CrowdSec Integration — ThreatHive.net

Verify CrowdSec is installed If CrowdSec isn't already running, follow the official installation guide at docs.crowdsec.net before continuing.

Create the import script Save the script below to /usr/local/bin/import_threathive.sh:

#!/bin/bash

BLOCKLIST_URL="https://threathive.net/hiveblocklist.txt"
TMPFILE="/tmp/hiveblocklist.txt"
IMPORTFILE="/tmp/hiveblocklist_bulk.json"

# Download the latest blocklist
curl -s "$BLOCKLIST_URL" -o "$TMPFILE" || exit 1

# Clear previous ThreatHive decisions
sudo cscli decisions delete --origin "threathive" > /dev/null 2>&1

# Build bulk JSON payload
echo "[" > "$IMPORTFILE"
first=1
while read -r ip; do
    [[ "$ip" =~ ^#.*$ || -z "$ip" ]] && continue
    [ $first -eq 0 ] && echo "," >> "$IMPORTFILE"
    echo "{\"type\": \"ban\", \"value\": \"$ip\", \"origin\": \"threathive\", \"scenario\": \"external blocklist\", \"duration\": \"24h\"}" >> "$IMPORTFILE"
    first=0
done < "$TMPFILE"
echo "]" >> "$IMPORTFILE"

# Import decisions in bulk
sudo cscli decisions import -i "$IMPORTFILE" --duration 24h

Then make it executable:

sudo chmod +x /usr/local/bin/import_threathive.sh

Run the script manually to test Execute once to fetch and load the current blocklist:

sudo /usr/local/bin/import_threathive.sh

Expected output:

INFO[0000] 0 decision(s) deleted
Parsing json
You are about to add 88994 decisions, this may take a while

Verify decisions were imported Confirm the IPs are active in CrowdSec:
```
sudo cscli decisions list
```
You should see entries like:
```
| 204335 | threathive | Ip:1.0.254.208 | threathive | ban | 24h |
```
Automate with cron
1. Open the root crontab:
```
sudo crontab -e
```
2. Add a daily refresh at midnight:
```
0 0 * * * /usr/local/bin/import_threathive.sh > /dev/null 2>&1
```
3. Save and exit. Cron will now keep the decision list current every 24 hours.