• ALERTS
  • LOGS
  • REPORTS
  • HUMAN

How to monitor security events with your AI

Connect CrowdSec to your AI client once. From then on, your agent watches the decision stream for new blocks and network changes.

Ask AI about this page

Short answer

How can I track real-time security blocks with my AI?

Your AI uses the decision stream to see every new block or change in your network defense. It turns raw security data into actionable summaries and alerts. You get a clear view of what's being blocked without manual log checking.

Security outcomes.

Where your data lands.

The AI processes incoming decisions and routes them to your preferred destination.

ALERTS

Real-time notifications

The AI watches the stream and sends a message to your Slack or Discord when a significant block occurs.

LOGS

Structured event history

The AI pulls decision data and writes it to a Google Sheet or database for long-term tracking.

REPORTS

Security summaries

The AI analyzes the stream to create a summary of recent attack patterns or frequent offenders.

HUMAN

Manual intervention

The AI flags suspicious activity that requires you to manually review firewall rules or IP whitelists.

The workflow

What your AI does when a decision is made.

The AI acts as a continuous observer of your CrowdSec instance.

  1. Watch the stream

    The AI stays connected to your CrowdSec instance to catch new decisions immediately.

    get_decisions_stream

  2. Filter events

    The AI looks through the stream to find specific IP addresses or types of attacks you care about.

    get_decisions_stream

  3. Summarize threats

    The AI interprets the raw decision data to explain why a specific entity was blocked.

    get_decisions_stream

  4. Alert you

    The AI prepares a notification based on the latest stream updates.

    get_decisions_stream

Try it

Copy these to start.

Use these prompts to begin monitoring your network.

Starting points

These are ideas to get you moving. Swap out the specific channel or sheet names for your own.

CrowdSec Connector

You're all set. Choose your MCP client and follow the setup instructions.

Connector linkhttps://edge.vinkius.com/vk_preview_2elfrol73nICZiMR18YQg2LgVuwctPXwaxqoZfA4/mcp

Claude Desktop

Follow the steps below to connect in seconds.

  1. 1In Claude Desktop, open Settings → Connectors.
  2. 2Click “Add custom connector” and paste the connector link above as the remote MCP server URL.
  3. 3Click Add and start a new chat — CrowdSec capabilities are ready to use.
Configuration · claude_desktop_config.jsonCopy
{
  "mcpServers": {
    "crowdsec-mcp": {
      "url": "https://edge.vinkius.com/vk_preview_2elfrol73nICZiMR18YQg2LgVuwctPXwaxqoZfA4/mcp"
    }
  }
}
Copy into chat04

  • Watch the CrowdSec decision stream and tell me if any new IPs were blocked in the last hour.

  • Check the CrowdSec decision stream and send a summary of the most frequent attackers to my #security-alerts Slack channel.

  • Look at the recent decisions from CrowdSec and log every new block into my 'Network Defense' Google Sheet.

  • Summarize the last 10 decisions from the CrowdSec stream and tell me if there's a pattern in the blocked countries.

  • Claude
  • ChatGPT
  • Cursor
  • VS Code
  • Windsurf
  • Claude Code
  • JetBrains
  • Cline

Start here

Connect CrowdSec once, then ask.

Just provide your credentials through the secure connection link. Once connected, your AI can immediately start reading your decision stream.

Connect CrowdSec to your AI

FAQ

How the monitoring works

  • 01

    Can the AI block IPs for me?

    No. The AI only reads the decision stream. You must use your own tools or manual processes to change firewall rules or block IPs.

  • 02

    Does the AI delete any CrowdSec data?

    No. The AI is read-only. It cannot delete decisions, logs, or any existing data in your CrowdSec instance.

  • 03

    How often does the AI check for new blocks?

    The AI uses the decision stream to receive updates as they happen through the connection.

  • 04

    Can I use this with any AI client?

    Yes, as long as you are using an MCP-compatible client like Claude, Cursor, or Windsurf.

  • 05

    Do I need to keep a terminal window open?

    No. Vinkius hosts the connection, so the AI can access the stream whenever you interact with it.

  • More questions about CrowdSec? See everything the CrowdSec Connector can do

Connect CrowdSec to Claude, Cursor, ChatGPT & more