Hub configuration

Name: ombi-logs
Author: LePresidente

More info

ombi-logs Log Parser by LePresidente | CrowdSec Hub

« ombi-logs »
v0.2 by LePresidente
Attack scenario

Parse ombi logs

Installation

cscli parsers install LePresidente/ombi-logs

Description

Parser for Ombi Logs.

1---
2filenames:
3 - /var/log/ombi/log-*.txt
4labels:
5  type: ombi

YAML Configuration

1onsuccess: next_stage
2#debug: false
3name: LePresidente/ombi-logs
4description: "Parse ombi logs"
5filter: "evt.Parsed.program == 'ombi'"
6nodes:
7  - grok:
8      pattern: '%{TIMESTAMP_ISO8601:timestamp}.*?Failed login attempt by IP: %{IP:source_ip}'
9      
10      apply_on: message
11      statics:
12        - meta: log_type
13          value: ombi_auth_failed
14
15statics:
16    - meta: service
17      value: ombi
18    - meta: source_ip
19      expression: "evt.Parsed.source_ip"
20    - target: evt.StrTime
21      expression: evt.Parsed.timestamp

Hub configuration

« ombi-logs »v0.2 by LePresidenteAttack scenario

« ombi-logs »
v0.2 by LePresidente
Attack scenario