-rules/vpatch-env-access) rule. +4. The request matched the [`vpatch-env-access`](https://app.crowdsec.net/hub/author/crowdsecurity/waf-rules/vpatch-env-access) rule. 5. AppSec answered `403`; HAProxy blocked the request.
diff --git a/crowdsec-docs/versioned_docs/version-v1.7/appsec/quickstart/nginx-ingress.mdx b/crowdsec-docs/versioned_docs/version-v1.7/appsec/quickstart/nginx-ingress.mdx index 25eeea1e0..dc1e8e6a4 100644 --- a/crowdsec-docs/versioned_docs/version-v1.7/appsec/quickstart/nginx-ingress.mdx +++ b/crowdsec-docs/versioned_docs/version-v1.7/appsec/quickstart/nginx-ingress.mdx @@ -14,8 +14,8 @@ has known security issues, and upstream removed Lua support in version `1.12`, which this integration depends on. Do not use this for new deployments. If you are already using it, plan a migration -to another supported integration such as [Traefik](/docs/next/appsec/quickstart/traefik) -or [Envoy Gateway](/docs/next/appsec/quickstart/envoy-gateway). +to another supported integration such as [Traefik](/appsec/quickstart/traefik.mdx) +or [Envoy Gateway](/appsec/quickstart/envoy-gateway.mdx). ::: ## Objectives diff --git a/crowdsec-docs/versioned_docs/version-v1.7/appsec/quickstart/nginxopenresty.mdx b/crowdsec-docs/versioned_docs/version-v1.7/appsec/quickstart/nginxopenresty.mdx index a3a41d260..063ab1485 100644 --- a/crowdsec-docs/versioned_docs/version-v1.7/appsec/quickstart/nginxopenresty.mdx +++ b/crowdsec-docs/versioned_docs/version-v1.7/appsec/quickstart/nginxopenresty.mdx @@ -89,7 +89,7 @@ curl -I http://localhost/.env You should get an `HTTP/1.1 403 Forbidden` response. -We're hitting a `.env` file, a [common way to retrieve credentials left by mistake](https://app.crowdsec.net/hub/author/crowdsecurity/appsec-rules/vpatch-env-access) — the AppSec Component detects and blocks it. +We're hitting a `.env` file, a [common way to retrieve credentials left by mistake](https://app.crowdsec.net/hub/author/crowdsecurity/waf-rules/vpatch-env-access) — the AppSec Component detects and blocks it. Check that CrowdSec recorded the block: @@ -123,7 +123,7 @@ Appsec '127.0.0.1:7422/' Rules Metrics: 1. `curl` hit your web server at `/.env`. 2. The bouncer forwarded the request to the AppSec Component on `127.0.0.1:7422`. -3. The request matched the [`vpatch-env-access`](https://app.crowdsec.net/hub/author/crowdsecurity/appsec-rules/vpatch-env-access) rule. +3. The request matched the [`vpatch-env-access`](https://app.crowdsec.net/hub/author/crowdsecurity/waf-rules/vpatch-env-access) rule. 4. The AppSec Component answered `403`, the bouncer enforced it, and the web server returned the CrowdSec ban page.
diff --git a/crowdsec-docs/versioned_docs/version-v1.7/appsec/quickstart/npmplus.mdx b/crowdsec-docs/versioned_docs/version-v1.7/appsec/quickstart/npmplus.mdx index 19862a9ac..bddf3ebc4 100644 --- a/crowdsec-docs/versioned_docs/version-v1.7/appsec/quickstart/npmplus.mdx +++ b/crowdsec-docs/versioned_docs/version-v1.7/appsec/quickstart/npmplus.mdx @@ -161,7 +161,7 @@ Appsec '0.0.0.0:7422/' Rules Metrics: 1. `curl` hit NPMplus at `/.env`. 2. The NPMplus bouncer forwarded the request to the AppSec Component inside the Docker network (on `crowdsec:7422`). -3. AppSec matched the [`vpatch-env-access`](https://app.crowdsec.net/hub/author/crowdsecurity/appsec-rules/vpatch-env-access) rule and answered `403`. +3. AppSec matched the [`vpatch-env-access`](https://app.crowdsec.net/hub/author/crowdsecurity/waf-rules/vpatch-env-access) rule and answered `403`. 4. NPMplus served the ban page. diff --git a/crowdsec-docs/versioned_docs/version-v1.7/appsec/quickstart/traefik.mdx b/crowdsec-docs/versioned_docs/version-v1.7/appsec/quickstart/traefik.mdx index a1eebc222..8913fa6a4 100644 --- a/crowdsec-docs/versioned_docs/version-v1.7/appsec/quickstart/traefik.mdx +++ b/crowdsec-docs/versioned_docs/version-v1.7/appsec/quickstart/traefik.mdx @@ -665,7 +665,7 @@ What happened in the test that we just did is: 1. We did a request (`localhost/.env`) to our local webserver 2. Thanks to its configuration, the Remediation Component forwarded the request to the AppSec Component 3. Our AppSec Component, listening on `http://127.0.0.1:7422` analyzed the request - 4. The request matches the [AppSec rule to detect .env access](https://app.crowdsec.net/hub/author/crowdsecurity/appsec-rules/vpatch-env-access) + 4. The request matches the [AppSec rule to detect .env access](https://app.crowdsec.net/hub/author/crowdsecurity/waf-rules/vpatch-env-access) 5. The AppSec Component thus answered with [HTTP 403](https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/403) to the Remediation Component, indicating that the request must be blocked 6. The web server then presented us with the default "request blocked" page. diff --git a/crowdsec-docs/versioned_docs/version-v1.7/appsec/quickstart/wordpress.mdx b/crowdsec-docs/versioned_docs/version-v1.7/appsec/quickstart/wordpress.mdx index e1699359a..634bfbb9a 100644 --- a/crowdsec-docs/versioned_docs/version-v1.7/appsec/quickstart/wordpress.mdx +++ b/crowdsec-docs/versioned_docs/version-v1.7/appsec/quickstart/wordpress.mdx @@ -68,7 +68,7 @@ AppSec requires the WordPress plugin to use API-key authentication (not TLS cert ## 4. Verify -From any machine, send a request with a malicious body through WordPress — this example trips the [`vpatch-CVE-2022-22965`](https://app.crowdsec.net/hub/author/crowdsecurity/appsec-rules/vpatch-CVE-2022-22965) rule (Spring4Shell): +From any machine, send a request with a malicious body through WordPress — this example trips the [`vpatch-CVE-2022-22965`](https://app.crowdsec.net/hub/author/crowdsecurity/waf-rules/vpatch-CVE-2022-22965) rule (Spring4Shell): ```bash curl -X POST https:/// \ diff --git a/crowdsec-docs/versioned_docs/version-v1.7/appsec/rules_syntax.md b/crowdsec-docs/versioned_docs/version-v1.7/appsec/rules_syntax.md index 534024091..e8d2e2275 100644 --- a/crowdsec-docs/versioned_docs/version-v1.7/appsec/rules_syntax.md +++ b/crowdsec-docs/versioned_docs/version-v1.7/appsec/rules_syntax.md @@ -133,7 +133,7 @@ rules: value: /crowdsec-test-NtktlJHV4TfBSK3wvlhiOBnl ``` -See the [appsec-generic-test rule](https://app.crowdsec.net/hub/author/crowdsecurity/appsec-rules/appsec-generic-test) for a full example. +See the [appsec-generic-test rule](https://app.crowdsec.net/hub/author/crowdsecurity/waf-rules/appsec-generic-test) for a full example. ### Rule condition fields diff --git a/crowdsec-docs/versioned_docs/version-v1.7/appsec/troubleshooting.md b/crowdsec-docs/versioned_docs/version-v1.7/appsec/troubleshooting.md index b074a6997..ede85be3a 100644 --- a/crowdsec-docs/versioned_docs/version-v1.7/appsec/troubleshooting.md +++ b/crowdsec-docs/versioned_docs/version-v1.7/appsec/troubleshooting.md @@ -176,7 +176,7 @@ To test that the AppSec Component is working, send requests directly to it. Keep This example tests detection for CVE-2023-42793, part of the [virtual patching collection](https://app.crowdsec.net/hub/author/crowdsecurity/collections/appsec-virtual-patching). Make sure the collection is installed (`cscli appsec-rules