1onsuccess: next_stage
2#debug: false
3name: MariuszKociubinski/bitwarden-logs
4description: "Parse bitwarden logs"
5filter: "evt.Parsed.program == 'bitwarden'"
6nodes:
7  - grok:
8      pattern: '^%{EXIM_DATE:timestamp}.*Failed login attempt\. %{IP:source_ip}.*$'
9      apply_on: message
10      statics:
11        - meta: log_type
12          value: bitwarden_failed_auth
13  - grok:
14      pattern: '^%{EXIM_DATE:timestamp}.*Failed login attempt\, 2FA invalid\. %{IP:source_ip}.*$'
15      apply_on: message
16      statics:
17        - meta: log_type
18          value: bitwarden_failed_auth
19
20statics:
21    - meta: service
22      value: bitwarden
23    - meta: source_ip
24      expression: "evt.Parsed.source_ip"
25    - target: evt.StrTime
26      expression: evt.Parsed.timestamp
27