Skip to content

fix(console): enroll enables manual and context by default #26

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
buixor merged 1 commit into from
Sep 11, 2026
Merged

fix(console): enroll enables manual and context by default #26

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,6 +23,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
`on_challenge` / `on_challenge_submit` hooks, and pointers into `bot-detection/`.
- `references/configure/bouncers/web-servers.md` — per-bouncer bot-detection capability column.

### Fixed
- `references/install/console.md` — `cscli console enroll` enables `manual` and `context`
(with `tainted`); the `share_*` false defaults only apply to never-enrolled engines.

## [0.2.3] - 2026-05-29

## [0.2.2] - 2026-05-26
Expand Down
17 changes: 9 additions & 8 deletions skills/crowdsec/references/install/console.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,7 +27,7 @@ Useful flags (from `cscli console enroll --help`):
|---|---|
| `--name <instance_name>` | Label this engine in the Console (default is the machine ID — set this on multi-engine fleets). |
| `--tags <t> --tags <t>` | Group/filter engines in the Console. |
| `--enable <opt>` / `--disable <opt>` | Set sharing options at enroll time (see options below). |
| `--enable <opt>` / `--disable <opt>` | Set sharing options at enroll time (see options below), e.g. `--disable context`. |
| `--overwrite` | Re-enroll an already-enrolled engine (e.g. moving it to another Console org). |
| `--quick` | Non-interactive enroll. |

Expand All @@ -38,14 +38,14 @@ If `online_api_credentials.yaml` is missing, `cscli capi register` then reload
## 2 — Console options (the part users get wrong)

`cscli console status` shows five toggles. Default state on a fresh
enrolled engine:
enrolled engine (`cscli console enroll` switches on `manual`, `tainted` and `context`; untested here):

| Option | Default | What it does |
|---|---|---|
| `custom` | ✅ on | Forward alerts from your custom scenarios |
| `tainted` | ✅ on | Forward alerts from tainted (locally modified) scenarios |
| `manual` | ❌ off | Forward your manual `cscli decisions add` |
| `context` | ❌ off | Forward alert context (richer detail, more data) |
| `manual` | ✅ on | Forward your manual `cscli decisions add` |
| `context` | ✅ on | Forward alert context (richer detail, more data) |
| `console_management` | ❌ **off** | **Receive** decisions/allowlists *from* the Console |

The trap: **`console_management` is off by default**. Centralized blocklists and
Expand All @@ -56,10 +56,11 @@ sudo cscli console enable console_management
sudo systemctl reload crowdsec
```

These map to `share_*` keys in `/etc/crowdsec/console.yaml`
(`share_custom: true`, `share_tainted: true`, `share_manual_decisions: false`,
`share_context: false`) — but use `cscli console enable/disable <opt>`, not hand
edits. `all` is a valid target (`cscli console enable all`).
These map to `share_*` keys in `/etc/crowdsec/console.yaml`. A never-enrolled
engine falls back to `share_custom: true`, `share_tainted: true`,
`share_manual_decisions: false`, `share_context: false`. Use
`cscli console enable/disable <opt>`, not hand edits. `all` is a valid target
(`cscli console enable all`).

## 3 — Verify enrollment

Expand Down
Loading