Install with a top-level collection
6 collections include itsudo cscli collections install ZoeyVid/npmplusInstalls 5 parsers and 54 scenarios, via WAF - Generic Rules.
View NPMplus →Installation
sudo cscli parsers install crowdsecurity/appsec-logsThen reload CrowdSec: sudo systemctl reload crowdsec
Sign in to see which of your engines run it →Configuration
Hover a line or a note to see what each field does.
onsuccess: next_stageformat: 3.0#debug: truefilter: "evt.Parsed.program == 'appsec' && evt.Parsed.source not in ['crowdsec-appsec-challenge', 'crowdsec-appsec-rate-limit']"name: crowdsecurity/appsec-logsdescription: "Parse Appsec events"statics:- meta: servicevalue: appsec- meta: source_ipexpression: "evt.Parsed.source_ip"- meta: target_hostexpression: "evt.Parsed.target_host"- meta: request_uuidexpression: "evt.Parsed.req_uuid"- meta: target_uriexpression: "evt.Parsed.target_uri"#was the request blocked ?- meta: log_typeexpression: |evt.Appsec.HasInBandMatches ? "appsec-block" : "appsec-info"- meta: rule_nameexpression: evt.Appsec.GetName()- meta: rule_idsexpression: Sprintf("%+v", evt.Appsec.GetRuleIDs())- meta: remediation_cmpt_ipexpression: "evt.Parsed.remediation_cmpt_ip"
Installed on
Know where it runs
Sign in to see the Security Engines that run this log parser, the version they run and whether it was modified locally.