#Crowdsec
Post-mortem: two WAF outages in the same morning
An invalid option stopped CrowdSec (1 h outage), then large file uploads exhausted the WAF's memory (25 min); uploads fixed and a new alert added.
ADR 0021: Intrusion detection and prevention in lightweight layers
Suricata on the firewall, CrowdSec shared by every machine with blocking at the firewall, detection rules on the centralised logs; no heavy SIEM.
Post-mortem: the whole household banned by the WAF
Intrusion tests run from the home network got its public address banned; the whole family received 403s on the sign-in portal.