1#let's try to post-process nginx error log to have naxsi pattern
2filter: "evt.Meta.log_type == 'http_error-log' && evt.Parsed.program == 'nginx'"
3description: "Enrich logs if its from NAXSI"
4name: crowdsecurity/naxsi-logs
5grok:
6  name: "NAXSI_EXLOG"
7  apply_on: message
8statics:
9  - target: evt.Meta.log_type
10    value: waf_naxsi-log
11  - meta: source_ip
12    expression: "evt.Parsed.naxsi_src_ip"
13  - meta: http_path
14    expression: "evt.Parsed.http_path"
15  - meta: dest_ip
16    expression: "evt.Parsed.target_ip"