TracecatHQ / tracecat

The open source Tines / Splunk SOAR alternative for security engineers.

https://tracecat.com

GNU Affero General Public License v3.0

2.42k stars 173 forks source link

feat(integration): Crowdsec add block and unblock file #473

Closed bouddha-fr closed 3 weeks ago

bouddha-fr commented 4 weeks ago

Pull Request: Unblock and Block IP Address Actions for CrowdSec

Overview

This pull request adds two actions to integrate with CrowdSec, allowing for the blocking and unblocking of specific IP addresses via API requests.

Features

1. Unblock IP Address

Action Name: unblock_ip_address
Namespace: integrations.crowdsec
Description: Sends a DELETE request to unblock an IP address in CrowdSec.

Input Parameters

url_server: Local URL of the CrowdSec API.
ip_address: The IP address to unblock.

Authentication

Uses an API token (CROWDSEC_API_TOKEN) for authorization.

2. Block IP Address

Action Name: block_ip_address
Namespace: integrations.crowdsec
Description: Sends a POST request to block a specific IP address in CrowdSec, with additional details about the IP origin.

Input Parameters

cn: Country of origin of the IP address.
duration: Duration of the selected block.
as_name: Internet service provider.
ip_address: The IP address to block.
url_server: Local URL of the CrowdSec API.
timestamp: Time of the action.

Authentication

Uses an API token (CROWDSEC_API_TOKEN) for authorization.