Plugin

CrowdSec

Unofficial CrowdSec plugin, not affiliated with CrowdSec: alerts, bans and top threats from your Local API in the EmDash admin.

• Category: crowdsec
• Status: available
• Version: 0.1.3
• Price: Unknown
• Source: Official plugin registry
• Install method: Sandboxed registry plugin
• Verified: 2026-10-21
• Compatibility: Not stated in the public registry profile
• Maintainer: Shane Lord

Registry listing Repository

Copy page link Open in Claude Open in ChatGPT

Share on X Share on LinkedIn Share on Reddit

Description

An unofficial plugin. It is not affiliated with, endorsed by or supported by CrowdSec.

CrowdSec in the EmDash admin, read from your CrowdSec Local API with a machine login of its own.

On the dashboard: a CrowdSec card with the last 24 hours’ alerts against the 24 before, the bans in force now, alerts by kind (WAF, bot challenge, behaviour) and the top scenarios.

CrowdSec page: 7, 30 or 90 days of alerts by kind and bans issued per day, with the top scenarios, source addresses, countries, AS organisations and targeted paths.

Alerts: an explorer of the stored alerts. Periods from an hour to everything kept or since your last visit, kind tabs, two breakdowns with histograms, filters by address range, country, scenario, behaviour, network, path or engine, alerts grouped by address, and a live detail of each alert.

Decisions: the decisions LAPI enforces now, read live and sorted by expiry.

Traffic charts: malicious traffic discarded by the firewall bouncer, split by community blocklist, your detections and manual bans, its share of all traffic, web requests inspected and blocked, the bot challenge, and active bans by source. From your own engine’s and bouncer’s metrics, never CrowdSec’s cloud.

MCP tools: a summary, top threats, an alerts explorer, traffic, active decisions and the alerts for one address, plus three that change things.

Optional changes: with Allow changes on, administrators can ban an address or range for a fixed time, remove a decision and delete old alerts. A ban never covers your own address, the site’s, the LAPI host’s, your protected addresses, private space or an allowlisted address.

Days run in your time zone. It needs a CrowdSec LAPI the site can reach.

Installation

You need CrowdSec 1.7 or later with its Local API on a public HTTPS hostname (EmDash refuses private addresses), and EMDASH_ENCRYPTION_KEY set on the site (npx emdash secrets generate makes one).

1. On the CrowdSec host, create a machine for the plugin: sudo cscli machines add emdash-crowdsec --auto -f /root/emdash-crowdsec.yaml. The file holds its ID and password.
2. Publish LAPI behind a reverse proxy that admits only the EmDash server’s address and only these routes: POST /v1/watchers/login, GET /v1/alerts, GET /v1/alerts/. For changes, also POST /v1/alerts, DELETE /v1/alerts/, DELETE /v1/decisions/ and POST /v1/allowlists/check. Never admit DELETE /v1/decisions without an id. Exempt the path from any bot challenge. The README has nginx and Traefik examples for a single host.
3. Install the plugin from the Registry. Its one permission is network access: to your LAPI URL, and to cloudflare-dns.com while changes are on.
4. In Plugins, open the plugin’s settings: enter the LAPI URL (without /v1), the machine ID and password, and your time zone. Save.
5. Open Plugins, CrowdSec, and select Check setup. Fix anything it names.
6. To allow bans and unbans, turn on Allow changes and add your server and home addresses to Protected addresses.

On Cloudflare Workers, the sync needs the Cron Trigger from EmDash’s deployment guide. To use the MCP tools, turn on Agent access for the plugin under Plugins.

FAQ

Does the plugin make my CrowdSec LAPI public? No. EmDash only lets a plugin call public HTTPS hostnames, so LAPI is reached through a path on one, but the proxy in front admits only your EmDash server’s address and only the routes the plugin uses. Everyone else gets 403, and every request also needs the plugin’s own machine login. LAPI itself still listens on 127.0.0.1. The README shows the setup.

The login fails with “incorrect Username or Password”, but the password is right. LAPI refuses a User-Agent that is not name/version. A proxy that replaces the plugin’s causes this.

The setup check says a route was refused (403). Your proxy does not admit it for the EmDash server. Add it as the README shows.

