A collection to defend Nextcloud instance against common attacks :

• Nextcloud parser
• Nextcloud bruteforce, enumeration and trusted domain detection

Contributed by Håvard Moen and a1ad

Example acquisition for this collection :

---
filenames:
 - /var/www/nextcloud/data/nextcloud.log
labels:
  type: Nextcloud

---
source: journalctl
journalctl_filter:
  - "SYSLOG_IDENTIFIER=Nextcloud"
labels:
  type: syslog

• Use the filename version if you have the default setting of logging to file
• Use the journalctl version if you are sending logs to syslog or systemd and read the logs from journald