1
2onsuccess: next_stage
3debug: false
4filter: "evt.Parsed.program == 'dovecot'"
5name: crowdsecurity/dovecot-logs
6description: "Parse dovecot logs"
7pattern_syntax:
8 AUTH_FUNC: '[A-Za-z0-9_]+(\(\))?'
9nodes:
10 - grok:
11 pattern: "%{WORD:protocol}-login: %{DATA:dovecot_login_message}: user=<%{DATA:dovecot_user}>.*, rip=%{IP:dovecot_remote_ip}, lip=%{IP:dovecot_local_ip}"
12 apply_on: message
13 - grok:
14 pattern: "auth-worker\\(%{INT}\\): %{WORD:dovecot_user_backend}\\(%{DATA:dovecot_user},%{IP:dovecot_remote_ip},?%{DATA}\\): (%{AUTH_FUNC:auth_func} failed: )?%{DATA:dovecot_login_message}$"
15 apply_on: message
16 - grok:
17 pattern: "auth-worker\\(%{INT}\\): (Info: )?conn unix:auth-worker \\(pid=%{INT},uid=%{INT}\\): auth-worker<%{INT}>: %{WORD:dovecot_user_backend}\\(%{DATA:dovecot_user},%{IP:dovecot_remote_ip},?%{DATA}\\): (%{AUTH_FUNC:auth_func} failed: )?%{DATA:dovecot_login_message}$"
18 apply_on: message
19 - grok:
20 pattern: "auth: passwd-file\\(%{DATA:dovecot_user},%{IP:dovecot_remote_ip}\\): (%{AUTH_FUNC:auth_func} failed: )?%{DATA:dovecot_login_message}$"
21 apply_on: message
22statics:
23 - meta: log_type
24 value: dovecot_logs
25 - meta: source_ip
26 expression: "evt.Parsed.dovecot_remote_ip"
27 - meta: dovecot_login_result
28 expression: "any(['Authentication failure', 'Password mismatch', 'password mismatch', 'auth failed', 'unknown user'], {evt.Parsed.dovecot_login_message contains #}) ? 'auth_failed' : ''"
29