list`). -[This rule](https://app.crowdsec.net/hub/author/crowdsecurity/appsec-rules/vpatch-CVE-2023-42793) detects requests to a URI ending with `/rpc2`: +[This rule](https://app.crowdsec.net/hub/author/crowdsecurity/waf-rules/vpatch-CVE-2023-42793) detects requests to a URI ending with `/rpc2`: > cat /etc/crowdsec/appsec-rules/vpatch-CVE-2023-42793.yaml ```yaml diff --git a/crowdsec-docs/versioned_docs/version-v1.7/contributing/code.md b/crowdsec-docs/versioned_docs/version-v1.7/contributing/code.md index 3629664a2..75fe78e9e 100644 --- a/crowdsec-docs/versioned_docs/version-v1.7/contributing/code.md +++ b/crowdsec-docs/versioned_docs/version-v1.7/contributing/code.md @@ -39,7 +39,7 @@ Run with `make bats-build bats-fixture` once, then `make bats-test-hub`. We receive contributions on the _master_ branch (or _main_, in recent repositories). To contribute, fork the repository, commit the code in a dedicated branch and ask for a Pull Request. By default it will target the master branch on the upstream repository, so in most cases you don't have to change anything. It will be reviewed by the core team and merged when ready, possibly after some changes. It is recommended to open [an Issue linked to the PR](https://docs.github.com/en/issues/tracking-your-work-with-issues/linking-a-pull-request-to-an-issue) in order to discuss it and track its progression. -You may also receive feedback from the CI scripts (directory [.github/workflows](https://github.com/crowdsecurity/hub/tree/master/.github/workflows)) that run a series of linters and tests. You are encouraged to run these on your environment as well, before committing (see the "Testing" section above, and "Style guide" below). +You may also receive feedback from the CI scripts (directory [.github/workflows](https://github.com/crowdsecurity/crowdsec/tree/master/.github/workflows)) that run a series of linters and tests. You are encouraged to run these on your environment as well, before committing (see the "Testing" section above). ## Release branches diff --git a/crowdsec-docs/versioned_docs/version-v1.7/contributing/specs/bouncer_appsec_specs.mdx b/crowdsec-docs/versioned_docs/version-v1.7/contributing/specs/bouncer_appsec_specs.mdx index 19762ab97..f3bb50504 100644 --- a/crowdsec-docs/versioned_docs/version-v1.7/contributing/specs/bouncer_appsec_specs.mdx +++ b/crowdsec-docs/versioned_docs/version-v1.7/contributing/specs/bouncer_appsec_specs.mdx @@ -318,7 +318,7 @@ You can refer to the AppSec documentation to test request forwarding. * **startup:** set it to **TRUE** for the **initial call** to get all decisions *(when False you’ll get the delta from your last call)* * **scopes:** “ip,range” is the only relevant value when remediating on IPs -* **origins:** Leave blank to allow all origins, test your configurable origins with [those tests](#decision-example) +* **origins:** Leave blank to allow all origins, check your configurable origins against the [decision example](#decision-example) * **scenarios_containing:** leave blank by default, allow change in config * **scenarios_not_containing:** leave blank by default, allow change in config @@ -330,7 +330,7 @@ You can refer to the AppSec documentation to test request forwarding. * **ip:** ignore/leave blank: shortcut for scope:ip \+ value * **range:** ignore/leave blank: shortcut for scope:range \+ value * **contains:** leave blank by default, configurable by user -* **origins:** Leave blank to allow all origins, test your configurable origins with [those tests](#decision-example) +* **origins:** Leave blank to allow all origins, check your configurable origins against the [decision example](#decision-example) * **scenarios_containing:** leave blank by default, allow change in config * **scenarios_not_containing:** leave blank by default, allow change in config diff --git a/crowdsec-docs/versioned_docs/version-v1.7/expr/strings_helpers.md b/crowdsec-docs/versioned_docs/version-v1.7/expr/strings_helpers.md index a7ea5413f..408664a9d 100644 --- a/crowdsec-docs/versioned_docs/version-v1.7/expr/strings_helpers.md +++ b/crowdsec-docs/versioned_docs/version-v1.7/expr/strings_helpers.md @@ -100,8 +100,6 @@ If sep is empty, Split splits after each UTF-8 sequence. If both s and sep are e It is equivalent to SplitN with a count of -1. -To split around the first instance of a separator, see Cut. - ### `SplitAfter(s string, sep string) []string` SplitAfter slices s into all substrings after each instance of sep and returns a slice of those substrings. @@ -141,8 +139,6 @@ n < 0: all substrings Edge cases for s and sep (for example, empty strings) are handled as described in the documentation for Split. -To split around the first instance of a separator, see Cut. - ### `Replace(s string, old string, new string, n int) string` Replace returns a copy of the string s with the first n non-overlapping instances of old replaced by new. If old is empty, it matches at the beginning of the string and after each UTF-8 sequence, yielding up to k+1 replacements for a k-rune string. If n < 0, there is no limit on the number of replacements. diff --git a/crowdsec-docs/versioned_docs/version-v1.7/getting_started/crowdsec_tour.mdx b/crowdsec-docs/versioned_docs/version-v1.7/getting_started/crowdsec_tour.mdx index bd8c75b65..e51927ecb 100644 --- a/crowdsec-docs/versioned_docs/version-v1.7/getting_started/crowdsec_tour.mdx +++ b/crowdsec-docs/versioned_docs/version-v1.7/getting_started/crowdsec_tour.mdx @@ -104,7 +104,7 @@ sudo cscli decisions list If you just deployed CrowdSec, the list might be empty, but don't worry, it simply means you haven't yet been attacked, congrats! Adding `-a` flag will as well list the decisions you received from the [community blocklist](/central_api/intro.md). -Check [decisions](/u/user_guides/hub_mgmt) management for more ! +Check [decisions management](/u/user_guides/decisions_mgmt) for more!
Listing decisions example diff --git a/crowdsec-docs/versioned_docs/version-v1.7/intro.mdx b/crowdsec-docs/versioned_docs/version-v1.7/intro.mdx index 062392306..0a4df1ff0 100644 --- a/crowdsec-docs/versioned_docs/version-v1.7/intro.mdx +++ b/crowdsec-docs/versioned_docs/version-v1.7/intro.mdx @@ -10,7 +10,7 @@ import AcademyPromo from "@site/src/components/academy-promo" The [CrowdSec Security Engine](https://github.com/crowdsecurity/crowdsec) is an open-source, lightweight security engine that detects and blocks malicious actors. It analyzes logs and HTTP requests using behavior-based patterns called scenarios. -CrowdSec is modular: it provides [behavior-based detection](https://app.crowdsec.net/hub/collections), including [AppSec rules](https://app.crowdsec.net/hub/appsec-rules), and optional [Remediation Components](https://app.crowdsec.net/hub/remediation-components) that enforce blocks. +CrowdSec is modular: it provides [behavior-based detection](https://app.crowdsec.net/hub/collections), including [AppSec rules](https://app.crowdsec.net/hub/waf-rules), and optional [Remediation Components](https://app.crowdsec.net/hub/remediation-components) that enforce blocks.
