cscli parsers install crowdsecurity/pam-logsA minimal parser for pam, supports only :
1onsuccess: next_stage2filter: "evt.Parsed.program == 'sudo'"3name: crowdsecurity/pam-logs4description: "Parse pam logs"5nodes:6 - grok:7 pattern: 'pam_tally2\(sudo:auth\): user %{NOTSPACE:username} \(%{NUMBER:uid}\) tally \d, deny \d'8 apply_on: message9 statics:10 - meta: log_type11 value: pam_user_lock12 - grok:13 pattern: 'pam_unix\(sudo:auth\): authentication failure; logname=%{NOTSPACE:logname} uid=%{NUMBER:uid} euid=%{NUMBER:euid} tty=%{NOTSPACE:tty} ruser=%{NOTSPACE:ruser} rhost=%{GREEDYDATA:rhost} user=%{NOTSPACE:username}'14 apply_on: message15 statics:16 - meta: log_type17 value: pam_failed_auth18statics:19 - meta: service20 value: pam21 - meta: username22 expression: "evt.Parsed.username"23