Hub configuration

Name: emby-logs
Author: LePresidente

More info

emby-logs Configuration by LePresidente | CrowdSec Hub

« emby-logs »
v0.3 by LePresidente
Attack scenario

Parse emby logs

Installation

cscli parsers install LePresidente/emby-logs

Description

Parser for emby Logs.

1---
2filenames:
3 - /var/log/embyserver.txt
4labels:
5  type: emby

YAML Configuration

1onsuccess: next_stage
2#debug: false
3name: LePresidente/emby-logs
4description: "Parse emby logs"
5filter: "evt.Parsed.program == 'emby'"
6nodes:
7  - grok:
8      pattern: '%{TIMESTAMP_ISO8601:timestamp}.*?AUTH-ERROR: %{IP:source_ip} - Invalid username or password entered\.$'
9      apply_on: message
10      statics:
11        - meta: log_type
12          value: emby_failed_auth
13
14statics:
15    - meta: service
16      value: emby
17    - meta: source_ip
18      expression: "evt.Parsed.source_ip"
19    - target: evt.StrTime
20      expression: evt.Parsed.timestamp

Hub configuration

« emby-logs »v0.3 by LePresidenteAttack scenario

« emby-logs »
v0.3 by LePresidente
Attack scenario