@@ -65,7 +65,7 @@ This architecture supports simple standalone setups and more distributed deploym - Centralized logs (rsyslog, Loki, ...): [Run CrowdSec next to your log pipeline](/u/user_guides/log_centralization), not on production workloads. - Kubernetes: See [our Helm chart](/u/getting_started/installation/kubernetes). - Containers: Use the [Docker data source](/log_processor/data_sources/docker.md). -- WAF only: Start with the [AppSec quickstart](appsec/intro.md). +- WAF only: Start with the [AppSec introduction](appsec/intro.md). Distributed architecture example: diff --git a/crowdsec-docs/versioned_docs/version-v1.7/log_processor/collections/introduction.md b/crowdsec-docs/versioned_docs/version-v1.7/log_processor/collections/introduction.md index 3ee1c7170..9d68c626f 100644 --- a/crowdsec-docs/versioned_docs/version-v1.7/log_processor/collections/introduction.md +++ b/crowdsec-docs/versioned_docs/version-v1.7/log_processor/collections/introduction.md @@ -27,7 +27,7 @@ Collections are the recommended way to install detection content because they: Collections are distributed via the CrowdSec Hub and managed with `cscli`: - Update the Hub index: see [`cscli hub update`](/cscli/cscli_hub_update.md) -- Install or upgrade items: see [`cscli hub upgrade`](/cscli/cscli_hub_upgrade.md) and [Hub management](/cscli/cscli_hub.md) +- Install items: see [`cscli collections install`](/cscli/cscli_collections_install.md). Upgrade installed items: see [`cscli hub upgrade`](/cscli/cscli_hub_upgrade.md). ## Collection file format diff --git a/crowdsec-docs/versioned_docs/version-v1.7/log_processor/data_sources/appsec.md b/crowdsec-docs/versioned_docs/version-v1.7/log_processor/data_sources/appsec.md index 703dc93fa..649126ad3 100644 --- a/crowdsec-docs/versioned_docs/version-v1.7/log_processor/data_sources/appsec.md +++ b/crowdsec-docs/versioned_docs/version-v1.7/log_processor/data_sources/appsec.md @@ -54,12 +54,12 @@ Number of routines to use to process the requests. Defaults to 1. ### `auth_cache_duration` -How long to cache the auth token for. Accepts values supported by [time.ParseDuration](https://golang.org/pkg/time/#ParseDuration). +How long to cache the auth token for. Accepts values supported by [time.ParseDuration](https://pkg.go.dev/time#ParseDuration). Defaults to 1m. ### `body_read_timeout` -How long to wait for the remediation component to finish sending the request body before giving up and processing whatever was received. Accepts value supported by [time.ParseDuration](https://golang.org/pkg/time/#ParseDuration). +How long to wait for the remediation component to finish sending the request body before giving up and processing whatever was received. Accepts value supported by [time.ParseDuration](https://pkg.go.dev/time#ParseDuration). Set to `0` to disable the timeout. Defaults to 1s. diff --git a/crowdsec-docs/versioned_docs/version-v1.7/log_processor/data_sources/cloudwatch.md b/crowdsec-docs/versioned_docs/version-v1.7/log_processor/data_sources/cloudwatch.md index 32d014e39..f360f4f58 100644 --- a/crowdsec-docs/versioned_docs/version-v1.7/log_processor/data_sources/cloudwatch.md +++ b/crowdsec-docs/versioned_docs/version-v1.7/log_processor/data_sources/cloudwatch.md @@ -38,7 +38,7 @@ labels: type: apigateway ``` -Look at the `configuration parameters` to view all supported options. +See [Parameters](#parameters) for all supported options. ## Parameters diff --git a/crowdsec-docs/versioned_docs/version-v1.7/log_processor/data_sources/docker.md b/crowdsec-docs/versioned_docs/version-v1.7/log_processor/data_sources/docker.md index d6ac6676e..493720d0c 100644 --- a/crowdsec-docs/versioned_docs/version-v1.7/log_processor/data_sources/docker.md +++ b/crowdsec-docs/versioned_docs/version-v1.7/log_processor/data_sources/docker.md @@ -59,7 +59,7 @@ labels: type: log_type ``` -Look at the `configuration parameters` to view all supported options. +See [Parameters](#parameters) for all supported options. ## Parameters diff --git a/crowdsec-docs/versioned_docs/version-v1.7/log_processor/data_sources/kafka.md b/crowdsec-docs/versioned_docs/version-v1.7/log_processor/data_sources/kafka.md index 34f3d02f8..5fef13fc1 100644 --- a/crowdsec-docs/versioned_docs/version-v1.7/log_processor/data_sources/kafka.md +++ b/crowdsec-docs/versioned_docs/version-v1.7/log_processor/data_sources/kafka.md @@ -63,7 +63,7 @@ batch: The reader will always start from the latest offset. ::: -Look at the `configuration parameters` to view all supported options. +See [Parameters](#parameters) for all supported options. ## Parameters diff --git a/crowdsec-docs/versioned_docs/version-v1.7/log_processor/data_sources/kinesis.md b/crowdsec-docs/versioned_docs/version-v1.7/log_processor/data_sources/kinesis.md index d7c30ea91..79205a7e1 100644 --- a/crowdsec-docs/versioned_docs/version-v1.7/log_processor/data_sources/kinesis.md +++ b/crowdsec-docs/versioned_docs/version-v1.7/log_processor/data_sources/kinesis.md @@ -30,7 +30,7 @@ labels: If your stream is written to by a [Cloudwatch subscription filter](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/SubscriptionFilters.html), you will need to pass the `from_subscription` parameter, or the Security Engine won't be able to parse the content of the message. ::: -Look at the `configuration parameters` to view all supported options. +See [Parameters](#parameters) for all supported options. ## Parameters diff --git a/crowdsec-docs/versioned_docs/version-v1.7/log_processor/data_sources/kubernetes_audit.md b/crowdsec-docs/versioned_docs/version-v1.7/log_processor/data_sources/kubernetes_audit.md index 7cafaaefc..7822361c1 100644 --- a/crowdsec-docs/versioned_docs/version-v1.7/log_processor/data_sources/kubernetes_audit.md +++ b/crowdsec-docs/versioned_docs/version-v1.7/log_processor/data_sources/kubernetes_audit.md @@ -16,7 +16,7 @@ labels: type: k8s-audit ``` -Look at the `configuration parameters` to view all supported options. +See [Parameters](#parameters) for all supported options. ## Parameters diff --git a/crowdsec-docs/versioned_docs/version-v1.7/log_processor/data_sources/loki.md b/crowdsec-docs/versioned_docs/version-v1.7/log_processor/data_sources/loki.md index 42410132d..0cb2a2441 100644 --- a/crowdsec-docs/versioned_docs/version-v1.7/log_processor/data_sources/loki.md +++ b/crowdsec-docs/versioned_docs/version-v1.7/log_processor/data_sources/loki.md @@ -26,7 +26,7 @@ labels: The reader will always start at "now". ::: -Look at the `configuration parameters` to view all supported options. +See [Parameters](#parameters) for all supported options. ## Parameters diff --git a/crowdsec-docs/versioned_docs/version-v1.7/log_processor/data_sources/s3.md b/crowdsec-docs/versioned_docs/version-v1.7/log_processor/data_sources/s3.md index 29bd26a7c..35d138cfa 100644 --- a/crowdsec-docs/versioned_docs/version-v1.7/log_processor/data_sources/s3.md +++ b/crowdsec-docs/versioned_docs/version-v1.7/log_processor/data_sources/s3.md @@ -44,7 +44,7 @@ When using the `sqs` polling method, make sure the Security Engine is the only r If other processes read from the queue, then the Security Engine will miss some events. ::: -Look at the `configuration parameters` to view all supported options. +See [Parameters](#parameters) for all supported options. ## Parameters diff --git a/crowdsec-docs/versioned_docs/version-v1.7/log_processor/data_sources/victorialogs.md b/crowdsec-docs/versioned_docs/version-v1.7/log_processor/data_sources/victorialogs.md index 611ab83fc..b17dd143c 