A collection for portscan detection via iptables/nftables :

• iptables/nftables parser (like in -j LOG)
• multi port scan detection

Example acquisition for this collection :

1filenames:
2  - /var/log/kern.log
3labels:
4  type: syslog

Debian 12 example (without rsyslog)

1source: journalctl
2journalctl_filter:
3 - "-k"
4labels:
5  type: syslog

notes :

• Depending on your distribution/OS, paths to log files might change
• Only relevant if you are manually installing collection