From 4b2286f5149361c4a286fa91befd570f38242695 Mon Sep 17 00:00:00 2001 From: mazzma12 Date: Fri, 11 Sep 2026 14:08:00 +0200 Subject: [PATCH] fix(console): enroll enables manual and context by default Co-Authored-By: Claude Opus 5 (1M context) Claude-Session: https://claude.ai/code/session_01ArauVu7mJ6S3d8HJr8yXN4 --- CHANGELOG.md | 4 ++++ skills/crowdsec/references/install/console.md | 17 +++++++++-------- 2 files changed, 13 insertions(+), 8 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 30c8a95..6e23001 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -23,6 +23,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 `on_challenge` / `on_challenge_submit` hooks, and pointers into `bot-detection/`. - `references/configure/bouncers/web-servers.md` — per-bouncer bot-detection capability column. +### Fixed +- `references/install/console.md` — `cscli console enroll` enables `manual` and `context` + (with `tainted`); the `share_*` false defaults only apply to never-enrolled engines. + ## [0.2.3] - 2026-05-29 ## [0.2.2] - 2026-05-26 diff --git a/skills/crowdsec/references/install/console.md b/skills/crowdsec/references/install/console.md index a7160c0..26d0cba 100644 --- a/skills/crowdsec/references/install/console.md +++ b/skills/crowdsec/references/install/console.md @@ -27,7 +27,7 @@ Useful flags (from `cscli console enroll --help`): |---|---| | `--name ` | Label this engine in the Console (default is the machine ID — set this on multi-engine fleets). | | `--tags --tags ` | Group/filter engines in the Console. | -| `--enable ` / `--disable ` | Set sharing options at enroll time (see options below). | +| `--enable ` / `--disable ` | Set sharing options at enroll time (see options below), e.g. `--disable context`. | | `--overwrite` | Re-enroll an already-enrolled engine (e.g. moving it to another Console org). | | `--quick` | Non-interactive enroll. | @@ -38,14 +38,14 @@ If `online_api_credentials.yaml` is missing, `cscli capi register` then reload ## 2 — Console options (the part users get wrong) `cscli console status` shows five toggles. Default state on a fresh -enrolled engine: +enrolled engine (`cscli console enroll` switches on `manual`, `tainted` and `context`; untested here): | Option | Default | What it does | |---|---|---| | `custom` | ✅ on | Forward alerts from your custom scenarios | | `tainted` | ✅ on | Forward alerts from tainted (locally modified) scenarios | -| `manual` | ❌ off | Forward your manual `cscli decisions add` | -| `context` | ❌ off | Forward alert context (richer detail, more data) | +| `manual` | ✅ on | Forward your manual `cscli decisions add` | +| `context` | ✅ on | Forward alert context (richer detail, more data) | | `console_management` | ❌ **off** | **Receive** decisions/allowlists *from* the Console | The trap: **`console_management` is off by default**. Centralized blocklists and @@ -56,10 +56,11 @@ sudo cscli console enable console_management sudo systemctl reload crowdsec ``` -These map to `share_*` keys in `/etc/crowdsec/console.yaml` -(`share_custom: true`, `share_tainted: true`, `share_manual_decisions: false`, -`share_context: false`) — but use `cscli console enable/disable `, not hand -edits. `all` is a valid target (`cscli console enable all`). +These map to `share_*` keys in `/etc/crowdsec/console.yaml`. A never-enrolled +engine falls back to `share_custom: true`, `share_tainted: true`, +`share_manual_decisions: false`, `share_context: false`. Use +`cscli console enable/disable `, not hand edits. `all` is a valid target +(`cscli console enable all`). ## 3 — Verify enrollment