Docker Environment variables not being recognised in crowdsec configuration files

[instantdreams]

What happened?

I have a compose.yaml file that includes a set of environment variables. Using docker compose config returns the following:

Details

name: crowdsec
services:
  crowdsec:
    image: crowdsecurity/crowdsec:latest
    container_name: crowdsec
    command:
      - daemon
    environment:
      COLLECTIONS: crowdsecurity/traefik crowdsecurity/http-cve crowdsecurity/base-http-scenarios crowdsecurity/sshd crowdsecurity/linux
      CUSTOM_HOSTNAME: id-edge1
      DIRECTORY_CONFIG: /srv/crowdsec/config
      DIRECTORY_DATA: /srv/crowdsec/data
      DIRECTORY_LOGS: /srv/traefik/logs
      GID: "1000"
      TELEGRAM_BOT_TOKEN: [redacted-telegram-bot-token]
      TELEGRAM_CHAT_ID: [redacted-telegram-chat-id]
    ports:
      - mode: ingress
        target: 8080
        published: "8088"
        protocol: tcp
      - mode: ingress
        target: 6060
        published: "6060"
        protocol: tcp
    volumes:
      - type: bind
        source: /srv/crowdsec/config
        target: /etc/crowdsec
        bind:
          create_host_path: true
      - type: bind
        source: /srv/crowdsec/data
        target: /var/lib/crowdsec/data
        bind:
          create_host_path: true
      - type: bind
        source: /srv/traefik/logs
        target: /logs/web
        read_only: true
        bind:
          create_host_path: true
      - type: bind
        source: /var/log
        target: /var/log
        read_only: true
        bind:
          create_host_path: true
      - type: bind
        source: /etc/localtime
        target: /etc/localtime
        read_only: true
        bind:
          create_host_path: true
    restart: unless-stopped

My profiles.yaml file contains the following:

Details

name: default_ip_remediation
#debug: true
filters:
 - Alert.Remediation == true && Alert.GetScope() == "Ip"
decisions:
 - type: ban
   duration: 4h
#duration_expr: Sprintf('%dh', (GetDecisionsCount(Alert.GetValue()) + 1) * 4)
notifications:
#   - slack_default  # Set the webhook in /etc/crowdsec/notifications/slack.yaml before enabling this.
#   - splunk_default # Set the splunk url and token in /etc/crowdsec/notifications/splunk.yaml before enabling this.
#   - http_default   # Set the required http parameters in /etc/crowdsec/notifications/http.yaml before enabling this.
#   - email_default  # Set the required email parameters in /etc/crowdsec/notifications/email.yaml before enabling this.
 - http_telegram
on_success: break
---
name: default_range_remediation
#debug: true
filters:
 - Alert.Remediation == true && Alert.GetScope() == "Range"
decisions:
 - type: ban
   duration: 4h
#duration_expr: Sprintf('%dh', (GetDecisionsCount(Alert.GetValue()) + 1) * 4)
notifications:
#   - slack_default  # Set the webhook in /etc/crowdsec/notifications/slack.yaml before enabling this.
#   - splunk_default # Set the splunk url and token in /etc/crowdsec/notifications/splunk.yaml before enabling this.
#   - http_default   # Set the required http parameters in /etc/crowdsec/notifications/http.yaml before enabling this.
#   - email_default  # Set the required email parameters in /etc/crowdsec/notifications/email.yaml before enabling this.
 - http_telegram
on_success: break

This enables notification plugin http_telegram for both ip and range Alert scopes.

File config/notifications/http.yaml contains the following:

Details

type: http
name: http_telegram
log_level: info
format: |
  {
   "chat_id": "${TELEGRAM_CHAT_ID}",
   "text": "
     {{range . -}}
     {{$alert := . -}}
     {{range .Decisions -}}
     {{.Value}} will get {{.Type}} for next {{.Duration}} for triggering {{.Scenario}}.
     {{end -}}
     {{end -}}
   ",
   "reply_markup": {
      "inline_keyboard": [
          {{ $arrLength := len . -}}
          {{ range $i, $value := . -}}
          {{ $V := $value.Source.Value -}}
          [
              {
                  "text": "See {{ $V }} on shodan.io",
                  "url": "https://www.shodan.io/host/{{ $V -}}"
              },
              {
                  "text": "See {{ $V }} on crowdsec.net",
                  "url": "https://app.crowdsec.net/cti/{{ $V -}}"
              }
          ]{{if lt $i ( sub $arrLength 1) }},{{end }}
      {{end -}}
      ]
  }
url: https://api.telegram.org/bot${TELEGRAM_BOT_TOKEN}/sendMessage
method: POST
headers:
  Content-Type: "application/json"

According to Notification Plugins Environment Variables, this is the correct format and usage.

Restarting the docker configuration and allowing crowdsec to fully load, the following results are found:

$ docker exec crowdsec cscli notifications list
---------------------------------------------------------------------------------------
 Active  Name              Type      Profile name
---------------------------------------------------------------------------------------
 ✔️      http_telegram     http      default_ip_remediation, default_range_remediation
 🚫      splunk_default    splunk
 🚫      email_default     email
 🚫      sentinel_default  sentinel
 🚫      slack_default     slack
---------------------------------------------------------------------------------------

$ docker exec crowdsec cscli notifications inspect http_telegram
 -            Type:            http
 -            Name:   http_telegram
 -         Timeout:              5s
 -          Format: {
 "chat_id": "${TELEGRAM_CHAT_ID}",
 "text": "
   {{range . -}}
   {{$alert := . -}}
   {{range .Decisions -}}
   {{.Value}} will get {{.Type}} for next {{.Duration}} for triggering {{.Scenario}}.
   {{end -}}
   {{end -}}
 ",
 "reply_markup": {
    "inline_keyboard": [
        {{ $arrLength := len . -}}
        {{ range $i, $value := . -}}
        {{ $V := $value.Source.Value -}}
        [
            {
                "text": "See {{ $V }} on shodan.io",
                "url": "https://www.shodan.io/host/{{ $V -}}"
            },
            {
                "text": "See {{ $V }} on crowdsec.net",
                "url": "https://app.crowdsec.net/cti/{{ $V -}}"
            }
        ]{{if lt $i ( sub $arrLength 1) }},{{end }}
    {{end -}}
    ]
}

 -         headers: map[   Content-Type:application/json]
 -       log_level:            info
 -             url: https://api.telegram.org/bot${TELEGRAM_BOT_TOKEN}/sendMessage
 -          method:            POST

