Crowdsec widget showing incorrect Number of alerts

[Helmchen-Lord]

Description

Basically, I'm dealing with the same issue that was already discussed in Discussions 3443.
I see 100 alerts in the widget, but there should only be 1 alert at the moment.
As already mentioned in the other discussion, updates from individual blocklists are also displayed in the widget as alerts, which I personally don't find particularly helpful.

I don't think the widget is very useful if all alerts are displayed.
Would it be possible for the widget to filter the alerts better? Possibly as an option?

There is also an error in the Homepage log because of the size of the alert list: API response for /api/services/proxy?type=crowdsec&group=Services&service=Crowdsec&endpoint=alerts exceeds 4MB. API Routes are meant to respond quickly. https://nextjs.org/docs/messages/api-routes-response-size-limit

Here is an example from my system that shows the difference between the alerts:

Update:
│ 376 │ crowdsecurity/community-blocklist (47 Ips) │ update : +15000/-0 IPs │ │ │ ban:47 │ 2024-05-10 18:40:56 +0000 UTC │

Real Ban:
│ 375 │ Ip:***.***.***.*** │ firewallservices/pf-scan-multi_ports │ DE │ 40021 NL-811-40021 │ ban:1 │ 2024-05-10 17:17:55.444260169 +0000 UTC │

Thanks in advance

Other

No response

[itguy327]

This is what I see as well.

[mgrimace]

#3443 - answered here previously, basically a limitation of the API afaik

[mukowman]

Is this not just a matter of adding the origin to the API call?
So, using /v1/alerts?has_active_decision=true&origin=cscli
The docs reference the following options for origin.
restrict results to this origin (ie. lists,CAPI,cscli)

[shamoon]

when I wrote the widget, no, that didn't work as it didnt return all of the correct alerts

[mukowman]

Interesting, I may be misunderstanding what the correct "alerts" are, but I observed the following.
If we use the cscli for the source of the correct alerts.
cscli alerts lists
returns a single alert which is one I manually added.
cscli alerts list --origin CAPI
returns a larger set matching the rest API call /v1/alerts

[lokiiiii]

I think that if you choose the origin = CAPI, you'll get all the results available from the website of crowdsec so it will display the IP purged / deleted locally and also the blocklists downloaded, that's why the results are not "right" compared to local decisions.
Would it be possible to update the widget to only fetch local cscli results ?