flowtriq-crowdsec

CrowdSec Hub collection for Flowtriq DDoS detection.

Parses attack events from ftagent logs and feeds attacker IPs into CrowdSec's community blocklist. When ftagent detects a DDoS attack on your infrastructure, CrowdSec shares that intelligence with the entire community.

Contents

File	Type	Description
parsers/s01-parse/flowtriq-ftagent-logs.yaml	Parser	Extracts attack events from ftagent log output
parsers/s02-enrich/flowtriq-ftagent-enrich.yaml	Enricher	Adds severity and confidence labels
scenarios/flowtriq-ddos-attack.yaml	Scenario	Triggers on L3/L4 DDoS attacks
scenarios/flowtriq-ddos-l7.yaml	Scenario	Triggers on L7 HTTP flood attacks
scenarios/flowtriq-ddos-mirror.yaml	Scenario	Triggers on mirror/SPAN monitored attacks
collections/flowtriq.yaml	Collection	Bundles all parsers and scenarios

Install

sudo cscli collections install flowtriq/flowtriq

Then add ftagent's log source to /etc/crowdsec/acquis.yaml:

filenames:
  - /var/log/ftagent.log
labels:
  type: ftagent

sudo systemctl restart crowdsec

See .github/flowtriq.md for full documentation, including the source IP integration options and verification steps.

Requirements

• ftagent running as a systemd service
• CrowdSec installed

Links

• Flowtriq
• ftagent on PyPI
• CrowdSec Hub