$ docker exec crowdsec cscli notifications test http_telegram
time="2024-12-16T07:44:20-07:00" level=debug msg="starting plugin" args="[/usr/local/lib/crowdsec/plugins/notification-http]" path=/usr/local/lib/crowdsec/plugins/notification-http
time="2024-12-16T07:44:20-07:00" level=debug msg="plugin started" path=/usr/local/lib/crowdsec/plugins/notification-http pid=573
time="2024-12-16T07:44:20-07:00" level=debug msg="waiting for RPC address" path=/usr/local/lib/crowdsec/plugins/notification-http
time="2024-12-16T07:44:20-07:00" level=debug msg="using plugin" version=1
time="2024-12-16T07:44:20-07:00" level=trace msg="waiting for stdio data"
level=info msg="registered plugin http_telegram"
level=info msg="pluginTomb dying"
time="2024-12-16T07:44:20-07:00" level=info msg="received signal for http_telegram config" @module=http-plugin
time="2024-12-16T07:44:20-07:00" level=warning msg="HTTP server returned non 200 status code: 400" @module=http-plugin
level=info msg="killing all plugins"
time="2024-12-16T07:44:20-07:00" level=debug msg="received EOF, stopping recv loop" err="rpc error: code = Unavailable desc = error reading from server: EOF"
time="2024-12-16T07:44:20-07:00" level=info msg="plugin process exited" path=/usr/local/lib/crowdsec/plugins/notification-http pid=573
time="2024-12-16T07:44:20-07:00" level=debug msg="plugin exited"

No notifcation arrives in my telegram channel.

I changed the configuration of config/notifications/http.yaml to explicitly include the Telegram Chat ID and Bot Token

Details

$ docker exec crowdsec cscli notifications inspect http_telegram
 -            Type:            http
 -            Name:   http_telegram
 -         Timeout:              5s
 -          Format: {
 "chat_id": "[redacted-telegram-chat-id]",
 "text": "
   {{range . -}}
   {{$alert := . -}}
   {{range .Decisions -}}
   {{.Value}} will get {{.Type}} for next {{.Duration}} for triggering {{.Scenario}}.
   {{end -}}
   {{end -}}
 ",
 "reply_markup": {
    "inline_keyboard": [
        {{ $arrLength := len . -}}
        {{ range $i, $value := . -}}
        {{ $V := $value.Source.Value -}}
        [
            {
                "text": "See {{ $V }} on shodan.io",
                "url": "https://www.shodan.io/host/{{ $V -}}"
            },
            {
                "text": "See {{ $V }} on crowdsec.net",
                "url": "https://app.crowdsec.net/cti/{{ $V -}}"
            }
        ]{{if lt $i ( sub $arrLength 1) }},{{end }}
    {{end -}}
    ]
}

 -       log_level:            info
 -             url: https://api.telegram.org/bot[redacted-telegram-bot-token]/sendMessage
 -          method:            POST
 -         headers: map[   Content-Type:application/json]

And run the test, I get a different message:

$ docker exec crowdsec cscli notifications test http_telegram
time="2024-12-16T07:49:17-07:00" level=debug msg="starting plugin" args="[/usr/local/lib/crowdsec/plugins/notification-http]" path=/usr/local/lib/crowdsec/plugins/notification-http
time="2024-12-16T07:49:17-07:00" level=debug msg="plugin started" path=/usr/local/lib/crowdsec/plugins/notification-http pid=579
time="2024-12-16T07:49:17-07:00" level=debug msg="waiting for RPC address" path=/usr/local/lib/crowdsec/plugins/notification-http
time="2024-12-16T07:49:17-07:00" level=debug msg="using plugin" version=1
time="2024-12-16T07:49:17-07:00" level=trace msg="waiting for stdio data"
level=info msg="registered plugin http_telegram"
level=info msg="pluginTomb dying"
time="2024-12-16T07:49:17-07:00" level=info msg="received signal for http_telegram config" @module=http-plugin
level=info msg="killing all plugins"
time="2024-12-16T07:49:18-07:00" level=debug msg="received EOF, stopping recv loop" err="rpc error: code = Unavailable desc = error reading from server: EOF"
time="2024-12-16T07:49:18-07:00" level=info msg="plugin process exited" path=/usr/local/lib/crowdsec/plugins/notification-http pid=579
time="2024-12-16T07:49:18-07:00" level=debug msg="plugin exited"

Not sure what the "error reading from server" message is but I did get the message 10.10.10.10 will get ban for next 4h for triggering test alert. in my telegram bot.

What did you expect to happen?

The docker environment variables to be referencable by the cscli application.

How can we reproduce it (as minimally and precisely as possible)?

1. Add environment variables TELEGRAM_CHAT_ID & TELEGRAM_BOT_TOKEN to compose.yaml then populate via .env file.
2. Enable http plugin for notifications
3. In http.yaml add the telegram example code and replace -XXXXXXXXX with ${TELEGRAM_CHAT_ID} and XXX:YYY with ${TELEGRAM_BOT_TOKEN }
4. Use docker compose up --detach to start the container
5. Check the logs
6. Inspect the notification settings with docker exec crowdsec cscli notifications inspect http_telegram or docker exec crowdsec cscli notifications inspect http_default
7. Test the notification with docker exec crowdsec cscli notifications test http_telegram or docker exec crowdsec cscli notifications test http_default

Anything else we need to know?

I know that some containers surface environment variables from docker into their application environment in differet ways, such as using DOCKER_[env-name], do I need to do something like this to get the substitution to work?

Crowdsec version

Details

$ docker exec crowdsec cscli version
version: v1.6.4-523164f6
Codename: alphaga
BuildDate: 2024-11-26_14:18:02
GoVersion: 1.23.3
Platform: docker
libre2: C++
User-Agent: crowdsec/v1.6.4-523164f6-docker
Constraint_parser: >= 1.0, <= 3.0
Constraint_scenario: >= 1.0, <= 3.0
Constraint_api: v1
Constraint_acquis: >= 1.0, < 2.0
Built-in optional components: cscli_setup, datasource_appsec, datasource_cloudwatch, datasource_docker, datasource_file, datasource_http, datasource_journalctl, datasource_k8s-audit, datasource_kafka, datasource_kinesis, datasource_loki, datasource_s3, datasource_syslog, datasource_wineventlog

OS version

Details

$ cat /etc/os-release
PRETTY_NAME="Debian GNU/Linux 12 (bookworm)"
NAME="Debian GNU/Linux"
VERSION_ID="12"
VERSION="12 (bookworm)"
VERSION_CODENAME=bookworm
ID=debian
HOME_URL="https://www.debian.org/"
SUPPORT_URL="https://www.debian.org/support"
BUG_REPORT_URL="https://bugs.debian.org/"

