TL;DR: CrowdSec parses logs from various Data sources, normalizes and enriches them before applying heuristic scenarii to identify aggressive behaviors and protect you from most attack classes. Like with fail2ban, things like credential stuffing, web or port scans, ssh / ftp / telnet brute-force, and many others are really easy to defeat with the software, but CrowdSec modern grammar & architecture give the users more possibilities. The global thing is to generate a IP reputation Database, shared among our community members, that is fed by them, curated by us and sent back to all members. This could become the largest ever hack-interferometer.