100644 --- a/crowdsec-docs/versioned_docs/version-v1.7/log_processor/data_sources/victorialogs.md +++ b/crowdsec-docs/versioned_docs/version-v1.7/log_processor/data_sources/victorialogs.md @@ -27,7 +27,7 @@ labels: The reader will always start at "now" for `tail` mode. ::: -Look at the `configuration parameters` to view all supported options. +See [Parameters](#parameters) for all supported options. ## Parameters diff --git a/crowdsec-docs/versioned_docs/version-v1.7/log_processor/scenarios/create.md b/crowdsec-docs/versioned_docs/version-v1.7/log_processor/scenarios/create.md index ec0cbde6f..6f88a54f6 100644 --- a/crowdsec-docs/versioned_docs/version-v1.7/log_processor/scenarios/create.md +++ b/crowdsec-docs/versioned_docs/version-v1.7/log_processor/scenarios/create.md @@ -129,7 +129,7 @@ We have the following fields: - a [type](/log_processor/scenarios/format.md#type): the type of bucket to use (trigger or leaky). - a [name](/log_processor/scenarios/format.md#name) - a [description](/log_processor/scenarios/format.md#description) -- a [filter](/log_processor/scenarios/format.md#type): the filter to apply on events to be filled in this bucket. +- a [filter](/log_processor/scenarios/format.md#filter): the filter to apply on events to be filled in this bucket. - a [leakspeed](/log_processor/scenarios/format.md#leakspeed) - a [capacity](/log_processor/scenarios/format.md#capacity): the number of events in the bucket before it overflows. - a [groupby](/log_processor/scenarios/format.md#groupby): a field from the event to partition the bucket. It is often the `source_ip` of the event. diff --git a/crowdsec-docs/versioned_docs/version-v1.7/log_processor/scenarios/format.md b/crowdsec-docs/versioned_docs/version-v1.7/log_processor/scenarios/format.md index 5f6624827..8f9d350e9 100644 --- a/crowdsec-docs/versioned_docs/version-v1.7/log_processor/scenarios/format.md +++ b/crowdsec-docs/versioned_docs/version-v1.7/log_processor/scenarios/format.md @@ -240,7 +240,7 @@ duration: 10m Only applies to `counter` buckets. A duration after which the bucket will overflow. -The format must be compatible with [golang ParseDuration format](https://golang.org/pkg/time/#ParseDuration) +The format must be compatible with [golang ParseDuration format](https://pkg.go.dev/time#ParseDuration) Examples : @@ -349,7 +349,7 @@ Only applies to `leaky` and `conditional` buckets. A duration that represents how often an event will be leaking from the bucket. -Must be compatible with [golang ParseDuration format](https://golang.org/pkg/time/#ParseDuration). +Must be compatible with [golang ParseDuration format](https://pkg.go.dev/time#ParseDuration). --- ### `condition` @@ -515,7 +515,7 @@ This is intended to limit / avoid spam of buckets that might be very rapidly tri The blackhole only applies to the individual bucket rather than the whole scenario. -Must be compatible with [golang ParseDuration format](https://golang.org/pkg/time/#ParseDuration). +Must be compatible with [golang ParseDuration format](https://pkg.go.dev/time#ParseDuration). #### Example diff --git a/crowdsec-docs/versioned_docs/version-v1.7/observability/cscli.md b/crowdsec-docs/versioned_docs/version-v1.7/observability/cscli.md index 6abb8292e..04c188795 100644 --- a/crowdsec-docs/versioned_docs/version-v1.7/observability/cscli.md +++ b/crowdsec-docs/versioned_docs/version-v1.7/observability/cscli.md @@ -7,7 +7,7 @@ sidebar_position: 2 # Crowdsec Metrics CrowdSec is instrumented using [Prometheus](https://prometheus.io/) to provide detailed metrics and traceability about what is going on. -The `cscli metrics` allows you to see a subset of the metrics exposed by crowdsec. For a more industrial solution, look into the [Grafana](/docs/next/observability/prometheus) integration. +The `cscli metrics` allows you to see a subset of the metrics exposed by crowdsec. For a more industrial solution, look into the [Grafana](/observability/prometheus.md) integration. The best way to get an overview of the available metrics is to use `cscli metrics list`: Type | Title | Description diff --git a/crowdsec-docs/versioned_docs/version-v1.8/appsec/bot_detection/configuration.md b/crowdsec-docs/versioned_docs/version-v1.8/appsec/bot_detection/configuration.md index a3f5ba689..109e1e088 100644 --- a/crowdsec-docs/versioned_docs/version-v1.8/appsec/bot_detection/configuration.md +++ b/crowdsec-docs/versioned_docs/version-v1.8/appsec/bot_detection/configuration.md @@ -135,4 +135,4 @@ level=info msg="on_challenge_submit rejected" source=203.0.113.7 reason=fast-bot If you don't see any `challenge submission` lines at all after a reload, double-check that: - The new appsec-config is listed in your AppSec datasource (`appsec_configs:`) — see [Where to set these values](#where-to-set-these-values). -- The bouncer is forwarding `/crowdsec-internal/challenge/*` paths unchanged — see [Prerequisites](intro.md#prerequisites) on the intro page. +- The bouncer is forwarding `/crowdsec-internal/challenge/*` paths unchanged — see [Internal challenge endpoints](challenge_protocol.md#internal-challenge-endpoints). diff --git a/crowdsec-docs/versioned_docs/version-v1.8/appsec/bot_detection/intro.md b/crowdsec-docs/versioned_docs/version-v1.8/appsec/bot_detection/intro.md index 736a30193..8bfe24a1b 100644 --- a/crowdsec-docs/versioned_docs/version-v1.8/appsec/bot_detection/intro.md +++ b/crowdsec-docs/versioned_docs/version-v1.8/appsec/bot_detection/intro.md @@ -48,7 +48,7 @@ For the full request flow, see [How it works](how_it_works.md). ## Next steps - [Enable bot detection](enable.md) — install the collection, wire the acquisition, and verify it. -- [See default collection](whats_included.md) — the request flow, the appsec-config, known-bot handling, and behavioral scenarios you just enabled. +- [Default configuration](whats_included.md) — the scoring and threshold appsec-configs, known-bot and path exclusions, alerts, and behavioral scenarios you just enabled. - [Customization & recipes](customization.md) — narrow the challenge to a path, allowlist a probe, and react to the bot signal in your own scenarios. - [Configuration](configuration.md) — master secret, key rotation, cookie TTL, and JS obfuscation. - [Hooks reference](hooks.md) — full list of helpers and the `on_challenge` / `on_challenge_submit` stages. diff --git a/crowdsec-docs/versioned_docs/version-v1.8/appsec/configuration_creation_testing.md b/crowdsec-docs/versioned_docs/version-v1.8/appsec/configuration_creation_testing.md index 2d5629b2f..62742fcc7 100644 --- a/crowdsec-docs/versioned_docs/version-v1.8/appsec/configuration_creation_testing.md +++ b/crowdsec-docs/versioned_docs/version-v1.8/appsec/configuration_creation_testing.md @@ -21,7 +21,7 @@ Often you will want multiple AppSec configurations to define groups of rules tha Use the `appsec_configs` parameter to load multiple configurations that work together. In the following example we have two configurations: -- One with [CrowdSec default AppSec rules ↗️](https://app.crowdsec.net/hub/author/crowdsecurity/appsec-configurations/appsec-default) running in in-band mode +- One with [CrowdSec default AppSec rules ↗️](https://app.crowdsec.net/hub/author/crowdsecurity/waf-configurations/appsec-default) running in in-band mode - The other for the [CRS rules ↗️](https://app.crowdsec.net/hub/author/crowdsecurity/collections/appsec-crs) that run in out-of-band mode by default ```yaml title="/etc/crowdsec/acquis.d/appsec.yaml" @@ -94,7 +94,7 @@ When multiple AppSec configurations are loaded, they are processed in the order After updating AppSec configuration files: 1. Reload CrowdSec so it picks up the new configuration. -2. Validate behavior with your usual test traffic, or use the [generic AppSec test rule](https://app.crowdsec.net/hub/author/crowdsecurity/appsec-rules/appsec-generic-test). +2. Validate behavior with your usual test traffic, or use the [generic AppSec test rule](https://app.crowdsec.net/hub/author/crowdsecurity/waf-rules/appsec-generic-test). 