CrowdSec Dashboard Monitoring

BY | Jun 4, 2026 | Network Security

CrowdSec Dashboard Setup: Local Monitoring & Web UI (2026)

Once CrowdSec is running, you need visibility into what it is doing. The CrowdSec dashboard provides real-time insights into blocked IPs, attack patterns, and your security posture.

This guide covers setting up both the command-line dashboard and the full web-based interface for comprehensive monitoring.

Dashboard Options Overview

Command Line

cscli Console

Built-in terminal interface requiring no additional setup. Perfect for quick checks and remote servers without graphical access.

Web Interface

Metabase Dashboard

Full-featured web UI with graphs, charts, and historical data. Requires separate installation but provides the best visualization.

Third Party

Prometheus & Grafana

Enterprise monitoring integration for existing observability stacks. Export metrics to your centralized monitoring system.

Step 1: Command Line Dashboard (Built-in)

The fastest way to monitor CrowdSec is using the built-in cscli commands. No additional installation required.

# View current bans and decisions
sudo cscli decisions list

# View recent alerts
sudo cscli alerts list

# Check metrics and statistics
sudo cscli metrics

# View hub status (collections, parsers, scenarios)
sudo cscli hub list

Step 2: Install Metabase Dashboard (Web UI)

For a full graphical interface, install the official CrowdSec Metabase dashboard. This provides the best visualization of your security data.

# Install the CrowdSec dashboard (Metabase)
sudo cscli dashboard setup

# Start the dashboard service
sudo systemctl start crowdsec-dashboard

# Enable auto-start
sudo systemctl enable crowdsec-dashboard

By default, the dashboard runs on port 3000. Access it at http://your-server-ip:3000

Step 3: Configure Dashboard Access

Secure your dashboard by changing default credentials and configuring proper access.

# Set up admin user (run on first access)
# Default credentials: [email protected] / admin

# Change default password immediately after login
# Navigate to Admin Settings > Authentication

# Configure SMTP for alerts (optional)
sudo cscli config set --config-key notifications

For production environments, place the dashboard behind your reverse proxy with authentication:

# Nginx Proxy Manager advanced configuration
location /crowdsec/ {
    proxy_pass http://localhost:3000/;
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
}

Step 4: Key Metrics to Monitor

Critical

Active Bans

Number of currently banned IPs. Sudden spikes indicate active attacks. Monitor for false positives if legitimate users are blocked.

Trends

Attack Patterns

Geographic origin of attacks, most targeted services, and time-based patterns. Helps identify if you are being specifically targeted.

Health

Parser Performance

Lines parsed per second, dropped lines, and scenario triggers. Indicates if CrowdSec is keeping up with your log volume.

Step 5: Set Up Notifications

Configure alerts so you are notified of significant security events without constantly checking the dashboard.

# Create notification configuration
sudo nano /etc/crowdsec/notifications/email.yaml

# Example email notification for critical bans
type: email
name: email_default
log_level: info
format: |
  {{range . -}}
  {{$Alert := . -}}
  {{range .Decisions -}}
  {{.Value}} banned for {{.Duration}}: {{.Scenario}}
  {{end -}}
  {{end -}}
smtp:
  host: smtp.gmail.com
  port: 587
  user: [email protected]
  pass: your-app-password
  from: [email protected]
  to: [email protected]
  auth_type: login

Dashboard Best Practices

Secure Access

Never expose the CrowdSec dashboard directly to the internet. Always place it behind a reverse proxy with authentication or VPN access only.

Regular Review

Schedule weekly reviews of blocked IPs and attack patterns. Look for trends that might indicate need for configuration tuning.

Backup Data

The Metabase dashboard stores historical data locally. Include this in your backup strategy to maintain attack history across server rebuilds.

Troubleshooting Common Issues

Dashboard Will Not Start

Check port conflicts. Metabase uses port 3000 by default which may conflict with other services. Edit configuration to change ports if needed.

No Data Showing

Verify CrowdSec is actually parsing logs. Run cscli metrics to confirm lines are being processed. Check that collections are enabled for your services.

High Resource Usage

The Metabase dashboard can be memory intensive. For low-resource servers, stick with cscli commands or use Prometheus export instead.

Questions for the Community

Your Dashboard Setup

Are you using the Metabase web UI, command line only, or integrated with Prometheus and Grafana?

Alerting Strategy

How do you handle notifications? Email, Slack, Discord, or silent monitoring only?

Third Party Integrations

Have you connected CrowdSec metrics to external monitoring systems? What works well?

A well-configured dashboard transforms CrowdSec from a black-box security tool into a transparent, monitorable defense system. The visibility it provides is essential for maintaining confidence in your security posture.

Disclaimer

This content is for educational and informational purposes only. It is not technical advice. Dashboard access should always be properly secured. Never expose security monitoring interfaces to the public internet without authentication.

DISCUSSION

No replies yet. Be the first to join the discussion!