A collection to defend Meshcentral instance against common attacks :

• Meshcentral parser
• Meshcentral bruteforce detection

Example acquisition for this collection :

You need to add the following in the Meshcentral config file before Meshcentral starts logging: "authLog": "/opt/meshcentral/meshcentral-data/auth.log"

1---
2filenames:
3 - /opt/meshcentral/meshcentral-data/auth.log
4labels:
5  type: meshcentral

For Docker directly

1---
2source: docker
3container_name:
4 - meshcentral
5#container_id:
6# - 843ee92d231b
7labels:
8  type: meshcentral