$ uname --all
Linux id-edge1 6.1.21-v8+ #1642 SMP PREEMPT Mon Apr  3 17:24:16 BST 2023 aarch64 GNU/Linux

Enabled collections and parsers

Details

$ docker exec crowdsec cscli hub list -o raw
name,status,version,description,type
crowdsecurity/appsec-logs,enabled,0.5,Parse Appsec events,parsers
crowdsecurity/cri-logs,enabled,0.1,CRI logging format parser,parsers
crowdsecurity/dateparse-enrich,enabled,0.2,,parsers
crowdsecurity/docker-logs,enabled,0.1,docker json logs parser,parsers
crowdsecurity/geoip-enrich,enabled,0.5,"Populate event with geoloc info : as, country, coords, source range.",parsers
crowdsecurity/http-logs,enabled,1.3,"Parse more Specifically HTTP logs, such as HTTP Code, HTTP path, HTTP args and if its a static ressource",parsers
crowdsecurity/sshd-logs,enabled,2.8,Parse openSSH logs,parsers
crowdsecurity/syslog-logs,enabled,0.8,,parsers
crowdsecurity/traefik-logs,enabled,0.9,Parse Traefik access logs,parsers
crowdsecurity/whitelists,"enabled,local",,,parsers
crowdsecurity/apache_log4j2_cve-2021-44228,enabled,0.6,Detect cve-2021-44228 exploitation attemps,scenarios
crowdsecurity/appsec-vpatch,enabled,0.5,Identify attacks flagged by CrowdSec AppSec,scenarios
crowdsecurity/CVE-2017-9841,enabled,0.2,Detect CVE-2017-9841 exploits,scenarios
crowdsecurity/CVE-2019-18935,enabled,0.2,Detect Telerik CVE-2019-18935 exploitation attempts,scenarios
crowdsecurity/CVE-2022-26134,enabled,0.2,Detect CVE-2022-26134 exploits,scenarios
crowdsecurity/CVE-2022-35914,enabled,0.2,Detect CVE-2022-35914 exploits,scenarios
crowdsecurity/CVE-2022-37042,enabled,0.2,Detect CVE-2022-37042 exploits,scenarios
crowdsecurity/CVE-2022-40684,enabled,0.3,Detect cve-2022-40684 exploitation attempts,scenarios
crowdsecurity/CVE-2022-41082,enabled,0.4,Detect CVE-2022-41082 exploits,scenarios
crowdsecurity/CVE-2022-41697,enabled,0.2,Detect CVE-2022-41697 enumeration,scenarios
crowdsecurity/CVE-2022-42889,enabled,0.3,Detect CVE-2022-42889 exploits (Text4Shell),scenarios
crowdsecurity/CVE-2022-44877,enabled,0.3,Detect CVE-2022-44877 exploits,scenarios
crowdsecurity/CVE-2022-46169,enabled,0.2,Detect CVE-2022-46169 brute forcing,scenarios
crowdsecurity/CVE-2023-22515,enabled,0.1,Detect CVE-2023-22515 exploitation,scenarios
crowdsecurity/CVE-2023-22518,enabled,0.2,Detect CVE-2023-22518 exploits,scenarios
crowdsecurity/CVE-2023-49103,enabled,0.3,Detect owncloud CVE-2023-49103 exploitation attempts,scenarios
crowdsecurity/CVE-2024-0012,enabled,0.1,Detect CVE-2024-0012 exploitation attempts,scenarios
crowdsecurity/CVE-2024-38475,enabled,0.1,Detect CVE-2024-38475 exploitation attempts,scenarios
crowdsecurity/CVE-2024-9474,enabled,0.1,Detect CVE-2024-9474 exploitation attempts,scenarios
crowdsecurity/f5-big-ip-cve-2020-5902,enabled,0.2,Detect cve-2020-5902 exploitation attemps,scenarios
crowdsecurity/fortinet-cve-2018-13379,enabled,0.3,Detect cve-2018-13379 exploitation attemps,scenarios
crowdsecurity/grafana-cve-2021-43798,enabled,0.2,Detect cve-2021-43798 exploitation attemps,scenarios
crowdsecurity/http-admin-interface-probing,enabled,0.4,Detect generic HTTP admin interface probing,scenarios
crowdsecurity/http-backdoors-attempts,enabled,0.6,Detect attempt to common backdoors,scenarios
crowdsecurity/http-bad-user-agent,enabled,1.2,Detect usage of bad User Agent,scenarios
crowdsecurity/http-crawl-non_statics,enabled,0.7,Detect aggressive crawl on non static resources,scenarios
crowdsecurity/http-cve-2021-41773,enabled,0.3,Apache - Path Traversal (CVE-2021-41773),scenarios
crowdsecurity/http-cve-2021-42013,enabled,0.3,Apache - Path Traversal (CVE-2021-42013),scenarios
crowdsecurity/http-cve-probing,enabled,0.2,Detect generic HTTP cve probing,scenarios
crowdsecurity/http-generic-bf,enabled,0.6,Detect generic http brute force,scenarios
crowdsecurity/http-open-proxy,enabled,0.5,Detect scan for open proxy,scenarios
crowdsecurity/http-path-traversal-probing,enabled,0.4,Detect path traversal attempt,scenarios
crowdsecurity/http-probing,enabled,0.4,Detect site scanning/probing from a single ip,scenarios
crowdsecurity/http-sensitive-files,enabled,0.4,"Detect attempt to access to sensitive files (.log, .db ..) or folders (.git)",scenarios
crowdsecurity/http-sqli-probing,enabled,0.4,A scenario that detects SQL injection probing with minimal false positives,scenarios
crowdsecurity/http-wordpress-scan,enabled,0.2,Detect WordPress scan: vuln hunting,scenarios
crowdsecurity/http-xss-probing,enabled,0.4,A scenario that detects XSS probing with minimal false positives,scenarios
crowdsecurity/jira_cve-2021-26086,enabled,0.3,Detect Atlassian Jira CVE-2021-26086 exploitation attemps,scenarios
crowdsecurity/netgear_rce,enabled,0.3,Detect Netgear RCE DGN1000/DGN220 exploitation attempts,scenarios
crowdsecurity/pulse-secure-sslvpn-cve-2019-11510,enabled,0.3,Detect cve-2019-11510 exploitation attemps,scenarios
crowdsecurity/spring4shell_cve-2022-22965,enabled,0.3,Detect cve-2022-22965 probing,scenarios