3. Inspect results in logs or via `cscli metrics show appsec`. For more troubleshooting guidance, see [AppSec Troubleshooting](troubleshooting.md). diff --git a/crowdsec-docs/versioned_docs/version-v1.8/appsec/quickstart/general.mdx b/crowdsec-docs/versioned_docs/version-v1.8/appsec/quickstart/general.mdx index 16407be8a..3790200d0 100644 --- a/crowdsec-docs/versioned_docs/version-v1.8/appsec/quickstart/general.mdx +++ b/crowdsec-docs/versioned_docs/version-v1.8/appsec/quickstart/general.mdx @@ -147,7 +147,6 @@ Now that the AppSec Component is configured and running, you need to: For specific remediation component configuration, see: - [Nginx/OpenResty Setup](nginxopenresty.mdx) -- [OpenResty Setup](nginxopenresty.mdx) - [Traefik Setup](traefik.mdx) - [HAProxy (SPOA) Setup](haproxy_spoa.mdx) - [WordPress Setup](wordpress.mdx) diff --git a/crowdsec-docs/versioned_docs/version-v1.8/appsec/quickstart/haproxy_spoa.mdx b/crowdsec-docs/versioned_docs/version-v1.8/appsec/quickstart/haproxy_spoa.mdx index c092e4577..ab7450715 100644 --- a/crowdsec-docs/versioned_docs/version-v1.8/appsec/quickstart/haproxy_spoa.mdx +++ b/crowdsec-docs/versioned_docs/version-v1.8/appsec/quickstart/haproxy_spoa.mdx @@ -95,7 +95,7 @@ sudo cscli metrics show appsec 1. `curl` hit HAProxy at `/.env`. 2. HAProxy forwarded the request to the SPOA remediation component. 3. The bouncer queried the AppSec Component at `appsec_url`. -4. The request matched the [`vpatch-env-access`](https://app.crowdsec.net/hub/author/crowdsecurity/appsec-rules/vpatch-env-access) rule. +4. The request matched the [`vpatch-env-access`](https://app.crowdsec.net/hub/author/crowdsecurity/waf-rules/vpatch-env-access) rule. 5. AppSec answered `403`; HAProxy blocked the request.
diff --git a/crowdsec-docs/versioned_docs/version-v1.8/appsec/quickstart/nginx-ingress.mdx b/crowdsec-docs/versioned_docs/version-v1.8/appsec/quickstart/nginx-ingress.mdx index df5045b02..9697b6100 100644 --- a/crowdsec-docs/versioned_docs/version-v1.8/appsec/quickstart/nginx-ingress.mdx +++ b/crowdsec-docs/versioned_docs/version-v1.8/appsec/quickstart/nginx-ingress.mdx @@ -16,8 +16,8 @@ has known security issues, and upstream removed Lua support in version `1.12`, which this integration depends on. Do not use this for new deployments. If you are already using it, plan a migration -to another supported integration such as [Traefik](/docs/next/appsec/quickstart/traefik) -or [Envoy Gateway](/docs/next/appsec/quickstart/envoy-gateway). +to another supported integration such as [Traefik](/appsec/quickstart/traefik.mdx) +or [Envoy Gateway](/appsec/quickstart/envoy-gateway.mdx). ::: ## Objectives diff --git a/crowdsec-docs/versioned_docs/version-v1.8/appsec/quickstart/nginxopenresty.mdx b/crowdsec-docs/versioned_docs/version-v1.8/appsec/quickstart/nginxopenresty.mdx index 5fcedd0a2..6bcba0f41 100644 --- a/crowdsec-docs/versioned_docs/version-v1.8/appsec/quickstart/nginxopenresty.mdx +++ b/crowdsec-docs/versioned_docs/version-v1.8/appsec/quickstart/nginxopenresty.mdx @@ -91,7 +91,7 @@ curl -I http://localhost/.env You should get an `HTTP/1.1 403 Forbidden` response. -We're hitting a `.env` file, a [common way to retrieve credentials left by mistake](https://app.crowdsec.net/hub/author/crowdsecurity/appsec-rules/vpatch-env-access) — the AppSec Component detects and blocks it. +We're hitting a `.env` file, a [common way to retrieve credentials left by mistake](https://app.crowdsec.net/hub/author/crowdsecurity/waf-rules/vpatch-env-access) — the AppSec Component detects and blocks it. Check that CrowdSec recorded the block: @@ -125,7 +125,7 @@ Appsec '127.0.0.1:7422/' Rules Metrics: 1. `curl` hit your web server at `/.env`. 2. The bouncer forwarded the request to the AppSec Component on `127.0.0.1:7422`. -3. The request matched the [`vpatch-env-access`](https://app.crowdsec.net/hub/author/crowdsecurity/appsec-rules/vpatch-env-access) rule. +3. The request matched the [`vpatch-env-access`](https://app.crowdsec.net/hub/author/crowdsecurity/waf-rules/vpatch-env-access) rule. 4. The AppSec Component answered `403`, the bouncer enforced it, and the web server returned the CrowdSec ban page. diff --git a/crowdsec-docs/versioned_docs/version-v1.8/appsec/quickstart/npmplus.mdx b/crowdsec-docs/versioned_docs/version-v1.8/appsec/quickstart/npmplus.mdx index ca6f2963b..92e93e062 100644 --- a/crowdsec-docs/versioned_docs/version-v1.8/appsec/quickstart/npmplus.mdx +++ b/crowdsec-docs/versioned_docs/version-v1.8/appsec/quickstart/npmplus.mdx @@ -163,7 +163,7 @@ Appsec '0.0.0.0:7422/' Rules Metrics: 1. `curl` hit NPMplus at `/.env`. 2. The NPMplus bouncer forwarded the request to the AppSec Component inside the Docker network (on `crowdsec:7422`). -3. AppSec matched the [`vpatch-env-access`](https://app.crowdsec.net/hub/author/crowdsecurity/appsec-rules/vpatch-env-access) rule and answered `403`. +3. AppSec matched the [`vpatch-env-access`](https://app.crowdsec.net/hub/author/crowdsecurity/waf-rules/vpatch-env-access) rule and answered `403`. 4. NPMplus served the ban page. diff --git a/crowdsec-docs/versioned_docs/version-v1.8/appsec/quickstart/traefik.mdx b/crowdsec-docs/versioned_docs/version-v1.8/appsec/quickstart/traefik.mdx index 5da778f50..bf88df4c4 100644 --- a/crowdsec-docs/versioned_docs/version-v1.8/appsec/quickstart/traefik.mdx +++ b/crowdsec-docs/versioned_docs/version-v1.8/appsec/quickstart/traefik.mdx @@ -667,7 +667,7 @@ What happened in the test that we just did is: 1. We did a request (`localhost/.env`) to our local webserver 2. Thanks to its configuration, the Remediation Component forwarded the request to the AppSec Component 3. Our AppSec Component, listening on `http://127.0.0.1:7422` analyzed the request - 4. The request matches the [AppSec rule to detect .env access](https://app.crowdsec.net/hub/author/crowdsecurity/appsec-rules/vpatch-env-access) + 4. The request matches the [AppSec rule to detect .env access](https://app.crowdsec.net/hub/author/crowdsecurity/waf-rules/vpatch-env-access) 5. The AppSec Component thus answered with [HTTP 403](https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/403) to the Remediation Component, indicating that the request must be blocked 6. The web server then presented us with the default "request blocked" page. diff --git a/crowdsec-docs/versioned_docs/version-v1.8/appsec/quickstart/wordpress.mdx b/crowdsec-docs/versioned_docs/version-v1.8/appsec/quickstart/wordpress.mdx index c23525970..24eb838a9 100644 --- a/crowdsec-docs/versioned_docs/version-v1.8/appsec/quickstart/wordpress.mdx +++ b/crowdsec-docs/versioned_docs/version-v1.8/appsec/quickstart/wordpress.mdx @@ -70,7 +70,7 @@ AppSec requires the WordPress plugin to use API-key authentication (not TLS cert ## 4. Verify -From any machine, send a request with a malicious body through WordPress — this example trips the [`vpatch-CVE-2022-22965`](https://app.crowdsec.net/hub/author/crowdsecurity/appsec-rules/vpatch-CVE-2022-22965) rule (Spring4Shell): +From any machine, send