What I love about it is it's open source nature. By parsing logs you can block bad actors just like you would with fail2ban - but with grok patterns which are way easier to write and implement. New parsers are easily constructed and it's really easy to keep a ton of bad traffic out of your network.

Simple installation and usage. Supports most applications from the start. A web (cloud) console. Ability to import more IPs to block and export.

Ease of use: One of the things that CrowdSec does great is its simplicity. Within a few minutes, I can install CrowdSec, configure it and install a bouncer to protect my servers against cyber attacks. Flexibility: CrowdSec is highly flexible in how it can remediate attacks. Many solutions will respond to an attack with a hard firewall block, while firewall blocks are an effective measure, it's false positive prone. CrowdSec allows you to apply the least restrictive remediation against an attack or go as aggressive as you like. Crowdsourced Threat Intelligence: Cyber attacks are getting increasingly sophisticated, easy to carry out and widespread, traditional methods of detecting malicious IP addresses are no longer effective. CrowdSec's solution to this is a collaboration with everybody from hobbyists and small businesses to large-scale enterprises like Google, Microsoft and Netflix. When everybody bands together, we can better understand the threat landscape and introduce strong security controls that work for everybody.