1onsuccess: next_stage
2format: 3.0
3
4filter: "evt.Parsed.program == 'appsec' && evt.Parsed.source == 'crowdsec-appsec-challenge'"
5name: crowdsecurity/appsec-bot-detection-logs
6description: "Parse AppSec bot-detection / challenge events"
7statics:
8 - meta: service
9 value: appsec
10 - meta: log_type
11 value: appsec-challenge
12 - meta: source_ip
13 expression: "evt.Parsed.source_ip"
14 - meta: target_host
15 expression: "evt.Parsed.target_host"
16 - meta: request_uuid
17 expression: "evt.Parsed.req_uuid"
18 - meta: target_uri
19 expression: "evt.Parsed.target_uri"
20 - meta: challenge_event
21 expression: evt.Parsed.challenge_event
22 - meta: challenge_difficulty
23 expression: evt.Parsed.challenge_difficulty
24 - meta: challenge_fail_reason
25 expression: evt.Parsed.challenge_fail_reason
26 - meta: fsid
27 expression: evt.Parsed.fsid
28 - meta: fingerprint_bot
29 expression: evt.Parsed.fingerprint_bot
30 - meta: http_user_agent
31 expression: evt.Parsed.user_agent
32 - meta: request_score
33 expression: evt.Parsed.request_score
34 - meta: request_score_reasons
35 expression: evt.Parsed.request_score_reasons
36
37
38
39 - meta: os
40 expression: 'evt.Unmarshaled.fingerprint != nil ? evt.Unmarshaled.fingerprint.Platform() : ""'
41
