CrowdSec

Solution

CrowdSec moved core cyber-threat intelligence and telemetry workloads onto MongoDB so it could iterate faster and turn security data into a richer product. Its open source engines detect attacks on host machines, remediate them locally, and send the resulting events to CrowdSec’s cloud platform, where AI and machine-learning models classify malicious IP addresses and publish curated blocklists. As the company grew, PostgreSQL schema migrations and version upgrades slowed development, so CrowdSec shifted increasing volumes of API and CTI data to MongoDB Atlas, added Atlas Search for fast queries, adopted Atlas Vector Search to cluster IPs with similar behavior, and used Time Series collections for high-volume engine telemetry. Data Federation exports colder data for deeper analysis, and Professional Services helped tune indexing and collection design. This integrated architecture lets CrowdSec search, enrich, and analyze huge threat datasets without breaking developer velocity.

Data flow

Host engines detect attacks and send telemetry to CrowdSec’s cloud, Atlas stores CTI and blocklist data, Atlas Search and Vector Search expose that intelligence for queries and similarity analysis, and Data Federation moves colder data into deeper analytical workflows.