crowdsecurity/ssh-bf,enabled,0.3,Detect ssh bruteforce,scenarios
crowdsecurity/ssh-cve-2024-6387,enabled,0.2,Detect exploitation attempt of CVE-2024-6387,scenarios
crowdsecurity/ssh-slow-bf,enabled,0.4,Detect slow ssh bruteforce,scenarios
crowdsecurity/thinkphp-cve-2018-20062,enabled,0.6,Detect ThinkPHP CVE-2018-20062 exploitation attemps,scenarios
crowdsecurity/vmware-cve-2022-22954,enabled,0.3,Detect Vmware CVE-2022-22954 exploitation attempts,scenarios
crowdsecurity/vmware-vcenter-vmsa-2021-0027,enabled,0.2,Detect VMSA-2021-0027 exploitation attemps,scenarios
ltsich/http-w00tw00t,enabled,0.2,detect w00tw00t,scenarios
crowdsecurity/appsec_base,enabled,0.7,,contexts
crowdsecurity/bf_base,enabled,0.1,,contexts
crowdsecurity/http_base,enabled,0.2,,contexts
crowdsecurity/appsec-default,enabled,0.2,,appsec-configs
crowdsecurity/crs,enabled,0.2,,appsec-configs
crowdsecurity/generic-rules,enabled,0.3,,appsec-configs
crowdsecurity/virtual-patching,enabled,0.4,,appsec-configs
crowdsecurity/base-config,enabled,0.1,,appsec-rules
crowdsecurity/crs,enabled,0.4,,appsec-rules
crowdsecurity/generic-freemarker-ssti,enabled,0.3,Generic FreeMarker SSTI,appsec-rules
crowdsecurity/generic-wordpress-uploads-php,enabled,0.1,Detect php execution in wordpress uploads directory,appsec-rules
crowdsecurity/vpatch-connectwise-auth-bypass,enabled,0.3,Detect exploitation of auth bypass in ConnectWise ScreenConnect,appsec-rules
crowdsecurity/vpatch-CVE-2017-9841,enabled,0.3,PHPUnit RCE (CVE-2017-9841),appsec-rules
crowdsecurity/vpatch-CVE-2018-1000861,enabled,0.1,Jenkins - RCE (CVE-2018-1000861),appsec-rules
crowdsecurity/vpatch-CVE-2018-10562,enabled,0.2,Dasan GPON RCE (CVE-2018-10562),appsec-rules
crowdsecurity/vpatch-CVE-2018-13379,enabled,0.2,Fortinet FortiOS - Credentials Disclosure (CVE-2018-13379),appsec-rules
crowdsecurity/vpatch-CVE-2018-20062,enabled,0.1,ThinkPHP - RCE (CVE-2018-20062),appsec-rules
crowdsecurity/vpatch-CVE-2019-1003030,enabled,0.1,Jenkins - RCE (CVE-2019-1003030),appsec-rules
crowdsecurity/vpatch-CVE-2019-12989,enabled,0.3,Citrix SQLi (CVE-2019-12989),appsec-rules
crowdsecurity/vpatch-CVE-2019-18935,enabled,0.1,Telerik - RCE (CVE-2019-18935),appsec-rules
crowdsecurity/vpatch-CVE-2020-11738,enabled,0.6,Wordpress Snap Creek Duplicator - Path Traversal (CVE-2020-11738),appsec-rules
crowdsecurity/vpatch-CVE-2020-17496,enabled,0.1,vBulletin RCE (CVE-2020-17496),appsec-rules
crowdsecurity/vpatch-CVE-2020-5902,enabled,0.1,F5 BIG-IP TMUI - RCE (CVE-2020-5902),appsec-rules
crowdsecurity/vpatch-CVE-2021-22941,enabled,0.3,Citrix RCE (CVE-2021-22941),appsec-rules
crowdsecurity/vpatch-CVE-2021-26086,enabled,0.1,Atlassian Jira Server/Data Center 8.4.0 - Limited Remote File Read/Include (CVE-2021-26086),appsec-rules
crowdsecurity/vpatch-CVE-2021-3129,enabled,0.4,Laravel with Ignition Debug Mode RCE (CVE-2021-3129),appsec-rules
crowdsecurity/vpatch-CVE-2022-22954,enabled,0.2,VMWare Workspace ONE Access RCE (CVE-2022-22954),appsec-rules
crowdsecurity/vpatch-CVE-2022-22965,enabled,0.2,Spring4Shell - RCE (CVE-2022-22965),appsec-rules
crowdsecurity/vpatch-CVE-2022-26134,enabled,0.2,Confluence - RCE (CVE-2022-26134),appsec-rules
crowdsecurity/vpatch-CVE-2022-27926,enabled,0.4,Zimbra Collaboration XSS (CVE-2022-27926),appsec-rules
crowdsecurity/vpatch-CVE-2022-35914,enabled,0.5,GLPI RCE (CVE-2022-35914),appsec-rules
crowdsecurity/vpatch-CVE-2022-41082,enabled,0.1,Microsoft Exchange - RCE (CVE-2022-41082),appsec-rules
crowdsecurity/vpatch-CVE-2022-44877,enabled,0.2,CentOS Web Panel 7 RCE (CVE-2022-44877),appsec-rules
crowdsecurity/vpatch-CVE-2022-46169,enabled,0.5,Cacti RCE (CVE-2022-46169),appsec-rules
crowdsecurity/vpatch-CVE-2023-1389,enabled,0.1,TP-Link Archer AX21 - RCE (CVE-2023-1389),appsec-rules
crowdsecurity/vpatch-CVE-2023-20198,enabled,0.6,CISCO IOS XE Account Creation (CVE-2023-20198),appsec-rules
crowdsecurity/vpatch-CVE-2023-22515,enabled,0.4,Atlassian Confluence Privesc (CVE-2023-22515),appsec-rules
crowdsecurity/vpatch-CVE-2023-22527,enabled,0.2,RCE using SSTI in Confluence (CVE-2023-22527),appsec-rules
crowdsecurity/vpatch-CVE-2023-23752,enabled,0.1,Joomla! Webservice - Password Disclosure (CVE-2023-23752),appsec-rules
crowdsecurity/vpatch-CVE-2023-24489,enabled,0.2,Citrix ShareFile RCE (CVE-2023-24489),appsec-rules
crowdsecurity/vpatch-CVE-2023-28121,enabled,0.1,WooCommerce auth bypass (CVE-2023-28121),appsec-rules
crowdsecurity/vpatch-CVE-2023-33617,enabled,0.4,Atlassian Confluence Privesc (CVE-2023-33617),appsec-rules
crowdsecurity/vpatch-CVE-2023-34362,enabled,0.6,MOVEit Transfer RCE (CVE-2023-34362),appsec-rules
crowdsecurity/vpatch-CVE-2023-35078,enabled,0.1,MobileIron Core Remote Unauthenticated API Access (CVE-2023-35078),appsec-rules
crowdsecurity/vpatch-CVE-2023-35082,enabled,0.2,MobileIron Core Remote Unauthenticated API Access (CVE-2023-35082),appsec-rules