a request with a malicious body through WordPress — this example trips the [`vpatch-CVE-2022-22965`](https://app.crowdsec.net/hub/author/crowdsecurity/waf-rules/vpatch-CVE-2022-22965) rule (Spring4Shell): ```bash curl -X POST https:/// \ diff --git a/crowdsec-docs/versioned_docs/version-v1.8/appsec/rules_syntax.md b/crowdsec-docs/versioned_docs/version-v1.8/appsec/rules_syntax.md index b25782a40..a8846160b 100644 --- a/crowdsec-docs/versioned_docs/version-v1.8/appsec/rules_syntax.md +++ b/crowdsec-docs/versioned_docs/version-v1.8/appsec/rules_syntax.md @@ -135,7 +135,7 @@ rules: value: /crowdsec-test-NtktlJHV4TfBSK3wvlhiOBnl ``` -See the [appsec-generic-test rule](https://app.crowdsec.net/hub/author/crowdsecurity/appsec-rules/appsec-generic-test) for a full example. +See the [appsec-generic-test rule](https://app.crowdsec.net/hub/author/crowdsecurity/waf-rules/appsec-generic-test) for a full example. ### Rule condition fields diff --git a/crowdsec-docs/versioned_docs/version-v1.8/appsec/troubleshooting.md b/crowdsec-docs/versioned_docs/version-v1.8/appsec/troubleshooting.md index 3c5de6053..3eabe0435 100644 --- a/crowdsec-docs/versioned_docs/version-v1.8/appsec/troubleshooting.md +++ b/crowdsec-docs/versioned_docs/version-v1.8/appsec/troubleshooting.md @@ -178,7 +178,7 @@ To test that the AppSec Component is working, send requests directly to it. Keep This example tests detection for CVE-2023-42793, part of the [virtual patching collection](https://app.crowdsec.net/hub/author/crowdsecurity/collections/appsec-virtual-patching). Make sure the collection is installed (`cscli appsec-rules list`). -[This rule](https://app.crowdsec.net/hub/author/crowdsecurity/appsec-rules/vpatch-CVE-2023-42793) detects requests to a URI ending with `/rpc2`: +[This rule](https://app.crowdsec.net/hub/author/crowdsecurity/waf-rules/vpatch-CVE-2023-42793) detects requests to a URI ending with `/rpc2`: > cat /etc/crowdsec/appsec-rules/vpatch-CVE-2023-42793.yaml ```yaml diff --git a/crowdsec-docs/versioned_docs/version-v1.8/contributing/code.md b/crowdsec-docs/versioned_docs/version-v1.8/contributing/code.md index 3629664a2..75fe78e9e 100644 --- a/crowdsec-docs/versioned_docs/version-v1.8/contributing/code.md +++ b/crowdsec-docs/versioned_docs/version-v1.8/contributing/code.md @@ -39,7 +39,7 @@ Run with `make bats-build bats-fixture` once, then `make bats-test-hub`. We receive contributions on the _master_ branch (or _main_, in recent repositories). To contribute, fork the repository, commit the code in a dedicated branch and ask for a Pull Request. By default it will target the master branch on the upstream repository, so in most cases you don't have to change anything. It will be reviewed by the core team and merged when ready, possibly after some changes. It is recommended to open [an Issue linked to the PR](https://docs.github.com/en/issues/tracking-your-work-with-issues/linking-a-pull-request-to-an-issue) in order to discuss it and track its progression. -You may also receive feedback from the CI scripts (directory [.github/workflows](https://github.com/crowdsecurity/hub/tree/master/.github/workflows)) that run a series of linters and tests. You are encouraged to run these on your environment as well, before committing (see the "Testing" section above, and "Style guide" below). +You may also receive feedback from the CI scripts (directory [.github/workflows](https://github.com/crowdsecurity/crowdsec/tree/master/.github/workflows)) that run a series of linters and tests. You are encouraged to run these on your environment as well, before committing (see the "Testing" section above). ## Release branches diff --git a/crowdsec-docs/versioned_docs/version-v1.8/contributing/specs/bouncer_appsec_specs.mdx b/crowdsec-docs/versioned_docs/version-v1.8/contributing/specs/bouncer_appsec_specs.mdx index 19762ab97..f3bb50504 100644 --- a/crowdsec-docs/versioned_docs/version-v1.8/contributing/specs/bouncer_appsec_specs.mdx +++ b/crowdsec-docs/versioned_docs/version-v1.8/contributing/specs/bouncer_appsec_specs.mdx @@ -318,7 +318,7 @@ You can refer to the AppSec documentation to test request forwarding. * **startup:** set it to **TRUE** for the **initial call** to get all decisions *(when False you’ll get the delta from your last call)* * **scopes:** “ip,range” is the only relevant value when remediating on IPs -* **origins:** Leave blank to allow all origins, test your configurable origins with [those tests](#decision-example) +* **origins:** Leave blank to allow all origins, check your configurable origins against the [decision example](#decision-example) * **scenarios_containing:** leave blank by default, allow change in config * **scenarios_not_containing:** leave blank by default, allow change in config @@ -330,7 +330,7 @@ You can refer to the AppSec documentation to test request forwarding. * **ip:** ignore/leave blank: shortcut for scope:ip \+ value * **range:** ignore/leave blank: shortcut for scope:range \+ value * **contains:** leave blank by default, configurable by user -* **origins:** Leave blank to allow all origins, test your configurable origins with [those tests](#decision-example) +* **origins:** Leave blank to allow all origins, check your configurable origins against the [decision example](#decision-example) * **scenarios_containing:** leave blank by default, allow change in config * **scenarios_not_containing:** leave blank by default, allow change in config diff --git a/crowdsec-docs/versioned_docs/version-v1.8/expr/strings_helpers.md b/crowdsec-docs/versioned_docs/version-v1.8/expr/strings_helpers.md index a7ea5413f..408664a9d 100644 --- a/crowdsec-docs/versioned_docs/version-v1.8/expr/strings_helpers.md +++ b/crowdsec-docs/versioned_docs/version-v1.8/expr/strings_helpers.md @@ -100,8 +100,6 @@ If sep is empty, Split splits after each UTF-8 sequence. If both s and sep are e It is equivalent to SplitN with a count of -1. -To split around the first instance of a separator, see Cut. - ### `SplitAfter(s string, sep string) []string` SplitAfter slices s into all substrings after each instance of sep and returns a slice of those substrings. @@ -141,8 +139,6 @@ n < 0: all substrings Edge cases for s and sep (for example, empty strings) are handled as described in the documentation for Split. -To split around the first instance of a separator, see Cut. - ### `Replace(s string, old string, new string, n int) string` Replace returns a copy of the string s with the first n non-overlapping instances of old replaced by new. If old is empty, it matches at the beginning of the string and after each UTF-8 sequence, yielding up to k+1 replacements for a k-rune string. If n < 0, there is no limit on the number of replacements. diff --git a/crowdsec-docs/versioned_docs/version-v1.8/getting_started/crowdsec_tour.mdx b/crowdsec-docs/versioned_docs/version-v1.8/getting_started/crowdsec_tour.mdx index ca6e1ffca..8b2098a87 100644 --- a/crowdsec-docs/versioned_docs/version-v1.8/getting_started/crowdsec_tour.mdx +++ b/crowdsec-docs/versioned_docs/version-v1.8/getting_started/crowdsec_tour.mdx @@ -83,7 +83,7 @@ sudo cscli decisions list If you just deployed CrowdSec, the list might be empty, but don't worry, it simply means you haven't yet been attacked, congrats! Adding `-a` flag will as well list the decisions you received from the [community blocklist](/central_api/intro.md). -Check [decisions](/u/user_guides/hub_mgmt) management for more ! +Check [decisions management](/u/user_guides/decisions_mgmt) for more!
