diff --git a/docs/widgets/services/crowdsec.md b/docs/widgets/services/crowdsec.md index da15a4788..977b0adb4 100644 --- a/docs/widgets/services/crowdsec.md +++ b/docs/widgets/services/crowdsec.md @@ -8,6 +8,9 @@ Learn more about [Crowdsec](https://crowdsec.net). See the [crowdsec docs](https://docs.crowdsec.net/docs/local_api/intro/#machines) for information about registering a machine, in most instances you can use the default credentials (`/etc/crowdsec/local_api_credentials.yaml`). +!!! note +Without the `limit24h` option, the widget will fetch all alerts which is limited to 100 by the API to avoid performance issues. + Allowed fields: `["alerts", "bans"]`. ```yaml @@ -16,4 +19,5 @@ widget: url: http://crowdsechostorip:port username: localhost # machine_id in crowdsec password: password + limit24h: true # optional, limits alerts to last 24h. Default: false ``` diff --git a/src/utils/config/service-helpers.js b/src/utils/config/service-helpers.js index c9b5f482c..ffe5f5803 100644 --- a/src/utils/config/service-helpers.js +++ b/src/utils/config/service-helpers.js @@ -279,6 +279,9 @@ export function cleanServiceGroups(groups) { slugs, symbols, + // crowdsec + limit24h, + // customapi mappings, display, @@ -473,6 +476,10 @@ export function cleanServiceGroups(groups) { if (defaultinterval) widget.defaultinterval = defaultinterval; } + if (limit24h !== undefined) { + widget.limit24h = !!limit24h; + } + if (type === "docker") { if (server) widget.server = server; if (container) widget.container = container; diff --git a/src/widgets/crowdsec/component.jsx b/src/widgets/crowdsec/component.jsx index f567ad70c..704001008 100644 --- a/src/widgets/crowdsec/component.jsx +++ b/src/widgets/crowdsec/component.jsx @@ -9,7 +9,7 @@ export default function Component({ service }) { const { widget } = service; - const { data: alerts, error: alertsError } = useWidgetAPI(widget, "alerts"); + const { data: alerts, error: alertsError } = useWidgetAPI(widget, !!widget.limit24h ? "alerts24h" : "alerts"); const { data: bans, error: bansError } = useWidgetAPI(widget, "bans"); if (alertsError || bansError) { diff --git a/src/widgets/crowdsec/widget.js b/src/widgets/crowdsec/widget.js index d29fa1f16..1b60168d0 100644 --- a/src/widgets/crowdsec/widget.js +++ b/src/widgets/crowdsec/widget.js @@ -9,6 +9,9 @@ const widget = { alerts: { endpoint: "alerts", }, + alerts24h: { + endpoint: "alerts?limit=0&since=24h", + }, bans: { endpoint: "alerts?decision_type=ban&origin=crowdsec&has_active_decision=1", },