cscli parsers install crowdsecurity/cpanel-logsParser for cpanel logs.
1onsuccess: next_stage2filter: "evt.Parsed.program == 'cpanel'"3name: crowdsecurity/cpanel-logs4description: "Parse Cpanel logs"5pattern_syntax:6 NO_DOUBLE_QUOTE: '[^"]+'7 CPANEL_HEADER: \[%{DATA:date} \+[0-9]+\] info \[(cpaneld|whostmgrd)\] %{IP:remote_addr} - %{NOTSPACE:username} "%{WORD:verb} %{URIPATHPARAM:request} HTTP/%{NUMBER:http_version}"8nodes:9 - grok:10 pattern: '%{CPANEL_HEADER} FAILED LOGIN cpaneld: brute force attempt \(user %{DATA}\) has locked out IP %{IP}'11 apply_on: message12 statics:13 - meta: log_type14 value: auth_bf_attempt15 - target: evt.StrTime16 expression: evt.Parsed.date17 - grok:18 pattern: '%{CPANEL_HEADER} FAILED LOGIN cpaneld: brute force attempt \(user %{DATA:target_user}\) has locked out IP %{IP}'19 apply_on: message20 statics:21 - meta: log_type22 value: auth_bf_log23 - target: evt.StrTime24 expression: evt.Parsed.date25 - grok:26 pattern: '%{CPANEL_HEADER} FAILED LOGIN cpaneld: invalid cpanel user %{DATA:target_user}'27 apply_on: message28 statics:29 - meta: log_type30 value: auth_bf_log31 - target: evt.StrTime32 expression: evt.Parsed.date33 - grok:34 pattern: '%{CPANEL_HEADER} FAILED LOGIN cpaneld: %{DATA:target_user} login is not permitted to cpaneld'35 apply_on: message36 statics:37 - meta: log_type38 value: auth_bf_log39 - target: evt.StrTime40 expression: evt.Parsed.date41 - grok:42 pattern: '%{CPANEL_HEADER} FAILED LOGIN whostmgrd: login attempt to whm by a non-reseller/root'43 apply_on: message44 statics:45 - meta: log_type46 value: auth_bf_log47 - target: evt.StrTime48 expression: evt.Parsed.date49 - grok:50 pattern: '%{CPANEL_HEADER} FAILED LOGIN whostmgrd: user password incorrect'51 apply_on: message52 statics:53 - meta: log_type54 value: auth_bf_log55 - target: evt.StrTime56 expression: evt.Parsed.date57 - grok: # see https://docs.cpanel.net/knowledge-base/cpanel-product/the-cpanel-log-files/58 pattern: '%{IP:remote_addr} - %{NOTSPACE:username} \[%{DATE}:%{TIME} %{ISO8601_TIMEZONE}\] "%{WORD:verb} %{URIPATHPARAM:request} HTTP/%{NUMBER:http_version}" %{INT:status} %{INT:request_body_length} "%{NOTSPACE:http_referer}" "%{NO_DOUBLE_QUOTE:http_user_agent}" "%{NO_DOUBLE_QUOTE:auth_method}" "%{NO_DOUBLE_QUOTE:x_forwarded_for}" %{NUMBER:server_port}'59 apply_on: message60 statics:61 - meta: log_type62 value: http_access-log63statics:64 - meta: service65 value: http66 - meta: source_ip67 expression: "evt.Parsed.remote_addr"68 - meta: http_path69 expression: "evt.Parsed.request"70 - meta: http_verb71 expression: "evt.Parsed.verb"72 - meta: http_user_agent73 expression: "evt.Parsed.http_user_agent"74 - meta: http_status75 expression: "evt.Parsed.status"76 - meta: username77 expression: "evt.Parsed.username"