1filter: "evt.Parsed.program == 'exchange-imap'"
2onsuccess: next_stage
3
4name: crowdsecurity/exchange-imap-logs
5description: "Parse exchange IMAP logs"
6
7
8grok:
9 pattern: "%{TIMESTAMP_ISO8601:date},%{DATA:session_id},%{INT:sequence_number},%{IPORHOST:server_ip}:%{INT:server_port},%{IPORHOST:client_ip}:%{INT:client_port},%{DATA:username},%{INT:duration},%{INT:rqsize},%{INT:rpsize},%{WORD:command},%{DATA:parameters},%{DATA}AuthFailed:LogonDenied\",%{DATA:puid}?"
10 apply_on: message
11statics:
12 - target: evt.StrTime
13 expression: evt.Parsed.date
14 - meta: source_ip
15 expression: evt.Parsed.client_ip
16 - meta: service
17 value: exchange
18 - meta: log_type
19 value: imap
20 - meta: sub_type
21 value: auth_fail