crowdsecurity/vpatch-CVE-2023-3519,enabled,0.3,Citrix RCE (CVE-2023-3519),appsec-rules
crowdsecurity/vpatch-CVE-2023-38205,enabled,0.3,Adobe ColdFusion Access Control Bypass (CVE-2023-38205),appsec-rules
crowdsecurity/vpatch-CVE-2023-40044,enabled,0.3,WS_FTP .NET deserialize RCE (CVE-2023-40044),appsec-rules
crowdsecurity/vpatch-CVE-2023-42793,enabled,0.3,JetBrains Teamcity Auth Bypass (CVE-2023-42793),appsec-rules
crowdsecurity/vpatch-CVE-2023-46805,enabled,0.4,Ivanti Connect Auth Bypass (CVE-2023-46805),appsec-rules
crowdsecurity/vpatch-CVE-2023-47218,enabled,0.2,QNAP QTS - RCE (CVE-2023-47218),appsec-rules
crowdsecurity/vpatch-CVE-2023-49070,enabled,0.1,Apache OFBiz - RCE (CVE-2023-49070),appsec-rules
crowdsecurity/vpatch-CVE-2023-50164,enabled,0.6,Apache Struts2 Path Traversal (CVE-2023-50164),appsec-rules
crowdsecurity/vpatch-CVE-2023-6553,enabled,0.1,Backup Migration plugin for WordPress RCE (CVE-2023-6553),appsec-rules
crowdsecurity/vpatch-CVE-2023-7028,enabled,0.2,Gitlab Password Reset Account Takeover (CVE-2023-7028),appsec-rules
crowdsecurity/vpatch-CVE-2024-0012,enabled,0.1,PanOS - Authentication Bypass (CVE-2024-0012),appsec-rules
crowdsecurity/vpatch-CVE-2024-1212,enabled,0.3,Progress Kemp LoadMaster Unauthenticated Command Injection (CVE-2024-1212),appsec-rules
crowdsecurity/vpatch-CVE-2024-22024,enabled,0.1,Ivanti Connect Secure - XXE (CVE-2024-22024),appsec-rules
crowdsecurity/vpatch-CVE-2024-23897,enabled,0.4,Jenkins CLI RCE (CVE-2024-23897),appsec-rules
crowdsecurity/vpatch-CVE-2024-27198,enabled,0.5,Teamcity - Authentication Bypass (CVE-2024-27198),appsec-rules
crowdsecurity/vpatch-CVE-2024-27348,enabled,0.1,Apache HugeGraph-Server - RCE (CVE-2024-27348),appsec-rules
crowdsecurity/vpatch-CVE-2024-27954,enabled,0.1,WP Automatic - Path Traversal (CVE-2024-27954),appsec-rules
crowdsecurity/vpatch-CVE-2024-27956,enabled,0.1,WordPress Automatic Plugin - SQLi (CVE-2024-27956),appsec-rules
crowdsecurity/vpatch-CVE-2024-28255,enabled,0.1,OpenMetadata - Authentication Bypass (CVE-2024-28255),appsec-rules
crowdsecurity/vpatch-CVE-2024-28987,enabled,0.1,SolarWinds WHD Hardcoded Credentials (CVE-2024-28987),appsec-rules
crowdsecurity/vpatch-CVE-2024-29824,enabled,0.1,Ivanti EPM - SQLi (CVE-2024-29824),appsec-rules
crowdsecurity/vpatch-CVE-2024-29849,enabled,0.5,Veeam Backup Enterprise Manager - Authentication Bypass (CVE-2024-29849),appsec-rules
crowdsecurity/vpatch-CVE-2024-29973,enabled,0.1,Zyxel - RCE (CVE-2024-29973),appsec-rules
crowdsecurity/vpatch-CVE-2024-32113,enabled,0.1,Apache OFBiz - Path Traversal (CVE-2024-32113),appsec-rules
crowdsecurity/vpatch-CVE-2024-3272,enabled,0.1," D-Link NAS - RCE (CVE-2024-3272)",appsec-rules
crowdsecurity/vpatch-CVE-2024-3273,enabled,0.1,D-LINK NAS Command Injection (CVE-2024-3273),appsec-rules
crowdsecurity/vpatch-CVE-2024-34102,enabled,0.1,Adobe Commerce & Magento - XXE (CVE-2024-34102),appsec-rules
crowdsecurity/vpatch-CVE-2024-38856,enabled,0.1,Apache OFBiz Incorrect Authorization (CVE-2024-38856),appsec-rules
crowdsecurity/vpatch-CVE-2024-4577,enabled,0.1,PHP CGI Command Injection - CVE-2024-4577,appsec-rules
crowdsecurity/vpatch-CVE-2024-51567,enabled,0.1,CyberPanel RCE (CVE-2024-51567),appsec-rules
crowdsecurity/vpatch-CVE-2024-52301,enabled,0.1,Laravel - Parameter Injection (CVE-2024-52301),appsec-rules
crowdsecurity/vpatch-CVE-2024-7593,enabled,0.1,Ivanti vTM - Authentication Bypass (CVE-2024-7593),appsec-rules
crowdsecurity/vpatch-CVE-2024-8190,enabled,0.1,Ivanti Cloud Services Appliance - RCE (CVE-2024-8190),appsec-rules
crowdsecurity/vpatch-CVE-2024-8963,enabled,0.2,Ivanti CSA - Path Traversal (CVE-2024-8963),appsec-rules
crowdsecurity/vpatch-CVE-2024-9474,enabled,0.3,PanOS - Privilege Escalation (CVE-2024-9474),appsec-rules
crowdsecurity/vpatch-env-access,enabled,0.1,Detect access to .env files,appsec-rules
crowdsecurity/vpatch-git-config,enabled,0.2,Detect access to .git files,appsec-rules
crowdsecurity/vpatch-laravel-debug-mode,enabled,0.3,Detect bots exploiting laravel debug mode,appsec-rules
crowdsecurity/vpatch-symfony-profiler,enabled,0.1,Detect abuse of symfony profiler,appsec-rules
crowdsecurity/appsec-crs,enabled,0.4,Appsec: Modsecurity core rule set rules,collections
crowdsecurity/appsec-generic-rules,enabled,0.6,A collection of generic attack vectors for additional protection.,collections
crowdsecurity/appsec-virtual-patching,enabled,4.8,"a generic virtual patching collection, suitable for most web servers.",collections
crowdsecurity/base-http-scenarios,enabled,1.0,http common : scanners detection,collections
crowdsecurity/http-cve,enabled,2.9,Detect CVE exploitation in http logs,collections
crowdsecurity/linux,enabled,0.2,core linux support : syslog+geoip+ssh,collections
crowdsecurity/sshd,enabled,0.5,sshd support : parser and brute-force detection,collections
crowdsecurity/traefik,enabled,0.1,traefik support: parser and generic http scenarios,collections