Listing decisions example diff --git a/crowdsec-docs/versioned_docs/version-v1.8/intro.mdx b/crowdsec-docs/versioned_docs/version-v1.8/intro.mdx index 062392306..0a4df1ff0 100644 --- a/crowdsec-docs/versioned_docs/version-v1.8/intro.mdx +++ b/crowdsec-docs/versioned_docs/version-v1.8/intro.mdx @@ -10,7 +10,7 @@ import AcademyPromo from "@site/src/components/academy-promo" The [CrowdSec Security Engine](https://github.com/crowdsecurity/crowdsec) is an open-source, lightweight security engine that detects and blocks malicious actors. It analyzes logs and HTTP requests using behavior-based patterns called scenarios. -CrowdSec is modular: it provides [behavior-based detection](https://app.crowdsec.net/hub/collections), including [AppSec rules](https://app.crowdsec.net/hub/appsec-rules), and optional [Remediation Components](https://app.crowdsec.net/hub/remediation-components) that enforce blocks. +CrowdSec is modular: it provides [behavior-based detection](https://app.crowdsec.net/hub/collections), including [AppSec rules](https://app.crowdsec.net/hub/waf-rules), and optional [Remediation Components](https://app.crowdsec.net/hub/remediation-components) that enforce blocks.
@@ -65,7 +65,7 @@ This architecture supports simple standalone setups and more distributed deploym - Centralized logs (rsyslog, Loki, ...): [Run CrowdSec next to your log pipeline](/u/user_guides/log_centralization), not on production workloads. - Kubernetes: See [our Helm chart](/u/getting_started/installation/kubernetes). - Containers: Use the [Docker data source](/log_processor/data_sources/docker.md). -- WAF only: Start with the [AppSec quickstart](appsec/intro.md). +- WAF only: Start with the [AppSec introduction](appsec/intro.md). Distributed architecture example: diff --git a/crowdsec-docs/versioned_docs/version-v1.8/log_processor/collections/introduction.md b/crowdsec-docs/versioned_docs/version-v1.8/log_processor/collections/introduction.md index 3ee1c7170..9d68c626f 100644 --- a/crowdsec-docs/versioned_docs/version-v1.8/log_processor/collections/introduction.md +++ b/crowdsec-docs/versioned_docs/version-v1.8/log_processor/collections/introduction.md @@ -27,7 +27,7 @@ Collections are the recommended way to install detection content because they: Collections are distributed via the CrowdSec Hub and managed with `cscli`: - Update the Hub index: see [`cscli hub update`](/cscli/cscli_hub_update.md) -- Install or upgrade items: see [`cscli hub upgrade`](/cscli/cscli_hub_upgrade.md) and [Hub management](/cscli/cscli_hub.md) +- Install items: see [`cscli collections install`](/cscli/cscli_collections_install.md). Upgrade installed items: see [`cscli hub upgrade`](/cscli/cscli_hub_upgrade.md). ## Collection file format diff --git a/crowdsec-docs/versioned_docs/version-v1.8/log_processor/data_sources/appsec.md b/crowdsec-docs/versioned_docs/version-v1.8/log_processor/data_sources/appsec.md index 81e1ac0d5..f90fcb39e 100644 --- a/crowdsec-docs/versioned_docs/version-v1.8/log_processor/data_sources/appsec.md +++ b/crowdsec-docs/versioned_docs/version-v1.8/log_processor/data_sources/appsec.md @@ -56,19 +56,19 @@ Number of routines to use to process the requests. Defaults to 1. ### `auth_cache_duration` -How long to cache the auth token for. Accepts values supported by [time.ParseDuration](https://golang.org/pkg/time/#ParseDuration). +How long to cache the auth token for. Accepts values supported by [time.ParseDuration](https://pkg.go.dev/time#ParseDuration). Defaults to 1m. ### `auth_timeout` -How long to wait for the local API to validate the API key of a remediation component. Accepts value supported by [time.ParseDuration](https://golang.org/pkg/time/#ParseDuration). +How long to wait for the local API to validate the API key of a remediation component. Accepts value supported by [time.ParseDuration](https://pkg.go.dev/time#ParseDuration). Set to `0` to disable the timeout. Increase it if your local API is not on the same machine or is a few network hops away. Defaults to 200ms. ### `body_read_timeout` -How long to wait for the remediation component to finish sending the request body before giving up and processing whatever was received. Accepts value supported by [time.ParseDuration](https://golang.org/pkg/time/#ParseDuration). +How long to wait for the remediation component to finish sending the request body before giving up and processing whatever was received. Accepts value supported by [time.ParseDuration](https://pkg.go.dev/time#ParseDuration). Set to `0` to disable the timeout. Defaults to 1s. diff --git a/crowdsec-docs/versioned_docs/version-v1.8/log_processor/data_sources/cloudwatch.md b/crowdsec-docs/versioned_docs/version-v1.8/log_processor/data_sources/cloudwatch.md index 32d014e39..f360f4f58 100644 --- a/crowdsec-docs/versioned_docs/version-v1.8/log_processor/data_sources/cloudwatch.md +++ b/crowdsec-docs/versioned_docs/version-v1.8/log_processor/data_sources/cloudwatch.md @@ -38,7 +38,7 @@ labels: type: apigateway ``` -Look at the `configuration parameters` to view all supported options. +See [Parameters](#parameters) for all supported options. ## Parameters diff --git a/crowdsec-docs/versioned_docs/version-v1.8/log_processor/data_sources/docker.md b/crowdsec-docs/versioned_docs/version-v1.8/log_processor/data_sources/docker.md index d6ac6676e..493720d0c 100644 --- a/crowdsec-docs/versioned_docs/version-v1.8/log_processor/data_sources/docker.md +++ b/crowdsec-docs/versioned_docs/version-v1.8/log_processor/data_sources/docker.md @@ -59,7 +59,7 @@ labels: type: log_type ``` -Look at the `configuration parameters` to view all supported options. +See [Parameters](#parameters) for all supported options. ## Parameters diff --git a/crowdsec-docs/versioned_docs/version-v1.8/log_processor/data_sources/kafka.md b/crowdsec-docs/versioned_docs/version-v1.8/log_processor/data_sources/kafka.md index 34f3d02f8..5fef13fc1 100644 --- a/crowdsec-docs/versioned_docs/version-v1.8/log_processor/data_sources/kafka.md +++ b/crowdsec-docs/versioned_docs/version-v1.8/log_processor/data_sources/kafka.md @@ -63,7 +63,7 @@ batch: The reader will always start from the latest offset. ::: -Look at the `configuration parameters` to view all supported options. +See [Parameters](#parameters) for all supported options. ## Parameters diff --git a/crowdsec-docs/versioned_docs/version-v1.8/log_processor/data_sources/kinesis.md b/crowdsec-docs/versioned_docs/version-v1.8/log_processor/data_sources/kinesis.md index d7c30ea91..79205a7e1 100644 --- a/crowdsec-docs/versioned_docs/version-v1.8/log_processor/data_sources/kinesis.md +++ b/crowdsec-docs/versioned_docs/version-v1.8/log_processor/data_sources/kinesis.md @@ -30,7 +30,7 @@ labels: If your stream is written to by a [Cloudwatch subscription filter](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/SubscriptionFilters.html), you will need to pass the `from_subscription` parameter, or the Security Engine won't be