Why are the first days’ numbers low? History is read newest first, a window at a time. The page says while it is still being read.

Why is the Decisions list shorter than cscli decisions list? It lists your own decisions. The community blocklist and lists hold thousands more, shown as one count above the list.

Why is the top list approximate? Each day keeps its 25 most frequent values, so rarer ones are undercounted.

Where are the reputation badges? The plugin never asks CrowdSec’s cloud. The explorer shows local hints: Banned now and Seen before.

My LAPI collects alerts from several hosts. Each alert keeps the engine that raised it. Name them in the Engine names setting.

Why can’t I delete this alert? Deleting it would delete its decisions where bouncers never hear of it. Remove the decision, then delete the alert two minutes later.

Why was my ban refused? The message names the rule. The README lists them all.

Where do the traffic charts come from? Your engine’s and firewall bouncer’s own metrics, never CrowdSec’s cloud. Set their URLs in the settings.

Which time zone are the days in? The Time zone setting, Australia/Sydney unless changed. An unknown name pauses the sync, and history is kept.

Security

Report a security problem privately through the repository’s advisory form: https://github.com/shanelord01/emdash-crowdsec/security/advisories/new

What the plugin can reach

Network requests only, to two places: the LAPI URL you enter, and, while Allow changes is on, cloudflare-dns.com to look up the site’s and the LAPI host’s addresses. It has no access to your content, users or media. It uses only the LAPI routes the README lists, never DELETE /v1/decisions with a filter, never a bulk alert delete, and follows no redirect, so the password is never sent to another host. Plain HTTP and URLs with credentials in them are refused.

Credentials

The machine password is saved encrypted with EMDASH_ENCRYPTION_KEY. The LAPI token is never stored: each run logs in and keeps it in memory. Give the plugin a machine of its own, and publish LAPI so only the EmDash server and only the plugin’s routes get through.

Who can do what

Editors and administrators see the card, the pages and the read tools. Only administrators can change anything, and only with Allow changes on. On the pages the plugin checks the role itself. The write tools’ routes are limited to administrators by EmDash.

Ban protections

A ban is refused, naming the rule, when it covers the requester’s address (for an MCP tool, the client’s egress), the site’s or LAPI host’s addresses, a Protected addresses entry, private, loopback, link-local, CGNAT (including Tailscale’s 100.64.0.0/10), multicast or reserved space, a range wider than /16 or /48, or a CrowdSec allowlist entry, checked first since LAPI skips it for manual bans. IPv6 that carries IPv4 is judged by that IPv4 address, and Teredo is refused. A bad protected entry refuses every change.

Deleting alerts

An alert is deleted only once its decisions ended more than two minutes ago, since deleting it removes its decisions where bouncers never hear of it.

Changelog

0.1.3

• The pages sit in one CrowdSec folder in the sidebar (Overview, Alerts, Decisions) on EmDash 1.2 and later. Their addresses are unchanged, and older EmDash lists them one by one.
• Active bans by source needs the engine’s Prometheus level: full. The README’s Metrics section says so.
• No new permissions and no change to the MCP tools.

0.1.2

• The alerts explorer’s filters sit in one row and apply as you pick them.

0.1.1

• The CrowdSec alerts page is an explorer: periods from an hour to all history, or since your last visit, kind tabs, two switchable breakdowns with histograms, filters as chips, alerts grouped by address with a view of each address and a live detail of each alert, and Banned now and Seen before hints.
• Engines: each alert keeps the CrowdSec agent that raised it, as a breakdown and a filter, plus a column and a chart when there is more than one, named in the Engine names setting.
• A new MCP tool, alerts_explorer. EmDash asks for Agent access again on update.
• Stored alerts move into a compact alert log on the first syncs.
• Demo data is removed: the plugin needs a reachable LAPI. An install that used it asks for LAPI settings and clears its demo rows once they are set.
• Shorter times, narrower tables, a 90-day page in three-day bars, and a metrics sampler that follows its settings without a dashboard visit.

0.1.0

First release: the dashboard card, the CrowdSec page, the alerts and decisions pages, a setup check, traffic charts, eight MCP tools, and optional bans, unbans and alert deletion for administrators with protections for your own addresses.

Full history: CHANGELOG.md.