Acquisition config

Details

$ docker exec crowdsec cat /etc/crowdsec/acquis.yaml /etc/crowdsec/acquis.d/*
filenames:
  - /var/log/auth.log
  - /var/log/syslog
labels:
  type: syslog
---
filenames:
  - /logs/web/*.log
labels:
  type: traefik

$ docker exec crowdsec ls -lha /etc/crowdsec/acquis.d
total 8K
drwxr-xr-x    2 root     root        4.0K Nov 26 06:06 .
drwxr-xr-x   14 1000     1000        4.0K Dec 16 07:37 ..

Config show

Details

$ docker exec crowdsec cscli config show
Global:
   - Configuration Folder   : /etc/crowdsec
   - Data Folder            : /var/lib/crowdsec/data
   - Hub Folder             : /etc/crowdsec/hub
   - Simulation File        : /etc/crowdsec/simulation.yaml
   - Log Folder             : /var/log
   - Log level              : info
   - Log Media              : stdout
Crowdsec:
  - Acquisition File        : /etc/crowdsec/acquis.yaml
  - Parsers routines        : 1
  - Acquisition Folder      : /etc/crowdsec/acquis.d
cscli:
  - Output                  : human
  - Hub Branch              :
API Client:
  - URL                     : http://0.0.0.0:8080/
  - Login                   : id-edge1
  - Credentials File        : /etc/crowdsec/local_api_credentials.yaml
Local API Server:
  - Listen URL              : 0.0.0.0:8080
  - Listen Socket           :
  - Profile File            : /etc/crowdsec/profiles.yaml

  - Trusted IPs:
      - 127.0.0.1
      - ::1
  - Database:
      - Type                : sqlite
      - Path                : /var/lib/crowdsec/data/crowdsec.db
      - Flush age           : 7d
      - Flush size          : 5000

Prometheus metrics

Details

$ $ docker exec crowdsec cscli metrics
Acquisition Metrics:
+---------------------------+------------+--------------+----------------+------------------------+-------------------+
| Source                    | Lines read | Lines parsed | Lines unparsed | Lines poured to bucket | Lines whitelisted |
+---------------------------+------------+--------------+----------------+------------------------+-------------------+
| file:/logs/web/access.log | 2.41k      | 2.41k        | -              | 9                      | 2.31k             |
| file:/var/log/auth.log    | 4          | -            | 4              | -                      | -                 |
| file:/var/log/syslog      | 141        | -            | 141            | -                      | -                 |
+---------------------------+------------+--------------+----------------+------------------------+-------------------+

Local API Alerts:
+---------------------------------------+-------+
| Reason                                | Count |
+---------------------------------------+-------+
| crowdsecurity/CVE-2017-9841           | 14    |
| crowdsecurity/CVE-2022-41082          | 2     |
| crowdsecurity/http-bad-user-agent     | 32    |
| crowdsecurity/http-cve-2021-41773     | 11    |
| crowdsecurity/http-probing            | 12    |
| crowdsecurity/http-sensitive-files    | 1     |
| crowdsecurity/netgear_rce             | 2     |
| crowdsecurity/thinkphp-cve-2018-20062 | 9     |
+---------------------------------------+-------+

Local API Decisions:
+---------------------------------------------+--------+--------+-------+
| Reason                                      | Origin | Action | Count |
+---------------------------------------------+--------+--------+-------+
| crowdsecurity/vpatch-CVE-2023-23752         | CAPI   | ban    | 1     |
| ltsich/http-w00tw00t                        | CAPI   | ban    | 5     |
| crowdsecurity/CVE-2019-18935                | CAPI   | ban    | 65    |
| crowdsecurity/CVE-2022-35914                | CAPI   | ban    | 6     |
| crowdsecurity/fortinet-cve-2018-13379       | CAPI   | ban    | 17    |
| crowdsecurity/http-path-traversal-probing   | CAPI   | ban    | 238   |
| crowdsecurity/thinkphp-cve-2018-20062       | CAPI   | ban    | 177   |
| crowdsecurity/vpatch-CVE-2023-1389          | CAPI   | ban    | 11    |
| crowdsecurity/http-cve-2021-41773           | CAPI   | ban    | 528   |
| crowdsecurity/vpatch-CVE-2017-9841          | CAPI   | ban    | 1     |
| crowdsecurity/vpatch-git-config             | CAPI   | ban    | 35    |
| crowdsecurity/CVE-2022-37042                | CAPI   | ban    | 2     |
| crowdsecurity/generic-wordpress-uploads-php | CAPI   | ban    | 2     |
| crowdsecurity/grafana-cve-2021-43798        | CAPI   | ban    | 2     |
| crowdsecurity/http-open-proxy               | CAPI   | ban    | 2467  |
| crowdsecurity/http-probing                  | CAPI   | ban    | 6209  |
| crowdsecurity/ssh-cve-2024-6387             | CAPI   | ban    | 47    |
| crowdsecurity/vpatch-symfony-profiler       | CAPI   | ban    | 11    |
| crowdsecurity/appsec-vpatch                 | CAPI   | ban    | 3     |
| crowdsecurity/f5-big-ip-cve-2020-5902       | CAPI   | ban    | 3     |
| crowdsecurity/netgear_rce                   | CAPI   | ban    | 161   |
| crowdsecurity/spring4shell_cve-2022-22965   | CAPI   | ban    | 1     |
| crowdsecurity/ssh-bf                        | CAPI   | ban    | 7397  |
| crowdsecurity/ssh-slow-bf                   | CAPI   | ban    | 7152  |
| crowdsecurity/CVE-2022-26134                | CAPI   | ban    | 8     |
| crowdsecurity/CVE-2023-22515                | CAPI   | ban    | 5     |
| crowdsecurity/vpatch-CVE-2021-3129          | CAPI   | ban    | 5     |
| crowdsecurity/vpatch-laravel-debug-mode     | CAPI   | ban    | 47    |
| crowdsecurity/vpatch-CVE-2023-50164         | CAPI   | ban    | 1     |
| crowdsecurity/CVE-2023-49103                | CAPI   | ban    | 63    |
| crowdsecurity/CVE-2024-0012                 | CAPI   | ban    | 1     |
| crowdsecurity/http-cve-2021-42013           | CAPI   | ban    | 4     |
| crowdsecurity/http-generic-bf               | CAPI   | ban    | 23    |
| crowdsecurity/http-wordpress-scan           | CAPI   | ban    | 1054  |
| crowdsecurity/jira_cve-2021-26086           | CAPI   | ban    | 10    |
| crowdsecurity/http-sensitive-files          | CAPI   | ban    | 357   |
| crowdsecurity/vpatch-env-access             | CAPI   | ban    | 507   |
| crowdsecurity/CVE-2017-9841                 | CAPI   | ban    | 354   |
| crowdsecurity/apache_log4j2_cve-2021-44228  | CAPI   | ban    | 35    |
| crowdsecurity/http-admin-interface-probing  | CAPI   | ban    | 290   |
| crowdsecurity/http-backdoors-attempts       | CAPI   | ban    | 205   |
| crowdsecurity/http-crawl-non_statics        | CAPI   | ban    | 767   |
| crowdsecurity/http-cve-probing              | CAPI   | ban    | 34    |
| crowdsecurity/http-bad-user-agent           | CAPI   | ban    | 13255 |
| crowdsecurity/vpatch-CVE-2022-22965         | CAPI   | ban    | 1     |
| crowdsecurity/vpatch-CVE-2023-28121         | CAPI   | ban    | 1     |
+---------------------------------------------+--------+--------+-------+

