appsec-bot-detection-logs

1onsuccess: next_stage1
2format: 3.0
3#debug: true
4filter: "evt.Parsed.program == 'appsec' && evt.Parsed.source == 'crowdsec-appsec-challenge'"2
5name: crowdsecurity/appsec-bot-detection-logs
6description: "Parse AppSec bot-detection / challenge events"
7statics:3
8  - meta: service
9    value: appsec
10  - meta: log_type
11    value: appsec-challenge
12  - meta: source_ip
13    expression: "evt.Parsed.source_ip"
14  - meta: target_host
15    expression: "evt.Parsed.target_host"
16  - meta: request_uuid
17    expression: "evt.Parsed.req_uuid"
18  - meta: target_uri
19    expression: "evt.Parsed.target_uri"
20  - meta: challenge_event
21    expression: evt.Parsed.challenge_event
22  - meta: challenge_difficulty
23    expression: evt.Parsed.challenge_difficulty
24  - meta: challenge_fail_reason
25    expression: evt.Parsed.challenge_fail_reason
26  - meta: fsid
27    expression: evt.Parsed.fsid
28  - meta: fingerprint_bot
29    expression: evt.Parsed.fingerprint_bot
30  - meta: http_user_agent
31    expression: evt.Parsed.user_agent
32  - meta: request_score
33    expression: evt.Parsed.request_score
34  - meta: request_score_reasons
35    expression: evt.Parsed.request_score_reasons
36  # Friendly OS straight from the fingerprint helper (high-entropy client-hint
37  # platform, falling back to navigator.platform). The nil guard covers
38  # "requested" challenge events, which carry no fingerprint.
39  - meta: os
40    expression: 'evt.Unmarshaled.fingerprint != nil ? evt.Unmarshaled.fingerprint.Platform() : ""'