CrowdSec, an open-source security platform that analyzes logs and detects malicious behavior such as brute-force attempts, scanning, bots, and other suspicious activity, has released version 1.8.
The headline change is bot detection in the CrowdSec WAF. When enabled, visitors see a challenge and browser-fingerprinting page before accessing the protected website. CrowdSec evaluates the challenge result and collected fingerprint against configured rules to determine if the client is legitimate or automated.
The release also improves the challenge mechanism itself, including stronger proof-of-work processing, configurable detection thresholds, unified bot-detection scoring, and clearer handling when cookies are disabled.
Another notable addition is a dedicated Kubernetes datasource. CrowdSec can now fetch logs directly from the Kubernetes API server, simplifying deployment in environments where administrators want to analyze cluster-generated logs without adding a separate log-forwarding layer.
CrowdSec 1.8 also extends its expression language with new HTTP helpers. These allow parsers and detection scenarios to query external HTTP services, opening the door to more flexible enrichment and decision-making workflows.
On top of that, the release improves cscli console status and cscli hub list, adds a new machine heartbeat metric, optimizes decision deduplication in the database, and introduces a configurable authentication timeout between the WAF and CrowdSec Local API.
The bug-fix list is extensive. Among the more relevant fixes are preventing duplicate Loki log ingestion, improving timestamp handling, correcting Docker-related crashes and naming issues, fixing syslog acquisition behavior, improving WAF rule tracking, and addressing several Local API, alerting, and database issues.
For additional details, see the changelog.