Local API Metrics:
+--------------------+--------+------+
| Route              | Method | Hits |
+--------------------+--------+------+
| /v1/decisions      | GET    | 41   |
| /v1/heartbeat      | GET    | 105  |
| /v1/usage-metrics  | POST   | 4    |
| /v1/watchers/login | POST   | 2    |
+--------------------+--------+------+

Local API Bouncers Metrics:
+-----------------+---------------+--------+------+
| Bouncer         | Route         | Method | Hits |
+-----------------+---------------+--------+------+
| traefik-bouncer | /v1/decisions | GET    | 41   |
+-----------------+---------------+--------+------+

Local API Bouncers Decisions:
+-----------------+---------------+-------------------+
| Bouncer         | Empty answers | Non-empty answers |
+-----------------+---------------+-------------------+
| traefik-bouncer | 41            | 0                 |
+-----------------+---------------+-------------------+

Local API Machines Metrics:
+----------+---------------+--------+------+
| Machine  | Route         | Method | Hits |
+----------+---------------+--------+------+
| id-edge1 | /v1/heartbeat | GET    | 105  |
+----------+---------------+--------+------+

Parser Metrics:
+----------------------------------+-------+--------+----------+
| Parsers                          | Hits  | Parsed | Unparsed |
+----------------------------------+-------+--------+----------+
| child-crowdsecurity/http-logs    | 7.22k | 5.10k  | 2.13k    |
| child-crowdsecurity/syslog-logs  | 145   | 145    | -        |
| child-crowdsecurity/traefik-logs | 4.82k | 2.41k  | 2.41k    |
| crowdsecurity/dateparse-enrich   | 2.41k | 2.41k  | -        |
| crowdsecurity/geoip-enrich       | 101   | 101    | -        |
| crowdsecurity/http-logs          | 2.41k | 2.41k  | -        |
| crowdsecurity/non-syslog         | 2.41k | 2.41k  | -        |
| crowdsecurity/syslog-logs        | 145   | 145    | -        |
| crowdsecurity/traefik-logs       | 2.41k | 2.41k  | -        |
| crowdsecurity/whitelists         | 2.41k | 2.41k  | -        |
+----------------------------------+-------+--------+----------+

Scenario Metrics:
+--------------------------------------+---------------+-----------+--------------+--------+---------+
| Scenario                             | Current Count | Overflows | Instantiated | Poured | Expired |
+--------------------------------------+---------------+-----------+--------------+--------+---------+
| crowdsecurity/http-bad-user-agent    | -             | -         | 1            | 1      | 1       |
| crowdsecurity/http-crawl-non_statics | -             | -         | 4            | 5      | 4       |
| crowdsecurity/http-probing           | -             | -         | 3            | 3      | 3       |
+--------------------------------------+---------------+-----------+--------------+--------+---------+

Whitelist Metrics:
+--------------------------+--------------+------+-------------+
| Whitelist                | Reason       | Hits | Whitelisted |
+--------------------------+--------------+------+-------------+
| crowdsecurity/whitelists | my ip ranges | 2408 | 2307        |
+--------------------------+--------------+------+-------------+

Related custom configs versions (if applicable) : notification plugins, custom scenarios, parsers etc.

Details

$ docker exec crowdsec cat /etc/crowdsec/profiles.yaml
name: default_ip_remediation
#debug: true
filters:
 - Alert.Remediation == true && Alert.GetScope() == "Ip"
decisions:
 - type: ban
   duration: 4h
#duration_expr: Sprintf('%dh', (GetDecisionsCount(Alert.GetValue()) + 1) * 4)
notifications:
#   - slack_default  # Set the webhook in /etc/crowdsec/notifications/slack.yaml before enabling this.
#   - splunk_default # Set the splunk url and token in /etc/crowdsec/notifications/splunk.yaml before enabling this.
#   - http_default   # Set the required http parameters in /etc/crowdsec/notifications/http.yaml before enabling this.
#   - email_default  # Set the required email parameters in /etc/crowdsec/notifications/email.yaml before enabling this.
 - http_telegram
on_success: break
---
name: default_range_remediation
#debug: true
filters:
 - Alert.Remediation == true && Alert.GetScope() == "Range"
decisions:
 - type: ban
   duration: 4h
#duration_expr: Sprintf('%dh', (GetDecisionsCount(Alert.GetValue()) + 1) * 4)
notifications:
#   - slack_default  # Set the webhook in /etc/crowdsec/notifications/slack.yaml before enabling this.
#   - splunk_default # Set the splunk url and token in /etc/crowdsec/notifications/splunk.yaml before enabling this.
#   - http_default   # Set the required http parameters in /etc/crowdsec/notifications/http.yaml before enabling this.
#   - email_default  # Set the required email parameters in /etc/crowdsec/notifications/email.yaml before enabling this.
 - http_telegram
on_success: break

