1onsuccess: next_stage
2filter: "evt.Parsed.program == 'php-fpm'"
3name: crowdsecurity/pfsense-gui-logs
4description: "Parse pfSense web auth logs"
5grok: 
6  pattern: "/index.php: webConfigurator authentication error for user '%{USERNAME:username}' from: %{IPORHOST:source_ip}"
7  apply_on: message
8statics:
9  - meta: service
10    value: pfsense-gui
11  - meta: username
12    expression: "evt.Parsed.username"
13  - meta: source_ip
14    expression: evt.Parsed.source_ip
15  - meta: log_type
16    value: pfsense-gui-failed-auth
17