A collection to defend Nextcloud instance against common attacks :

• Nextcloud parser
• Nextcloud bruteforce, enumeration and trusted domain detection

Contributed by Håvard Moen and a1ad

Example acquisition for this collection :

1---
2filenames:
3 - /var/www/nextcloud/data/nextcloud.log
4labels:
5  type: Nextcloud

1---
2source: journalctl
3journalctl_filter:
4  - "SYSLOG_IDENTIFIER=Nextcloud"
5labels:
6  type: syslog

• Use the filename version if you have the default setting of logging to file
• Use the journalctl version if you are sending logs to syslog or systemd and read the logs from journald