$ docker exec crowdsec cat /etc/crowdsec/notifications/http.yaml
type: http
name: http_telegram
log_level: info
format: |
  {
   "chat_id": "${TELEGRAM_CHAT_ID}",
   "text": "
     {{range . -}}
     {{$alert := . -}}
     {{range .Decisions -}}
     {{.Value}} will get {{.Type}} for next {{.Duration}} for triggering {{.Scenario}}.
     {{end -}}
     {{end -}}
   ",
   "reply_markup": {
      "inline_keyboard": [
          {{ $arrLength := len . -}}
          {{ range $i, $value := . -}}
          {{ $V := $value.Source.Value -}}
          [
              {
                  "text": "See {{ $V }} on shodan.io",
                  "url": "https://www.shodan.io/host/{{ $V -}}"
              },
              {
                  "text": "See {{ $V }} on crowdsec.net",
                  "url": "https://app.crowdsec.net/cti/{{ $V -}}"
              }
          ]{{if lt $i ( sub $arrLength 1) }},{{end }}
      {{end -}}
      ]
  }
url: https://api.telegram.org/bot${TELEGRAM_BOT_TOKEN}/sendMessage
method: POST
headers:
  Content-Type: "application/json"

[github-actions]

@instantdreams: Thanks for opening an issue, it is currently awaiting triage.

In the meantime, you can:

1. Check Crowdsec Documentation to see if your issue can be self resolved.
2. You can also join our Discord.
3. Check Releases to make sure your agent is on the latest version.

Details

I am a bot created to help the crowdsecurity developers manage community feedback and contributions. You can check out my manifest file to understand my behavior and what I can do. If you want to use this for your project, you can check out the BirthdayResearch/oss-governance-bot repository.

[LaurenceJJones]

Just to ask, if you leave the configuration running and it hits a alert generate by the log does it in fact work? as per comment on #2923 ?

it might currently be an issue with just cscli and how it handles the plugin differently from the actual pipeline in CrowdSec.

[instantdreams]

I added back in the environment variables and confirmed they are referenced in http.yaml. I will now leave the container running. My last alert was at 05:17:26, my time is 09:46. I'll check if any alerts that occur after this time are notified via Telegram.

[instantdreams]

The Alerts dashboard identified an event at 10:01:47, so I logged into my edge server and viewed the docker logs for crowdsec.

crowdsec  | time="2024-12-16T10:00:33-07:00" level=info msg="127.0.0.1 - [Mon, 16 Dec 2024 10:00:33 MST] \"GET /v1/heartbeat HTTP/1.1 200 6.554102ms \"crowdsec/v1.6.4-523164f6-docker\" \""
crowdsec  | time="2024-12-16T10:01:31-07:00" level=info msg="192.168.91.1 - [Mon, 16 Dec 2024 10:01:31 MST] \"GET /v1/decisions?ip=165.225.210.242&banned=true HTTP/1.1 200 107.131257ms \"Crowdsec-Bouncer-Traefik-Plugin/1.X.X\" \""
crowdsec  | time="2024-12-16T10:01:33-07:00" level=info msg="127.0.0.1 - [Mon, 16 Dec 2024 10:01:33 MST] \"GET /v1/heartbeat HTTP/1.1 200 6.835027ms \"crowdsec/v1.6.4-523164f6-docker\" \""
crowdsec  | time="2024-12-16T10:01:47-07:00" level=info msg="Ip 165.225.210.242 performed 'crowdsecurity/http-crawl-non_statics' (44 events over 14.877464175s) at 2024-12-16 17:01:47.778141788 +0000 UTC"
crowdsec  | time="2024-12-16T10:01:48-07:00" level=info msg="(id-edge1/crowdsec) crowdsecurity/http-crawl-non_statics by ip 165.225.210.242 (CA/22616) : 4h ban on Ip 165.225.210.242"
crowdsec  | time="2024-12-16T10:01:48-07:00" level=info msg="127.0.0.1 - [Mon, 16 Dec 2024 10:01:48 MST] \"POST /v1/alerts HTTP/1.1 201 33.75973ms \"crowdsec/v1.6.4-523164f6-docker\" \""
crowdsec  | time="2024-12-16T10:01:48-07:00" level=info msg="received signal for http_telegram config" @module=http-plugin
crowdsec  | time="2024-12-16T10:01:49-07:00" level=warning msg="HTTP server returned non 200 status code: 400" @module=http-plugin
crowdsec  | time="2024-12-16T10:01:57-07:00" level=info msg="Signal push: 1 signals to push"
crowdsec  | time="2024-12-16T10:02:04-07:00" level=error msg="UnmarshalJSON : unexpected end of JSON input" line="{\"ClientAddr\":\"165.225.210.242:46973\",\"ClientHost\":\"165.225.210.242\",\"ClientPort\":\"46973\",\"ClientUsername\":\"-\",\"DownstreamContentSize\":151248,\"DownstreamStatus\":200,\"Duration\":19511864,\"OriginContentSize\":151248,\"OriginDuration\":18563849,\"OriginStatus\":200,\"Overhead\":948015,\"RequestAddr\":\"[accidentally-banned-one-of-my-subdomains]\",\"R"
crowdsec  | time="2024-12-16T10:02:04-07:00" level=warning msg="failed to run filter : unexpected end of JSON input (1:1)\n | UnmarshalJSON(evt.Parsed.message, evt.Unmarshaled, \"traefik\") in [\"\", nil]\n | ^" id=cold-darkness name=child-crowdsecurity/traefik-logs stage=s01-parse

The error seems to be Unexpected end of JSON input. I checked my http.yaml file and everything seems to be terminated correctly.

Running input "{\"ClientAddr\":\"165.225.210.242:46973\",\"ClientHost\":\"165.225.210.242\",\"ClientPort\":\"46973\",\"ClientUsername\":\"-\",\"DownstreamContentSize\":151248,\"DownstreamStatus\":200,\"Duration\":19511864,\"OriginContentSize\":151248,\"OriginDuration\":18563849,\"OriginStatus\":200,\"Overhead\":948015,\"RequestAddr\":\"[accidentally-banned-one-of-my-subdomains]\",\"R" through a json validator also worked.

[instantdreams]

I also tried changing the variables from ${TELEGRAM_CHAT_ID} to $TELEGRAM_CHAT_ID as I noted some previous commits referencing this - but it still didn't work.

[LaurenceJJones]

Hey I tested a few things and put my finding on the issue #2923, I will close this issue in favor of tracking a fix on the issue that been outstanding for sometime, you can read my tldr if you want to quick information.