dropbear-logs Log Parser by crowdsecurity | CrowdSec Hub

dropbear-logs

Log parser

By: crowdsecurity
Version: 0.3

Parse dropbear logs

Install with a top-level collection

1 collection include it

sudo cscli collections install crowdsecurity/unifi

Installs 5 parsers and 2 scenarios.

View UniFi →

Installation

sudo cscli parsers install crowdsecurity/dropbear-logs

Then reload CrowdSec: sudo systemctl reload crowdsec

Configuration

Hover a line or a note to see what each field does.

parsers/s01-parse/crowdsecurity/dropbear-logs.yaml· 23 linesGitHub

1onsuccess: next_stage1
2filter: "evt.Parsed.program == 'dropbear'"2
3name: crowdsecurity/dropbear-logs
4description: "Parse dropbear logs"
5nodes:3
6  - grok: 4
7      pattern: "Bad PAM password attempt for '%{DATA:user}' from %{IP:source_ip}:%{INT:port}"
8      apply_on: message
9  - grok: 
10      pattern: "Login attempt for nonexistent user from %{IP:source_ip}:%{INT:port}"
11      apply_on: message
12  - grok: 
13      pattern: "Exit before auth from <%{IP:source_ip}:%{INT:port}>:"
14      apply_on: message
15statics:5
16  - meta: service
17    value: dropbear
18  - meta: target_user
19    expression: evt.Parsed.user
20  - meta: source_ip
21    expression: evt.Parsed.source_ip
22  - meta: log_type
23    value: ssh_failed-auth

Installed on

Know where it runs

Documentation

Parser for dropbear SSH server.