CrowdSec Discord Notifications: Real-Time Security Alerts with Context
Integrating CrowdSec with Discord lets you receive rich, real-time security alerts directly in your Discord server whenever CrowdSec bans a malicious IP. Instead of just a plain text notification, youâll get detailed context including geolocation, map previews, attack scenarios, and targeted URIs â making it easier to debug false positives and fine-tune whitelists.
What You Get
Immediate alerts when CrowdSec bans an IP
Geoapify static map image of the attackerâs approximate location
Geolocation details (country, city, maliciousness score if CTI enabled)
Clickable IP links to WHOIS for quick investigation
Target URIs and metadata to understand attack context
Fully automated Discord delivery via webhooks
Imagine getting a Discord embed that shows:
- âBan issued for IP 123.45.67.89 (Maliciousness 85%)â
- A static map snapshot of the attackerâs origin
- Target URLs that were hit in your infrastructure
Requirements
-
Geoapify API Key
- Needed for free static map rendering.
- Get one here: Geoapify
- Pass it into CrowdSec as
GEOAPIFY_API_KEY.
-
Optional: CrowdSec CTI API Key
-
Provides maliciousness score and detailed geolocation.
-
Free for up to 30 queries/day via CrowdSec Console.
-
Configure in
config.yaml:api: cti: key: ${CTI_API_KEY} cache_timeout: 60m cache_size: 50 enabled: true log_level: debug
-
-
Discord Webhook
-
Create a webhook in your Discord channel.
-
Youâll get a URL in the format:
https://discord.com/api/webhooks/${DISCORD_WEBHOOK_ID}/${DISCORD_WEBHOOK_TOKEN} -
Add both ID and token as environment variables.
-
-
Notification Config
- Map a custom
discord.yamlto CrowdSecâs notifications directory.
- Map a custom
-
Environment Variables (
.envfile):GEOAPIFY_API_KEY=your-geoapify-key DISCORD_WEBHOOK_ID=your-webhook-id DISCORD_WEBHOOK_TOKEN=your-webhook-token CTI_API_KEY=optional-crowdsec-cti-key
Docker Compose Example
Hereâs a minimal example with Discord + Geoapify integration:
services:
crowdsec:
image: crowdsecurity/crowdsec:v1.6.5
container_name: crowdsec
environment:
GEOAPIFY_API_KEY: ${GEOAPIFY_API_KEY}
DISCORD_WEBHOOK_ID: ${DISCORD_WEBHOOK_ID}
DISCORD_WEBHOOK_TOKEN: ${DISCORD_WEBHOOK_TOKEN}
CTI_API_KEY: ${CTI_API_KEY}
volumes:
- ./config/acquis.yaml:/etc/crowdsec/acquis.yaml
- ./config/profiles.yaml:/etc/crowdsec/profiles.yaml
- ./config/config.yaml:/etc/crowdsec/config.yaml
- ./notifications/discord.yaml:/etc/crowdsec/notifications/discord.yaml
- /var/log/traefik:/var/log/traefik/:ro
restart: unless-stopped
Discord Notification Template
Your discord.yaml defines the alert format. Example:
type: http
name: discord
format: |
{
"embeds": [
{
"title": "đ¨ CrowdSec Alert",
"description": "IP {{.Value}} banned for {{.Duration}}",
"url": "https://app.crowdsec.net/cti/{{.Value}}",
"image": {
"url": "https://maps.geoapify.com/v1/staticmap?...&apiKey={{env "GEOAPIFY_API_KEY"}}"
},
"fields": [
{ "name": "Scenario", "value": "{{.Scenario}}" },
{ "name": "Country", "value": "{{.Source.Cn}}" },
{ "name": "Target URIs", "value": "{{range (GetMeta . "target_fqdn")}}`{{.}}`\n{{end}}" }
]
}
]
}
url: https://discord.com/api/webhooks/${DISCORD_WEBHOOK_ID}/${DISCORD_WEBHOOK_TOKEN}
method: POST
headers:
Content-Type: application/json
Enable Notifications in Profiles
Add discord to your profiles.yaml:
name: default_ip_remediation
filters:
- Alert.Remediation == true && Alert.GetScope() == "Ip"
decisions:
- type: ban
duration: 168h
notifications:
- discord
on_success: break
Testing
Run a manual ban to confirm the notification fires:
docker exec crowdsec cscli decisions add --ip 192.168.1.10 -d 10m
You should see a new embed in your Discord channel with all the configured details.
Summary
By integrating CrowdSec with Discord, you now have:
- Real-time, rich notifications on malicious IP bans
- Visual map embeds for attacker location
- Detailed metadata for debugging false positives
- Optional CTI insights for deeper threat context
This makes it much easier to monitor, react to, and tune your CrowdSec setup without constantly digging into logs.