Hmm I keep hearing about it but haven't looked into it. One thing I have set up between my systems if they share the blocked IPs with each other so every server drops a blocked address at the same time... I assume crowdsec has something similar for local sharing so I don't have to wait for a blocked IP to be sent to them, added to the database, and sent back to my local machines again?