Behavioural detection
Analyses HTTP activity for probing, brute force behaviour, sensitive-file requests and exploit attempts.
Security Engineering Case Study
CrowdSec Security Monitoring Platform
A production-style security platform providing automated threat detection, community intelligence, firewall enforcement and operational observability for internet-facing services.
Overview
The engineering challenge
Internet-facing services are continuously scanned by automated bots, vulnerability scanners and exploit frameworks. Traditional firewall rules alone provide limited visibility into the behaviour behind those requests.
The objective was to implement a platform that could analyse reverse proxy logs, identify malicious behaviour, create security decisions and automatically block offending traffic at the Linux firewall.
The platform also needed operational dashboards and alerts so that detection activity, firewall enforcement and service health could be monitored in real time.
Architecture
Detection through to automated response
The solution connects reverse-proxy logging, behavioural analysis, threat intelligence, firewall enforcement and observability.
01Internet Traffic
Requests arrive through Cloudflare.
→
02Nginx Proxy Manager
Access and error logs record activity.
→
03CrowdSec
Behavioural scenarios detect malicious requests.
→
04Firewall Bouncer
Security decisions are enforced automatically.
→
05Prometheus and Grafana
Metrics, dashboards and alerts provide visibility.
Platform Capabilities
Security automation and operational visibility
Community intelligence
Receives CrowdSec community decisions covering known malicious infrastructure and common attack categories.
Automated enforcement
The firewall bouncer turns security decisions into packet-filtering rules without manual intervention.
Prometheus metrics
Custom and native metrics expose decision counts, detection rates, dropped packets and blocked traffic.
Grafana dashboards
Dashboards translate raw telemetry into attack categories, trends, platform health and firewall activity.
Operational alerting
Alerts detect exporter failures, CrowdSec outages and unusual firewall blocking activity.
Operational Evidence
Real security activity
A recent 24-hour dashboard view demonstrated the following activity.
These values are included as a representative operational snapshot and will naturally change as the live platform continues to process traffic.
Detection Coverage
Observed attack behaviour
The platform has identified several common forms of automated internet reconnaissance and exploitation activity:
- Administrative interface probing
- Sensitive file discovery
- HTTP technology fingerprinting
- WordPress scanning
- CVE exploitation attempts
- Bad and automated user agents
- HTTP crawling and generic probing
- Jira and other application exploit scans
Skills Demonstrated
Engineering disciplines covered
Linux
Firewall administration, networking and service troubleshooting.
Containers
Docker Compose, networking, volumes and service integration.
Observability
Prometheus metrics, exporters, Grafana dashboards and alerts.
Security
Threat detection, intelligence, response and attack analysis.
Operations
Health monitoring, incident visibility and operational support.
Documentation
Architecture, implementation details and public case-study design.
Lessons Learned
Key engineering outcomes
Behaviour-based detection provides context that cannot be achieved through static firewall rules alone.
Community intelligence significantly reduces exposure to known malicious sources, while local detections reveal activity specific to the hosted environment.
The project also reinforced that a security control is much more valuable when its health, effectiveness and operational impact can be measured clearly.
Live Evidence
Explore the public security dashboard
The externally shared Grafana dashboard provides a sanitised, read-only view of live security telemetry.