1onsuccess: next_stage
2#debug: true
3filter: "evt.Parsed.program == 'kernel' and evt.Parsed.message contains 'IN=' and not (evt.Parsed.message contains 'ACCEPT')"
4name: crowdsecurity/iptables-logs
5description: "Parse iptables drop logs"
6statics:
7  - parsed: unused #this is never used setting to random var
8    expression: ParseKV(evt.Parsed.message, evt.Unmarshaled, "iptables")
9  - meta: service
10    expression: Lower(evt.Unmarshaled.iptables.PROTO)
11  - meta: log_type
12    expression: |
13        evt.Meta.log_type != "" ? evt.Meta.log_type : evt.Meta.service in ["tcp", "udp"] && evt.Unmarshaled.iptables.OUT == "" ? "iptables_drop" : ""
14  - meta: icmp_type
15    expression: evt.Unmarshaled.iptables.TYPE
16  - meta: icmp_code
17    expression: evt.Unmarshaled.iptables.CODE
18  - meta: source_ip
19    expression: "evt.Unmarshaled.iptables.SRC"
20## For backporting reason all previous variables will be reparsed out to the parsed object
21  - parsed: dst_port
22    expression: evt.Unmarshaled.iptables.DPT
23  - parsed: int_eth
24    expression: evt.Unmarshaled.iptables.IN
25  - parsed: src_ip
26    expression: evt.Unmarshaled.iptables.SRC
27  - parsed: dst_ip
28    expression: evt.Unmarshaled.iptables.DST
29  - parsed: length
30    expression: evt.Unmarshaled.iptables.LEN
31  - parsed: proto
32    expression: evt.Unmarshaled.iptables.PROTO
33  - parsed: src_port
34    expression: evt.Unmarshaled.iptables.SPT
35