able to parse the content of the message. ::: -Look at the `configuration parameters` to view all supported options. +See [Parameters](#parameters) for all supported options. ## Parameters diff --git a/crowdsec-docs/versioned_docs/version-v1.8/log_processor/data_sources/kubernetes.md b/crowdsec-docs/versioned_docs/version-v1.8/log_processor/data_sources/kubernetes.md index b4ee215c5..2deca5427 100644 --- a/crowdsec-docs/versioned_docs/version-v1.8/log_processor/data_sources/kubernetes.md +++ b/crowdsec-docs/versioned_docs/version-v1.8/log_processor/data_sources/kubernetes.md @@ -29,7 +29,7 @@ labels: type: nginx ``` -Look at the `configuration parameters` to view all supported options. +See [Parameters](#parameters) for all supported options. ## Parameters diff --git a/crowdsec-docs/versioned_docs/version-v1.8/log_processor/data_sources/kubernetes_audit.md b/crowdsec-docs/versioned_docs/version-v1.8/log_processor/data_sources/kubernetes_audit.md index 865d3e182..7afe36614 100644 --- a/crowdsec-docs/versioned_docs/version-v1.8/log_processor/data_sources/kubernetes_audit.md +++ b/crowdsec-docs/versioned_docs/version-v1.8/log_processor/data_sources/kubernetes_audit.md @@ -16,7 +16,7 @@ labels: type: k8s-audit ``` -Look at the `configuration parameters` to view all supported options. +See [Parameters](#parameters) for all supported options. ## Parameters diff --git a/crowdsec-docs/versioned_docs/version-v1.8/log_processor/data_sources/loki.md b/crowdsec-docs/versioned_docs/version-v1.8/log_processor/data_sources/loki.md index 42410132d..0cb2a2441 100644 --- a/crowdsec-docs/versioned_docs/version-v1.8/log_processor/data_sources/loki.md +++ b/crowdsec-docs/versioned_docs/version-v1.8/log_processor/data_sources/loki.md @@ -26,7 +26,7 @@ labels: The reader will always start at "now". ::: -Look at the `configuration parameters` to view all supported options. +See [Parameters](#parameters) for all supported options. ## Parameters diff --git a/crowdsec-docs/versioned_docs/version-v1.8/log_processor/data_sources/s3.md b/crowdsec-docs/versioned_docs/version-v1.8/log_processor/data_sources/s3.md index 29bd26a7c..35d138cfa 100644 --- a/crowdsec-docs/versioned_docs/version-v1.8/log_processor/data_sources/s3.md +++ b/crowdsec-docs/versioned_docs/version-v1.8/log_processor/data_sources/s3.md @@ -44,7 +44,7 @@ When using the `sqs` polling method, make sure the Security Engine is the only r If other processes read from the queue, then the Security Engine will miss some events. ::: -Look at the `configuration parameters` to view all supported options. +See [Parameters](#parameters) for all supported options. ## Parameters diff --git a/crowdsec-docs/versioned_docs/version-v1.8/log_processor/data_sources/victorialogs.md b/crowdsec-docs/versioned_docs/version-v1.8/log_processor/data_sources/victorialogs.md index 611ab83fc..b17dd143c 100644 --- a/crowdsec-docs/versioned_docs/version-v1.8/log_processor/data_sources/victorialogs.md +++ b/crowdsec-docs/versioned_docs/version-v1.8/log_processor/data_sources/victorialogs.md @@ -27,7 +27,7 @@ labels: The reader will always start at "now" for `tail` mode. ::: -Look at the `configuration parameters` to view all supported options. +See [Parameters](#parameters) for all supported options. ## Parameters diff --git a/crowdsec-docs/versioned_docs/version-v1.8/log_processor/scenarios/create.md b/crowdsec-docs/versioned_docs/version-v1.8/log_processor/scenarios/create.md index ec0cbde6f..6f88a54f6 100644 --- a/crowdsec-docs/versioned_docs/version-v1.8/log_processor/scenarios/create.md +++ b/crowdsec-docs/versioned_docs/version-v1.8/log_processor/scenarios/create.md @@ -129,7 +129,7 @@ We have the following fields: - a [type](/log_processor/scenarios/format.md#type): the type of bucket to use (trigger or leaky). - a [name](/log_processor/scenarios/format.md#name) - a [description](/log_processor/scenarios/format.md#description) -- a [filter](/log_processor/scenarios/format.md#type): the filter to apply on events to be filled in this bucket. +- a [filter](/log_processor/scenarios/format.md#filter): the filter to apply on events to be filled in this bucket. - a [leakspeed](/log_processor/scenarios/format.md#leakspeed) - a [capacity](/log_processor/scenarios/format.md#capacity): the number of events in the bucket before it overflows. - a [groupby](/log_processor/scenarios/format.md#groupby): a field from the event to partition the bucket. It is often the `source_ip` of the event. diff --git a/crowdsec-docs/versioned_docs/version-v1.8/log_processor/scenarios/format.md b/crowdsec-docs/versioned_docs/version-v1.8/log_processor/scenarios/format.md index 5f6624827..8f9d350e9 100644 --- a/crowdsec-docs/versioned_docs/version-v1.8/log_processor/scenarios/format.md +++ b/crowdsec-docs/versioned_docs/version-v1.8/log_processor/scenarios/format.md @@ -240,7 +240,7 @@ duration: 10m Only applies to `counter` buckets. A duration after which the bucket will overflow. -The format must be compatible with [golang ParseDuration format](https://golang.org/pkg/time/#ParseDuration) +The format must be compatible with [golang ParseDuration format](https://pkg.go.dev/time#ParseDuration) Examples : @@ -349,7 +349,7 @@ Only applies to `leaky` and `conditional` buckets. A duration that represents how often an event will be leaking from the bucket. -Must be compatible with [golang ParseDuration format](https://golang.org/pkg/time/#ParseDuration). +Must be compatible with [golang ParseDuration format](https://pkg.go.dev/time#ParseDuration). --- ### `condition` @@ -515,7 +515,7 @@ This is intended to limit / avoid spam of buckets that might be very rapidly tri The blackhole only applies to the individual bucket rather than the whole scenario. -Must be compatible with [golang ParseDuration format](https://golang.org/pkg/time/#ParseDuration). +Must be compatible with [golang ParseDuration format](https://pkg.go.dev/time#ParseDuration). #### Example diff --git a/crowdsec-docs/versioned_docs/version-v1.8/observability/cscli.md b/crowdsec-docs/versioned_docs/version-v1.8/observability/cscli.md index bf3947e2e..328f89605 100644 --- a/crowdsec-docs/versioned_docs/version-v1.8/observability/cscli.md +++ b/crowdsec-docs/versioned_docs/version-v1.8/observability/cscli.md @@ -7,7 +7,7 @@ sidebar_position: 2 # Crowdsec Metrics CrowdSec is instrumented using [Prometheus](https://prometheus.io/) to provide detailed metrics and traceability about what is going on. -The `cscli metrics` allows you to see a subset of the metrics exposed by crowdsec. For a more industrial solution, look into the [Grafana](/docs/next/observability/prometheus) integration. +The `cscli metrics` allows you to see a subset of the metrics exposed by crowdsec. For a more industrial solution, look into the [Grafana](/observability/prometheus.md) integration. The best way to get an overview of the available metrics is to use `cscli metrics list`: Type | Title | Description