asterisk-logs

1name: crowdsecurity/asterisk-logs
2description: "Parse Asterisk logs"
3filter: "evt.Parsed.program == 'asterisk'"1
4onsuccess: next_stage2
5nodes:3
6  - grok:4
7      pattern: '(\[%{DATA:timestamp}\] )?SECURITY\[%{NUMBER}\].* SecurityEvent="InvalidAccountID",EventTV="%{DATA:event_timestamp}",Severity="Error",Service="%{NOTDQUOTE:asterisk_service}",EventVersion="%{NUMBER}",AccountID="%{NOTDQUOTE:username}",SessionID="%{NOTDQUOTE:asterisk_session_id}",LocalAddress="IPV%{NUMBER}/(UDP|TCP|TLS)/%{IPORHOST:target_ip}/%{NUMBER:target_port}",RemoteAddress="IPV%{NUMBER}/(UDP|TCP|TLS)/%{IPORHOST:source_ip}/%{NUMBER:source_port}"'
8      apply_on: message
9      statics:5
10        - meta: log_type
11          value: asterisk_failed_auth
12        - target: evt.StrTime
13          expression: evt.Parsed.timestamp
14        - meta: target_user
15          expression: evt.Parsed.username
16        - meta: session_id
17          expression: evt.Parsed.asterisk_session_id
18        - meta: asterisk_service
19          expression: evt.Parsed.asterisk_service
20  - grok:4
21      pattern: '(\[%{DATA:timestamp}\] )?SECURITY\[%{NUMBER}\].* SecurityEvent="ChallengeResponseFailed",EventTV="%{DATA:event_timestamp}",Severity="Error",Service="%{NOTDQUOTE:asterisk_service}",EventVersion="%{NUMBER}",AccountID="%{NOTDQUOTE:username}",SessionID="%{NOTDQUOTE:asterisk_session_id}",LocalAddress="IPV%{NUMBER}/(UDP|TCP|TLS)/%{IPORHOST:target_ip}/%{NUMBER:target_port}",RemoteAddress="IPV%{NUMBER}/(UDP|TCP|TLS)/%{IPORHOST:source_ip}/%{NUMBER:source_port}"'
22      apply_on: message
23      statics:5
24        - meta: log_type
25          value: asterisk_failed_auth
26        - target: evt.StrTime
27          expression: evt.Parsed.timestamp
28        - meta: target_user
29          expression: evt.Parsed.username
30        - meta: session_id
31          expression: evt.Parsed.asterisk_session_id
32        - meta: asterisk_service
33          expression: evt.Parsed.asterisk_service
34  - grok:4
35      pattern: '(\[%{DATA:timestamp}\] )?SECURITY\[%{NUMBER}\].* SecurityEvent="InvalidPassword",EventTV="%{DATA:event_timestamp}",Severity="Error",Service="%{NOTDQUOTE:asterisk_service}",EventVersion="%{NUMBER}",AccountID="%{NOTDQUOTE:username}",SessionID="%{NOTDQUOTE:asterisk_session_id}",LocalAddress="IPV%{NUMBER}/(UDP|TCP|TLS)/%{IPORHOST:target_ip}/%{NUMBER:target_port}",RemoteAddress="IPV%{NUMBER}/(UDP|TCP|TLS)/%{IPORHOST:source_ip}/%{NUMBER:source_port}"'
36      apply_on: message
37      statics:5
38        - meta: log_type
39          value: asterisk_failed_auth
40        - target: evt.StrTime