UTMStack SIEM Security

• https://utmstack.com/

Installation

Step 1. Install CrowdSec

On Ubuntu/Debian/Rocky Linux, installation is simple with the official repo.

# Ubuntu / Debian
curl -s https://install.crowdsec.net | sudo bash

# Rocky Linux (or CentOS / RHEL)
curl -s https://install.crowdsec.net | sudo bash

That will install:

• The CrowdSec agent (parses logs, detects attacks).
• Some default scenarios (rules), e.g. SSH brute-force, HTTP scanners.
• The bouncer API (used to block bad IPs).

Step 2. Add a Firewall Bouncer

This is what actually blocks attackers once CrowdSec flags them.

# For iptables (works on most VPS):
sudo apt install crowdsec-firewall-bouncer-iptables -y   # Ubuntu/Debian

# For Rocky Linux / CentOS:
sudo yum install crowdsec-firewall-bouncer-iptables -y

If you’re using nftables, there’s also crowdsec-firewall-bouncer-nftables.

Step 3. Add Collections (for web + ssh)

CrowdSec uses “collections” (sets of rules) depending on what services you run.

sudo cscli collections install crowdsecurity/linux
sudo cscli collections install crowdsecurity/ssh
sudo cscli collections install crowdsecurity/nginx  # or apache2 if you use Apache

That way it monitors system logs, SSH, and your web server.

Step 4. Alerts to Telegram

CrowdSec can send alerts to Telegram, Slack, email, etc. using postoverflows or webhooks.

1. Install the notification plugin:

sudo apt install crowdsec-notifications-telegram -y   # Ubuntu/Debian
sudo yum install crowdsec-notifications-telegram -y   # Rocky

2. Edit the config:

sudo nano /etc/crowdsec/notifications/telegram.yaml

Fill in something like:

type: telegram
name: telegram_default
bot_token: "123456789:ABC-YourBotTokenHere"
chat_id: "987654321"
format: |
  CrowdSec Alert
  Scenario: {{ .Alert.GetScenario }}
  Source IP: {{ .Alert.Source.IP }}
  Decision: {{ .Alert.Decisions }}

To get a bot token, you create a bot via @BotFather in Telegram.
To get your chat_id, talk to @userinfobot.

3. Reload CrowdSec:

sudo systemctl reload crowdsec

Now, whenever CrowdSec blocks someone, you’ll get a Telegram ping.

Step 5. Test it

From another server (or a VPN), try to brute-force SSH or curl your server rapidly — you should see a block happen and a Telegram alert.

---

Community Blocklist

Step 1. Update your Hub

First, make sure your CrowdSec “hub” (the local rules/plugins library) is up to date:

sudo cscli hub update

Step 2. Install the Community Blocklist

CrowdSec maintains an “official curated” blocklist, called crowdsecurity/community-blocklist.

Install it with:

sudo cscli collections install crowdsecurity/community-blocklist

This tells your agent: “regularly fetch and enforce the global consensus ban list.”

---

Step 3. Verify It’s Active

Check what decisions (bans) are currently loaded:

sudo cscli decisions list

You should see entries like IP addresses with a reason such as community-blocklist.

To confirm the collection is installed:

sudo cscli collections list

You’ll see crowdsecurity/community-blocklist marked as installed.

Step 4. Automatic Updates

By default, CrowdSec updates this blocklist automatically every few hours.
If you want to force a refresh anytime:

sudo cscli hub update
sudo cscli collections upgrade crowdsecurity/community-blocklist

---

That’s it — your servers are now plugged into the global brain of CrowdSec