ApisCP - Generic Protection

ApisCP collection

A collection for ApisCP :

• Apache log parser for apisCP and httpd access_log
• Scenario to detect bruteforce on ApisCP admin page
• Collections for supported services:
  • crowdsecurity/apache2
  • crowdsecurity/dovecot
  • crowdsecurity/haproxy
  • crowdsecurity/mysql
  • crowdsecurity/postfix
  • crowdsecurity/pgsql
  • crowdsecurity/vsftpd

Acquisition template

Example acquisition for this collection :

1filenames:
2  - /usr/local/apnscp/storage/logs/access_log
3  - /usr/local/apnscp/storage/logs/error_log
4labels:
5  type: apache2
6---
7filenames:
8  - /var/log/pgsql/*.log
9labels:
10  type: postgres
11---
12filenames:
13  - /var/log/maillog
14labels:
15  type: syslog
16---
17filenames:
18  - /var/log/mysqld.log
19labels:
20  type: mysql
21---
22filenames:
23  - /var/log/vsftpd.log
24labels:
25  type: vsftpd

You can also monitor all the created Nexus by replacing /var/log/ by /home/virtual/<site_name>/var/log/.

notes :

• If you are using syslog, set type to syslog instead
• Depending on your distribution/OS, paths to log files might change
• Only relevant if you are manually installing collection