Install with a top-level collection
1 collection include itsudo cscli collections install andreasbrett/baikalInstalls 1 parser and 1 scenario.
View baikal →Installation
sudo cscli parsers install andreasbrett/baikal-logsThen reload CrowdSec: sudo systemctl reload crowdsec
Sign in to see which of your engines run it →Configuration
Hover a line or a note to see what each field does.
onsuccess: next_stagefilter: "Upper(evt.Parsed.program) == 'BAIKAL'"name: andreasbrett/baikal-logsdescription: "Parse baikal logs"pattern_syntax:BAIKAL_FAILED_AUTH: '\[%{HTTPDERROR_DATE:timestamp}\].*\[client %{IP:source_ip}:%{INT:source_port}\] AH01071: Got error ''PHP message: user %{USERNAME:username} authentication failure for Baikal'''BAIKAL_FAILED_AUTH_NO_USER: '\[%{HTTPDERROR_DATE:timestamp}\].*\[client %{IP:source_ip}:%{INT:source_port}\] AH01071: Got error ''PHP message: user \(name stripped-out\) authentication failure for Baikal'''nodes:- grok:pattern: "%{BAIKAL_FAILED_AUTH}"apply_on: messagestatics:- meta: log_typevalue: baikal_failed_auth- meta: usernameexpression: evt.Parsed.username- grok:pattern: "%{BAIKAL_FAILED_AUTH_NO_USER}"apply_on: messagestatics:- meta: log_typevalue: baikal_failed_auth_no_userstatics:- meta: servicevalue: baikal- meta: source_ipexpression: "evt.Parsed.source_ip"- target: evt.StrTimeexpression: evt.Parsed.timestamp
Installed on
Know where it runs
Sign in to see the Security Engines that run this log parser, the version they run and whether it was modified locally.
Documentation
Parser for Baikal logs. Baikal does not produce dedicated logs but rather sends PHP errors into apache/nginx logs. Currently only apache error logs are supported by this parser.
1---2filenames:3 - /var/log/httpd/error.log4labels:5 type: Baikal