1
2onsuccess: next_stage
3#debug: false
4name: a1ad/meshcentral-logs
5description: "Parse meshcentral logs"
6filter: "evt.Parsed.program == 'meshcentral'"
7pattern_syntax:
8  MESHCENTRAL_CUSTOMUSER: "(%{EMAILADDRESS}|%{USERNAME})"
9  MESHCENTRAL_CUSTOMDATE: "%{MONTH} %{MONTHDAY} %{HOUR}:%{MINUTE}:%{SECOND}"
10nodes:
11  - grok:
12      pattern: '%{MESHCENTRAL_CUSTOMDATE:timestamp}.*Failed password for %{MESHCENTRAL_CUSTOMUSER:username} from %{IP:source_ip}.*'
13      apply_on: message
14      statics:
15        - meta: log_type
16          value: meshcentral_failed_auth
17
18statics:
19    - meta: service
20      value: meshcentral
21    - meta: user
22      expression: "evt.Parsed.username"
23    - meta: source_ip
24      expression: "evt.Parsed.source_ip"
25    - target: evt.StrTime
26      expression: evt.Parsed.timestamp
27