cscli parsers install baudneo/zoneminder-logsA parser that searches for unknown user and incorrect password logins to ZoneMinder by using web_php.log as a data source.
Now supports new PHP date format; DEFAULT US/CAN format.
acquis.yaml entry - the type must be exactly as shown here or the parser will never be successful.
The log path is the default path on a debian based distro, change to point towards where your ZoneMinder web_php.log is1filenames:2 - /var/log/zm/web_php.log3labels:4 type: zoneminder
❗ The type MUST be zoneminder ❗
evt.Parsed.source_ip and evt.Meta.source_ipevt.Parsed.username and evt.Meta.username1#filter: '1==1' # Testing2filter: evt.Parsed.program == "zoneminder" # Production3#debug: true4onsuccess: next_stage5name: baudneo/zoneminder-logs6description: A parser for zoneminder web_php.log (Logins to DB/Web), now supports default PHP intl date format7pattern_syntax:8 ZM_TIME: '2[0123]|[01]?[0-9]:[0-5][0-9]:(?:[0-5]?[0-9]|60)\s?(AM|PM [A-Z]{3})?\.[0-9]{6}'9 ZM_BADUSER: '^%{MONTHNUM:month}[/-]%{MONTHDAY:day}[/-]%{YEAR:year},?[- ]%{ZM_TIME:time} web_php\[\d+]\.[A-Z]{3} \[(%{IP:source_ip})\]\s\[Could not retrieve user %{DATA:username} details\]'10 ZM_BADPASSWORD: '^%{MONTHNUM:month}[/-]%{MONTHDAY:day}[/-]%{YEAR:year},?[- ]%{ZM_TIME:time} web_php\[\d+]\.[A-Z]{3} \[(%{IP:source_ip})\]\s\[Login denied for user \"%{DATA:username}\"\]'11##NEW BAD USER# 12/17/22, 10:31:29 PM MST.557710 web_php[254894].ERR [10.0.1.5] [Could not retrieve user aaaa details] at /usr/share/zoneminder/www/includes/auth.php line 39512##NEW BAD PASS# 01/06/22, 10:31:29 PM MST.557710 web_php[688].ERR [99.1.1.1] [Login denied for user "validuser"] at /usr/share/zoneminder/www/includes/auth.php line 31313##OLD BAD USER# 01/06/22 09:26:15.117434 web_php[258].ERR [99.1.1.1] [Could not retrieve user testuser details] at /usr/share/zoneminder/www/includes/auth.php line 31314##OLD BAD PASS# 01/06/22 09:27:39.843338 web_php[688].ERR [99.1.1.1] [Login denied for user "validuser"] at /usr/share/zoneminder/www/includes/auth.php line 3131516nodes:17 - grok:18 name: "ZM_BADPASSWORD"19 apply_on: message20 statics:21 - meta: log_type22 value: zm_failed_auth23 - meta: log_subtype24 value: zm_bad_password25 - meta: username26 expression: evt.Parsed.username27 - grok:28 name: "ZM_BADUSER"29 apply_on: message30 statics:31 - meta: log_type32 value: zm_failed_auth33 - meta: log_subtype34 value: zm_bad_user35 - meta: username36 expression: evt.Parsed.username3738statics:39 - meta: source_ip40 expression: evt.Parsed.source_ip41 - target: StrTime42 expression: |-43 "20" + evt.Parsed.year + "/" + evt.Parsed.month + "/" + evt.Parsed.day + " " + evt.Parsed.time44